49 lines
960 B
Markdown
49 lines
960 B
Markdown
# Admin Feature Spec
|
|
|
|
## Current Implementation
|
|
|
|
### Access model
|
|
|
|
- Middleware can protect admin routes with Basic Auth
|
|
- App login requires configured password and signed cookie session
|
|
- Failed password attempts trigger lockout
|
|
|
|
### Routing
|
|
|
|
- Source pages live in
|
|
|
|
`app/_admin`
|
|
|
|
- Middleware rewrites to
|
|
|
|
`app/admin-internal`
|
|
|
|
- Development compatibility routes exist under
|
|
|
|
`app/root`
|
|
|
|
### Capabilities
|
|
|
|
- Overview dashboard
|
|
- Maintenance mode
|
|
- Media Library
|
|
- Site Settings
|
|
- Marquee Settings
|
|
- SMTP Settings
|
|
- Contact Protection
|
|
- Portfolio categories
|
|
- Portfolio projects
|
|
- UI Kit page
|
|
|
|
## Constraints
|
|
|
|
- Admin currently assumes a single shared operator credential model
|
|
- No role-based access control exists
|
|
- No audit log exists
|
|
|
|
## Recommended Improvements
|
|
|
|
- Add per-user authentication if multiple operators are expected
|
|
- Add action audit logging for content and configuration changes
|
|
- Add tests around middleware rewriting and auth edge cases
|