feat(admin): admin portal UI — users, allowlist, roles, achievements, cosmetics #69

Description

@AndresL230

Goal

Build out the admin portal (frontend route already scaffolded in frontend/src/components/screens/Admin.tsx with tabs users | roles | achievements | cosmetics | analytics). This issue captures the full backend surface that exists today, gaps that block UI work, and decisions to make before implementation.

Auth gate

services/auth_guard.py::require_admin looks up the session user's user_roles and requires a row joining to roles where slug='admin'. Returns 401 (no session) or 403 (missing role). Every admin endpoint lives in routes/admin.py, mounted at /api/admin. is_admin: true is exposed on /api/auth/me for client routing.

Current backend surface

Users — /api/admin/users*

MethodPathBodyEffect
GET/usersAll users with decrypted name/email, is_approved, created_at, plus roles[] (id/name/slug/color).
PATCH/users/{user_id}/approveSets users.is_approved = true. No unapprove path.

Roles — /api/admin/roles*

MethodPathBodyEffect
GET/rolesAll roles, ordered by display_priority desc.
POST/rolesCreateRoleBodyInsert.
PATCH/roles/{id}partial dictWhitelist: name, color, icon, description, is_staff_assigned, is_earnable, display_priority. slug immutable.
DELETE/roles/{id}Hard delete; user_roles cascades.
POST/roles/assignAssignRoleBodyInsert user_roles. No conflict handling — re-assign 500s.
DELETE/roles/revokeRevokeRoleBodyDelete user_roles row.

Seeded roles: early-adopter, moderator, admin, verified, vip.

Achievements — /api/admin/achievements*

MethodPathBodyEffect
GET/achievementsAll achievements.
POST/achievementsCreateAchievementBodyInsert.
PATCH/achievements/{id}partial dictWhitelist: name, description, icon, category, rarity, is_secret.
DELETE/achievements/{id}Cascades to user_achievements, achievement_triggers, achievement_cosmetics.
POST/achievements/grantGrantAchievementBodyInsert user_achievements (409 if duplicate); fires check_achievements(user_id, \"manual_admin_grant\", {}).
POST/achievements/triggersCreateAchievementTriggerBodyInsert trigger row. No list/update/delete for triggers.

Cosmetics — /api/admin/cosmetics*

MethodPathBodyEffect
GET/cosmeticsAll cosmetics, ordered by type asc.
POST/cosmeticsCreateCosmeticBodyInsert.
PATCH/cosmetics/{id}partial dictWhitelist: name, asset_url, css_value, rarity, unlock_source. type and slug immutable.
DELETE/cosmetics/{id}Cascades to user_cosmetics, role_cosmetics.

Cosmetic types: avatar_frame, banner, name_color, title. Asset upload happens client-side directly to Supabase Storage (cosmetic-assets bucket); API stores the URL only.

Beta allowlist — /api/admin/allowlist*

MethodPathBodyEffect
GET/allowlistAll newsletter_emails rows (id, email, created_at, approved_at), newest first.
POST/allowlist/approveAllowlistEmailBodyUpsert email lowercased + approved_at = now().
POST/allowlist/revokeAllowlistEmailBodySet approved_at = NULL (preserves signup row). 404 if missing.

Pre-approved emails are auto-promoted to users.is_approved=true on their next OAuth callback (routes/auth.py:308-345). No mid-session promotion.

Gaps blocking the UI

  • Analytics tab is in Admin.tsx's tab union but has no backend — needs new endpoints (user growth, session counts, document volume, etc.) before it's functional.
  • No audit log — nothing records who approved a user, granted a role, or whitelisted an email. user_roles.granted_by exists but the route doesn't auto-fill it from the session.
  • No pagination on any list endpoint — /users, /roles, /achievements, /cosmetics, /allowlist return everything every time.
  • No search/filter on /users — can't find by name/email/role server-side.
  • No "unapprove" / suspend / ban / delete userPATCH /users/{id}/approve is one-way.
  • No "impersonate user" for support flows.
  • Self-protection — nothing prevents an admin from revoking their own admin role or deleting the admin role row.
  • Achievement triggers: only POST exists; can't list/delete via API.
  • Role-cosmetic / achievement-cosmetic linking tables exist (role_cosmetics, achievement_cosmetics) but no admin endpoints.
  • "Last sign-in" field referenced in Admin.tsx types isn't returned by /users.
  • /users decrypts every user's name + email per request — fine at current scale, hot CPU path past hundreds of rows; pagination amplifies the urgency.

