Hi @joppedahlin, In the end I didn't use Grav for my project, but before i came to that decision I did come up with a workaround.
first in the twig template i used the following line to generate the menu.
{% for p in page.find('/'~grav.user.username ).children %}
grav.user.username returns the actual username that is used to login.
To prevent users seeing each others profiles / dashboards etc. I added the following to the .yaml user file. (replace XXXXXX with username, be consistent here!)
site:
login: true
site.XXXXXX: true
then on root level create a page for each 'user' and add the following to the page header. (replace XXXXXX with username, be consistent here!)
access:
site.XXXXXX: true
This way all the pages linked in the menu are under the 'user' page, which to which you restricted access in the page.header and allowed access to in the user.yaml
In the few tests that I conducted I wasn't able to access the pages of other users, also not when I used the absolute URL with their username in it etc. If it's completely s ecure im not sure, but the magic all happens inside Grav, so to a certain extend it should be fine to use.
Hopefully you manage to get it to work.