sass-mohfarawati/specs/admin.md

Admin Feature Spec

Current Implementation

Access model

• Middleware can protect admin routes with Basic Auth
• App login requires configured password and signed cookie session
• Failed password attempts trigger lockout

Routing

• Source pages live in

app/_admin

• Middleware rewrites to

app/admin-internal

• Development compatibility routes exist under

app/root

Capabilities

• Overview dashboard
• Maintenance mode
• Media Library
• Site Settings
• Marquee Settings
• SMTP Settings
• Contact Protection
• Portfolio categories
• Portfolio projects
• UI Kit page

Constraints

• Admin currently assumes a single shared operator credential model
• No role-based access control exists
• No audit log exists

Recommended Improvements

• Add per-user authentication if multiple operators are expected
• Add action audit logging for content and configuration changes
• Add tests around middleware rewriting and auth edge cases