Proposed tab structure

TabStatusNotes
UsersBackend exists, needs additionsPagination, search, unapprove, last_sign_in.
AllowlistBackend complete (just landed)Single-list view with approve/revoke + add-by-email.
RolesBackend completeAdd fix for re-assign 500 (use upsert). Surface granted_by (auto-fill from session).
AchievementsBackend mostly completeAdd list/delete for triggers; expose achievement_cosmetics linking.
CosmeticsBackend completeAdd role_cosmetics linking UI.
AnalyticsBackend missing entirelyDecide scope (DAU/MAU? per-feature counts?) before scoping UI.

Decisions needed

  1. Unapprove: do we want the inverse of PATCH /users/{id}/approve? (Likely yes — manual mistake recovery.)
  2. Audit log scope: a single admin_audit_log table with (actor_id, action, target_type, target_id, payload, created_at), or per-table audit columns?
  3. Analytics scope: out of scope for v1, or include simple counts (total users, approved users, signups by day)?
  4. Self-protection rules: prevent revoking own admin? Prevent deleting last admin? Prevent deleting admin role row?
  5. Pagination shape: cursor or offset? Page size default?

Related work

  • Beta allowlist endpoints + auth callback promotion logic landed alongside this issue (PR pending).
  • Audit-log + unapprove + /users pagination/search would be the natural next backend chunk.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
       blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
      }
      } catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
      })();
      (function(){
      try {
      var __m = "github.com";
      var __re = new RegExp('^' + "github\\.com" + '
      
      Skip to content

      feat(admin): admin portal UI — users, allowlist, roles, achievements, cosmetics #69

      Description

      @AndresL230

      Goal

      Build out the admin portal (frontend route already scaffolded in frontend/src/components/screens/Admin.tsx with tabs users | roles | achievements | cosmetics | analytics). This issue captures the full backend surface that exists today, gaps that block UI work, and decisions to make before implementation.

      Auth gate

      services/auth_guard.py::require_admin looks up the session user's user_roles and requires a row joining to roles where slug='admin'. Returns 401 (no session) or 403 (missing role). Every admin endpoint lives in routes/admin.py, mounted at /api/admin. is_admin: true is exposed on /api/auth/me for client routing.

      Current backend surface

      Users — /api/admin/users*

      MethodPathBodyEffect
      GET/usersAll users with decrypted name/email, is_approved, created_at, plus roles[] (id/name/slug/color).
      PATCH/users/{user_id}/approveSets users.is_approved = true. No unapprove path.

      Roles — /api/admin/roles*

      MethodPathBodyEffect
      GET/rolesAll roles, ordered by display_priority desc.
      POST/rolesCreateRoleBodyInsert.
      PATCH/roles/{id}partial dictWhitelist: name, color, icon, description, is_staff_assigned, is_earnable, display_priority. slug immutable.
      DELETE/roles/{id}Hard delete; user_roles cascades.
      POST/roles/assignAssignRoleBodyInsert user_roles. No conflict handling — re-assign 500s.
      DELETE/roles/revokeRevokeRoleBodyDelete user_roles row.

      Seeded roles: early-adopter, moderator, admin, verified, vip.

      Achievements — /api/admin/achievements*

      MethodPathBodyEffect
      GET/achievementsAll achievements.
      POST/achievementsCreateAchievementBodyInsert.
      PATCH/achievements/{id}partial dictWhitelist: name, description, icon, category, rarity, is_secret.
      DELETE/achievements/{id}Cascades to user_achievements, achievement_triggers, achievement_cosmetics.
      POST/achievements/grantGrantAchievementBodyInsert user_achievements (409 if duplicate); fires check_achievements(user_id, \"manual_admin_grant\", {}).
      POST/achievements/triggersCreateAchievementTriggerBodyInsert trigger row. No list/update/delete for triggers.

      Cosmetics — /api/admin/cosmetics*

      MethodPathBodyEffect
      GET/cosmeticsAll cosmetics, ordered by type asc.
      POST/cosmeticsCreateCosmeticBodyInsert.
      PATCH/cosmetics/{id}partial dictWhitelist: name, asset_url, css_value, rarity, unlock_source. type and slug immutable.
      DELETE/cosmetics/{id}Cascades to user_cosmetics, role_cosmetics.

