# Admin Feature Spec

## Current Implementation

### Access model

- Middleware can protect admin routes with Basic Auth
- App login requires configured password and signed cookie session
- Failed password attempts trigger lockout

### Routing

- Source pages live in

`app/_admin`

- Middleware rewrites to

`app/admin-internal`

- Development compatibility routes exist under

`app/root`

### Capabilities

- Overview dashboard
- Maintenance mode
- Media Library
- Site Settings
- Marquee Settings
- SMTP Settings
- Contact Protection
- Portfolio categories
- Portfolio projects
- UI Kit page

## Constraints

- Admin currently assumes a single shared operator credential model
- No role-based access control exists
- No audit log exists

## Recommended Improvements

- Add per-user authentication if multiple operators are expected
- Add action audit logging for content and configuration changes
- Add tests around middleware rewriting and auth edge cases