Admin Panel

The admin panel is fully functional at /admin. User management, banning, role assignment, everything works out of the box.

Access Control

Who Can Access?

Only users with the admin role can access the admin panel.

Setting Admin Role

Admins are typically set:

• By existing admins
• Through direct database access (first admin)

Admin Dashboard

The dashboard at /admin shows:

System Statistics

Three key metrics displayed in cards:

Total Users

• Count of all registered accounts
• Includes active, banned, and admin users

Administrators

• Number of users with admin role
• Critical for access control monitoring

Banned Users

• Count of currently restricted accounts
• Helps track moderation actions

User Management

User Table

View all users with:

• Name and email
• Role (user/admin)
• Status (active/banned)
• Join date
• Actions menu (dropdown with all admin actions)

User Actions Menu

Each user row has a dropdown menu with these actions:

Utility Actions:

• Copy Email: Copy user's email to clipboard
• Copy ID: Copy user's unique ID to clipboard

Account Management:

• Verify Email: Manually verify user's email (if unverified)
• Set Role: Change user role (user/admin)
• Change Password: Set new password for user
• Revoke Sessions: Force logout from all devices

Advanced Actions:

• Impersonate User: Login as this user (for debugging/support)
• Ban User: Temporarily or permanently ban user
• Unban User: Restore access to banned user

User Actions

Create User

1. Click "Create User"
2. Fill in details:
   • Email (required)
   • Name
   • Password
   • Role
3. Click create
4. User can sign in immediately

Change User Password

1. Find user in table
2. Click actions → "Change Password"
3. Enter new password
4. Confirm change
5. User can sign in with new password

Verify Email

Manually verify a user's email:

1. Find user
2. Click actions → "Verify Email"
3. Confirm action
4. Email marked as verified

Use when:

• User can't receive verification email
• Email system issues
• Special circumstances

Set Role

Change user's role:

1. Find user
2. Click actions → "Set Role"
3. Select role:
   • user (default)
   • admin
4. Confirm change

Ban User

Temporarily or permanently ban a user:

1. Find user
2. Click actions → "Ban User"
3. Enter reason (optional)
4. Set duration or permanent
5. Confirm ban

What Happens:

• User immediately logged out
• Cannot sign in
• Existing sessions revoked
• Can be unbanned later

Ban Options:

• Temporary (specify duration)
• Permanent
• With reason (internal note)

Unban User

Restore banned user access:

1. Go to banned users tab
2. Find user
3. Click "Unban"
4. Confirm action
5. User can sign in again

Impersonate User

Login as another user for debugging or support:

1. Find user in table
2. Click actions → "Impersonate User"
3. You'll be logged in as that user
4. See the app from their perspective
5. Click "Stop Impersonating" to return to admin account

Use when:

• Debugging user-specific issues
• Testing user permissions
• Providing customer support
• Verifying reported bugs

Banned Users

View all banned users at /admin → Banned table:

Information Shown

• User details
• Ban date
• Ban reason
• Ban duration
• Unban action

Managing Bans

• See ban reasons
• Unban users

Admin Best Practices

Security

1. Limit Admins: Only grant to trusted users
2. Document Actions: Note reasons for major changes (admin actions are not automatically audited)
3. Separate Accounts: Use separate admin accounts if possible

User Management

1. Communication: Inform users of major account changes
2. Document Bans: Always include reason for bans
3. Password Changes: Tell users when you change their password
4. Impersonation: Use only for legitimate support/debugging, document usage
5. Verify First: Confirm issues before taking action

Operations

1. Test Actions: Use test accounts to verify admin features
2. Backup: Ensure database backups before bulk changes
3. Response Plan: Have process for security incidents

Permissions

Admins can:

• View all users
• Create users
• Edit user details
• Change passwords
• Verify emails
• Set roles
• Ban/unban users
• Revoke sessions
• Impersonate users (for support/debugging)
• View statistics
• Access admin panel
• Copy user emails and IDs

Troubleshooting

Can't Access Admin Panel?

• Verify you have admin role
• Check URL is correct (/admin)

Can't Find User?

• Use search function
• Check spelling
• User may be deleted
• Try searching by email

Safety Checks

Built-in protections:

• Cannot delete your own account while admin
• Cannot impersonate other admins
• Cannot ban yourself
• Confirmations for destructive actions

Admin Audit

Admin actions are not currently audited. The audit system tracks user authentication and account events, but not admin panel activities.

What is audited:

• User sign-ins and sign-outs
• Password changes and resets
• Email verification
• Account creation and updates
• Session management
• Failed login attempts

What is not audited:

• Admin user management actions
• Role assignments
• User bans/unbans
• Password changes by admins
• User deletions