      Cosmetic types: avatar_frame, banner, name_color, title. Asset upload happens client-side directly to Supabase Storage (cosmetic-assets bucket); API stores the URL only.

      Beta allowlist — /api/admin/allowlist*

      MethodPathBodyEffect
      GET/allowlistAll newsletter_emails rows (id, email, created_at, approved_at), newest first.
      POST/allowlist/approveAllowlistEmailBodyUpsert email lowercased + approved_at = now().
      POST/allowlist/revokeAllowlistEmailBodySet approved_at = NULL (preserves signup row). 404 if missing.

      Pre-approved emails are auto-promoted to users.is_approved=true on their next OAuth callback (routes/auth.py:308-345). No mid-session promotion.

      Gaps blocking the UI

      • Analytics tab is in Admin.tsx's tab union but has no backend — needs new endpoints (user growth, session counts, document volume, etc.) before it's functional.
      • No audit log — nothing records who approved a user, granted a role, or whitelisted an email. user_roles.granted_by exists but the route doesn't auto-fill it from the session.
      • No pagination on any list endpoint — /users, /roles, /achievements, /cosmetics, /allowlist return everything every time.
      • No search/filter on /users — can't find by name/email/role server-side.
      • No "unapprove" / suspend / ban / delete userPATCH /users/{id}/approve is one-way.
      • No "impersonate user" for support flows.
      • Self-protection — nothing prevents an admin from revoking their own admin role or deleting the admin role row.
      • Achievement triggers: only POST exists; can't list/delete via API.
      • Role-cosmetic / achievement-cosmetic linking tables exist (role_cosmetics, achievement_cosmetics) but no admin endpoints.
      • "Last sign-in" field referenced in Admin.tsx types isn't returned by /users.
      • /users decrypts every user's name + email per request — fine at current scale, hot CPU path past hundreds of rows; pagination amplifies the urgency.

      Proposed tab structure

      TabStatusNotes
      UsersBackend exists, needs additionsPagination, search, unapprove, last_sign_in.
      AllowlistBackend complete (just landed)Single-list view with approve/revoke + add-by-email.
      RolesBackend completeAdd fix for re-assign 500 (use upsert). Surface granted_by (auto-fill from session).
      AchievementsBackend mostly completeAdd list/delete for triggers; expose achievement_cosmetics linking.
      CosmeticsBackend completeAdd role_cosmetics linking UI.
      AnalyticsBackend missing entirelyDecide scope (DAU/MAU? per-feature counts?) before scoping UI.

      Decisions needed

      1. Unapprove: do we want the inverse of PATCH /users/{id}/approve? (Likely yes — manual mistake recovery.)
      2. Audit log scope: a single admin_audit_log table with (actor_id, action, target_type, target_id, payload, created_at), or per-table audit columns?
      3. Analytics scope: out of scope for v1, or include simple counts (total users, approved users, signups by day)?
      4. Self-protection rules: prevent revoking own admin? Prevent deleting last admin? Prevent deleting admin role row?
      5. Pagination shape: cursor or offset? Page size default?

      Related work

      • Beta allowlist endpoints + auth callback promotion logic landed alongside this issue (PR pending).
      • Audit-log + unapprove + /users pagination/search would be the natural next backend chunk.

      Metadata

      Metadata

      Assignees

      No one assigned

        Labels

        No labels
        No labels

        Type

        No type

        Projects

        No projects

          Milestone

          No milestone

          Relationships

          None yet

          Development

          No branches or pull requests

          Issue actions

          , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
          Skip to content

          feat(admin): admin portal UI — users, allowlist, roles, achievements, cosmetics #69

          Description

          @AndresL230

          Goal

          Build out the admin portal (frontend route already scaffolded in frontend/src/components/screens/Admin.tsx with tabs users | roles | achievements | cosmetics | analytics). This issue captures the full backend surface that exists today, gaps that block UI work, and decisions to make before implementation.

          Auth gate

          services/auth_guard.py::require_admin looks up the session user's user_roles and requires a row joining to roles where slug='admin'. Returns 401 (no session) or 403 (missing role). Every admin endpoint lives in routes/admin.py, mounted at /api/admin. is_admin: true is exposed on /api/auth/me for client routing.

          Current backend surface

          Users — /api/admin/users*

          MethodPathBodyEffect
          GET/usersAll users with decrypted name/email, is_approved, created_at, plus roles[] (id/name/slug/color).
          PATCH/users/{user_id}/approveSets users.is_approved = true. No unapprove path.

