mirror of
https://github.com/jjbrunton/Sauci.git
synced 2026-10-31 18:19:43 +00:00
85 lines
2.6 KiB
Markdown
85 lines
2.6 KiB
Markdown
# Admin Dashboard - Agent Guidelines
|
|
|
|
**STRICT RULES - DO NOT VIOLATE**
|
|
|
|
## Architecture
|
|
|
|
This is a React Admin dashboard using:
|
|
- **Build**: Vite
|
|
- **Routing**: react-router-dom with component-based routing in `App.tsx`
|
|
- **Styling**: Tailwind CSS
|
|
- **State**: React Context (`AuthContext`)
|
|
- **Backend**: Supabase client in `src/lib/supabase.ts`
|
|
|
|
## Directory Structure
|
|
|
|
```
|
|
src/
|
|
components/ # Reusable components
|
|
layout/ # AppLayout, Sidebar, etc.
|
|
ProtectedRoute.tsx # Route guard
|
|
contexts/ # React contexts (AuthContext)
|
|
hooks/ # Custom hooks
|
|
lib/ # Utilities (supabase)
|
|
pages/ # Page components
|
|
content/ # Categories, Packs, Questions
|
|
users/ # User management (super_admin only)
|
|
admins/ # Admin management (super_admin only)
|
|
```
|
|
|
|
## Critical Rules
|
|
|
|
### Authentication & Authorization
|
|
|
|
Two admin roles exist:
|
|
- `admin` - Content management only (categories, packs, questions)
|
|
- `super_admin` - Full access including user data, admins, audit logs
|
|
|
|
Use `<ProtectedRoute requireSuperAdmin>` for super_admin-only routes.
|
|
|
|
### Route Structure
|
|
|
|
```typescript
|
|
// Public
|
|
/login
|
|
|
|
// Protected (all admins)
|
|
/ # Dashboard
|
|
/categories # Category management
|
|
/categories/:id/packs # Packs in category
|
|
/packs/:id/questions # Questions in pack
|
|
|
|
// Protected (super_admin only)
|
|
/users # User list
|
|
/users/:id # User detail
|
|
/users/:id/matches/:id # Match chat view
|
|
/admins # Admin management
|
|
/audit-logs # Audit log viewer
|
|
```
|
|
|
|
### Supabase Queries
|
|
|
|
- **Always use `.maybeSingle()` instead of `.single()`** when the row might not exist
|
|
- All admin operations are audited - check `audit_logs` table structure
|
|
|
|
### UI Patterns
|
|
|
|
- Use Tailwind CSS for styling
|
|
- Follow existing component patterns in `src/components/`
|
|
- Use `AppLayout` wrapper for all protected pages
|
|
|
|
### Security
|
|
|
|
- Never expose user passwords or sensitive data in admin views
|
|
- Audit log all administrative actions
|
|
- Verify admin role before performing operations
|
|
|
|
## Forbidden Actions
|
|
|
|
1. **DO NOT** expose user passwords or auth tokens
|
|
2. **DO NOT** allow content admins to access user data
|
|
3. **DO NOT** bypass role checks in protected routes
|
|
4. **DO NOT** perform destructive operations without confirmation
|
|
5. **DO NOT** use `.single()` for queries that might return 0 rows
|
|
6. **DO NOT** skip audit logging for administrative actions
|