          Roles — /api/admin/roles*

          MethodPathBodyEffect
          GET/rolesAll roles, ordered by display_priority desc.
          POST/rolesCreateRoleBodyInsert.
          PATCH/roles/{id}partial dictWhitelist: name, color, icon, description, is_staff_assigned, is_earnable, display_priority. slug immutable.
          DELETE/roles/{id}Hard delete; user_roles cascades.
          POST/roles/assignAssignRoleBodyInsert user_roles. No conflict handling — re-assign 500s.
          DELETE/roles/revokeRevokeRoleBodyDelete user_roles row.

          Seeded roles: early-adopter, moderator, admin, verified, vip.

          Achievements — /api/admin/achievements*

          MethodPathBodyEffect
          GET/achievementsAll achievements.
          POST/achievementsCreateAchievementBodyInsert.
          PATCH/achievements/{id}partial dictWhitelist: name, description, icon, category, rarity, is_secret.
          DELETE/achievements/{id}Cascades to user_achievements, achievement_triggers, achievement_cosmetics.
          POST/achievements/grantGrantAchievementBodyInsert user_achievements (409 if duplicate); fires check_achievements(user_id, \"manual_admin_grant\", {}).
          POST/achievements/triggersCreateAchievementTriggerBodyInsert trigger row. No list/update/delete for triggers.

          Cosmetics — /api/admin/cosmetics*

          MethodPathBodyEffect
          GET/cosmeticsAll cosmetics, ordered by type asc.
          POST/cosmeticsCreateCosmeticBodyInsert.
          PATCH/cosmetics/{id}partial dictWhitelist: name, asset_url, css_value, rarity, unlock_source. type and slug immutable.
          DELETE/cosmetics/{id}Cascades to user_cosmetics, role_cosmetics.

          Cosmetic types: avatar_frame, banner, name_color, title. Asset upload happens client-side directly to Supabase Storage (cosmetic-assets bucket); API stores the URL only.

          Beta allowlist — /api/admin/allowlist*

          MethodPathBodyEffect
          GET/allowlistAll newsletter_emails rows (id, email, created_at, approved_at), newest first.
          POST/allowlist/approveAllowlistEmailBodyUpsert email lowercased + approved_at = now().
          POST/allowlist/revokeAllowlistEmailBodySet approved_at = NULL (preserves signup row). 404 if missing.

          Pre-approved emails are auto-promoted to users.is_approved=true on their next OAuth callback (routes/auth.py:308-345). No mid-session promotion.

          Gaps blocking the UI

          • Analytics tab is in Admin.tsx's tab union but has no backend — needs new endpoints (user growth, session counts, document volume, etc.) before it's functional.
          • No audit log — nothing records who approved a user, granted a role, or whitelisted an email. user_roles.granted_by exists but the route doesn't auto-fill it from the session.
          • No pagination on any list endpoint — /users, /roles, /achievements, /cosmetics, /allowlist return everything every time.
          • No search/filter on /users — can't find by name/email/role server-side.
          • No "unapprove" / suspend / ban / delete userPATCH /users/{id}/approve is one-way.
          • No "impersonate user" for support flows.
          • Self-protection — nothing prevents an admin from revoking their own admin role or deleting the admin role row.
          • Achievement triggers: only POST exists; can't list/delete via API.
          • Role-cosmetic / achievement-cosmetic linking tables exist (role_cosmetics, achievement_cosmetics) but no admin endpoints.
          • "Last sign-in" field referenced in Admin.tsx types isn't returned by /users.
          • /users decrypts every user's name + email per request — fine at current scale, hot CPU path past hundreds of rows; pagination amplifies the urgency.

          Proposed tab structure

          TabStatusNotes
          UsersBackend exists, needs additionsPagination, search, unapprove, last_sign_in.
          AllowlistBackend complete (just landed)Single-list view with approve/revoke + add-by-email.
          RolesBackend completeAdd fix for re-assign 500 (use upsert). Surface granted_by (auto-fill from session).
          AchievementsBackend mostly completeAdd list/delete for triggers; expose achievement_cosmetics linking.
          CosmeticsBackend completeAdd role_cosmetics linking UI.
          AnalyticsBackend missing entirelyDecide scope (DAU/MAU? per-feature counts?) before scoping UI.

          Decisions needed

          1. Unapprove: do we want the inverse of PATCH /users/{id}/approve? (Likely yes — manual mistake recovery.)
          2. Audit log scope: a single admin_audit_log table with (actor_id, action, target_type, target_id, payload, created_at), or per-table audit columns?
          3. Analytics scope: out of scope for v1, or include simple counts (total users, approved users, signups by day)?
          4. Self-protection rules: prevent revoking own admin? Prevent deleting last admin? Prevent deleting admin role row?
          5. Pagination shape: cursor or offset? Page size default?

          Related work

          • Beta allowlist endpoints + auth callback promotion logic landed alongside this issue (PR pending).
          • Audit-log + unapprove + /users pagination/search would be the natural next backend chunk.

          Metadata

          Metadata

          Assignees

          No one assigned

            Labels

            No labels
            No labels

            Type

            No type

            Projects

            No projects

              Milestone

              No milestone

              Relationships

              None yet

              Development

              No branches or pull requests

              Issue actions

              , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
              Skip to content

              feat(admin): admin portal UI — users, allowlist, roles, achievements, cosmetics #69

              Description

              @AndresL230

              Goal

              Build out the admin portal (frontend route already scaffolded in frontend/src/components/screens/Admin.tsx with tabs users | roles | achievements | cosmetics | analytics). This issue captures the full backend surface that exists today, gaps that block UI work, and decisions to make before implementation.

              Auth gate

              services/auth_guard.py::require_admin looks up the session user's user_roles and requires a row joining to roles where slug='admin'. Returns 401 (no session) or 403 (missing role). Every admin endpoint lives in routes/admin.py, mounted at /api/admin. is_admin: true is exposed on /api/auth/me for client routing.

              Current backend surface

              Users — /api/admin/users*

              MethodPathBodyEffect
              GET/usersAll users with decrypted name/email, is_approved, created_at, plus roles[] (id/name/slug/color).
              PATCH/users/{user_id}/approveSets users.is_approved = true. No unapprove path.

              Roles — /api/admin/roles*

              MethodPathBodyEffect
              GET/rolesAll roles, ordered by display_priority desc.
              POST/rolesCreateRoleBodyInsert.
              PATCH/roles/{id}partial dictWhitelist: name, color, icon, description, is_staff_assigned, is_earnable, display_priority. slug immutable.
              DELETE/roles/{id}Hard delete; user_roles cascades.
              POST/roles/assignAssignRoleBodyInsert user_roles. No conflict handling — re-assign 500s.
              DELETE/roles/revokeRevokeRoleBodyDelete user_roles row.

              Seeded roles: early-adopter, moderator, admin, verified, vip.

              Achievements — /api/admin/achievements*

              MethodPathBodyEffect
              GET/achievementsAll achievements.
              POST/achievementsCreateAchievementBodyInsert.
              PATCH/achievements/{id}partial dictWhitelist: name, description, icon, category, rarity, is_secret.
              DELETE/achievements/{id}Cascades to user_achievements, achievement_triggers, achievement_cosmetics.
              POST/achievements/grantGrantAchievementBodyInsert user_achievements (409 if duplicate); fires check_achievements(user_id, \"manual_admin_grant\", {}).
              POST/achievements/triggersCreateAchievementTriggerBodyInsert trigger row. No list/update/delete for triggers.

              Cosmetics — /api/admin/cosmetics*

              MethodPathBodyEffect
              GET/cosmeticsAll cosmetics, ordered by type asc.
              POST/cosmeticsCreateCosmeticBodyInsert.
              PATCH/cosmetics/{id}partial dictWhitelist: name, asset_url, css_value, rarity, unlock_source. type and slug immutable.
              DELETE/cosmetics/{id}Cascades to user_cosmetics, role_cosmetics.

              Cosmetic types: avatar_frame, banner, name_color, title. Asset upload happens client-side directly to Supabase Storage (cosmetic-assets bucket); API stores the URL only.

              Beta allowlist — /api/admin/allowlist*

              MethodPathBodyEffect
              GET/allowlistAll newsletter_emails rows (id, email, created_at, approved_at), newest first.
              POST/allowlist/approveAllowlistEmailBodyUpsert email lowercased + approved_at = now().
              POST/allowlist/revokeAllowlistEmailBodySet approved_at = NULL (preserves signup row). 404 if missing.

              Pre-approved emails are auto-promoted to users.is_approved=true on their next OAuth callback (routes/auth.py:308-345). No mid-session promotion.

              Gaps blocking the UI

              • Analytics tab is in Admin.tsx's tab union but has no backend — needs new endpoints (user growth, session counts, document volume, etc.) before it's functional.
              • No audit log — nothing records who approved a user, granted a role, or whitelisted an email. user_roles.granted_by exists but the route doesn't auto-fill it from the session.
              • No pagination on any list endpoint — /users, /roles, /achievements, /cosmetics, /allowlist return everything every time.
              • No search/filter on /users — can't find by name/email/role server-side.
              • No "unapprove" / suspend / ban / delete userPATCH /users/{id}/approve is one-way.
              • No "impersonate user" for support flows.
              • Self-protection — nothing prevents an admin from revoking their own admin role or deleting the admin role row.
              • Achievement triggers: only POST exists; can't list/delete via API.
              • Role-cosmetic / achievement-cosmetic linking tables exist (role_cosmetics, achievement_cosmetics) but no admin endpoints.
              • "Last sign-in" field referenced in Admin.tsx types isn't returned by /users.
              • /users decrypts every user's name + email per request — fine at current scale, hot CPU path past hundreds of rows; pagination amplifies the urgency.

              Proposed tab structure

              TabStatusNotes
              UsersBackend exists, needs additionsPagination, search, unapprove, last_sign_in.
              AllowlistBackend complete (just landed)Single-list view with approve/revoke + add-by-email.
              RolesBackend completeAdd fix for re-assign 500 (use upsert). Surface granted_by (auto-fill from session).
              AchievementsBackend mostly completeAdd list/delete for triggers; expose achievement_cosmetics linking.
              CosmeticsBackend completeAdd role_cosmetics linking UI.
              AnalyticsBackend missing entirelyDecide scope (DAU/MAU? per-feature counts?) before scoping UI.

              Decisions needed

              1. Unapprove: do we want the inverse of PATCH /users/{id}/approve? (Likely yes — manual mistake recovery.)
              2. Audit log scope: a single admin_audit_log table with (actor_id, action, target_type, target_id, payload, created_at), or per-table audit columns?
              3. Analytics scope: out of scope for v1, or include simple counts (total users, approved users, signups by day)?
              4. Self-protection rules: prevent revoking own admin? Prevent deleting last admin? Prevent deleting admin role row?
              5. Pagination shape: cursor or offset? Page size default?

              Related work

              • Beta allowlist endpoints + auth callback promotion logic landed alongside this issue (PR pending).
              • Audit-log + unapprove + /users pagination/search would be the natural next backend chunk.

              Metadata

              Metadata

              Assignees

              No one assigned

                Labels

                No labels
                No labels

                Type

                No type

                Projects

                No projects

                  Milestone

                  No milestone

                  Relationships

                  None yet

                  Development

                  No branches or pull requests

                  Issue actions

                  , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
                  Skip to content

                  feat(admin): admin portal UI — users, allowlist, roles, achievements, cosmetics #69

                  Description

                  @AndresL230

                  Goal

                  Build out the admin portal (frontend route already scaffolded in frontend/src/components/screens/Admin.tsx with tabs users | roles | achievements | cosmetics | analytics). This issue captures the full backend surface that exists today, gaps that block UI work, and decisions to make before implementation.

                  Auth gate

                  services/auth_guard.py::require_admin looks up the session user's user_roles and requires a row joining to roles where slug='admin'. Returns 401 (no session) or 403 (missing role). Every admin endpoint lives in routes/admin.py, mounted at /api/admin. is_admin: true is exposed on /api/auth/me for client routing.

                  Current backend surface

                  Users — /api/admin/users*

                  MethodPathBodyEffect
                  GET/usersAll users with decrypted name/email, is_approved, created_at, plus roles[] (id/name/slug/color).
                  PATCH/users/{user_id}/approveSets users.is_approved = true. No unapprove path.

                  Roles — /api/admin/roles*

                  MethodPathBodyEffect
                  GET/rolesAll roles, ordered by display_priority desc.
                  POST/rolesCreateRoleBodyInsert.
                  PATCH/roles/{id}partial dictWhitelist: name, color, icon, description, is_staff_assigned, is_earnable, display_priority. slug immutable.
                  DELETE/roles/{id}Hard delete; user_roles cascades.
                  POST/roles/assignAssignRoleBodyInsert user_roles. No conflict handling — re-assign 500s.
                  DELETE/roles/revokeRevokeRoleBodyDelete user_roles row.

                  Seeded roles: early-adopter, moderator, admin, verified, vip.

                  Achievements — /api/admin/achievements*

                  MethodPathBodyEffect
                  GET/achievementsAll achievements.
                  POST/achievementsCreateAchievementBodyInsert.
                  PATCH/achievements/{id}partial dictWhitelist: name, description, icon, category, rarity, is_secret.
                  DELETE/achievements/{id}Cascades to user_achievements, achievement_triggers, achievement_cosmetics.
                  POST/achievements/grantGrantAchievementBodyInsert user_achievements (409 if duplicate); fires check_achievements(user_id, \"manual_admin_grant\", {}).
                  POST/achievements/triggersCreateAchievementTriggerBodyInsert trigger row. No list/update/delete for triggers.

                  Cosmetics — /api/admin/cosmetics*

                  MethodPathBodyEffect
                  GET/cosmeticsAll cosmetics, ordered by type asc.
                  POST/cosmeticsCreateCosmeticBodyInsert.
                  PATCH/cosmetics/{id}partial dictWhitelist: name, asset_url, css_value, rarity, unlock_source. type and slug immutable.
                  DELETE/cosmetics/{id}Cascades to user_cosmetics, role_cosmetics.

                  Cosmetic types: avatar_frame, banner, name_color, title. Asset upload happens client-side directly to Supabase Storage (cosmetic-assets bucket); API stores the URL only.

                  Beta allowlist — /api/admin/allowlist*

                  MethodPathBodyEffect
                  GET/allowlistAll newsletter_emails rows (id, email, created_at, approved_at), newest first.
                  POST/allowlist/approveAllowlistEmailBodyUpsert email lowercased + approved_at = now().
                  POST/allowlist/revokeAllowlistEmailBodySet approved_at = NULL (preserves signup row). 404 if missing.

                  Pre-approved emails are auto-promoted to users.is_approved=true on their next OAuth callback (routes/auth.py:308-345). No mid-session promotion.

                  Gaps blocking the UI

                  • Analytics tab is in Admin.tsx's tab union but has no backend — needs new endpoints (user growth, session counts, document volume, etc.) before it's functional.
                  • No audit log — nothing records who approved a user, granted a role, or whitelisted an email. user_roles.granted_by exists but the route doesn't auto-fill it from the session.
                  • No pagination on any list endpoint — /users, /roles, /achievements, /cosmetics, /allowlist return everything every time.
                  • No search/filter on /users — can't find by name/email/role server-side.
                  • No "unapprove" / suspend / ban / delete userPATCH /users/{id}/approve is one-way.
                  • No "impersonate user" for support flows.
                  • Self-protection — nothing prevents an admin from revoking their own admin role or deleting the admin role row.
                  • Achievement triggers: only POST exists; can't list/delete via API.
                  • Role-cosmetic / achievement-cosmetic linking tables exist (role_cosmetics, achievement_cosmetics) but no admin endpoints.
                  • "Last sign-in" field referenced in Admin.tsx types isn't returned by /users.
                  • /users decrypts every user's name + email per request — fine at current scale, hot CPU path past hundreds of rows; pagination amplifies the urgency.

                  Proposed tab structure

                  TabStatusNotes
                  UsersBackend exists, needs additionsPagination, search, unapprove, last_sign_in.
                  AllowlistBackend complete (just landed)Single-list view with approve/revoke + add-by-email.
                  RolesBackend completeAdd fix for re-assign 500 (use upsert). Surface granted_by (auto-fill from session).
                  AchievementsBackend mostly completeAdd list/delete for triggers; expose achievement_cosmetics linking.
                  CosmeticsBackend completeAdd role_cosmetics linking UI.
                  AnalyticsBackend missing entirelyDecide scope (DAU/MAU? per-feature counts?) before scoping UI.

                  Decisions needed

                  1. Unapprove: do we want the inverse of PATCH /users/{id}/approve? (Likely yes — manual mistake recovery.)
                  2. Audit log scope: a single admin_audit_log table with (actor_id, action, target_type, target_id, payload, created_at), or per-table audit columns?
                  3. Analytics scope: out of scope for v1, or include simple counts (total users, approved users, signups by day)?
                  4. Self-protection rules: prevent revoking own admin? Prevent deleting last admin? Prevent deleting admin role row?
                  5. Pagination shape: cursor or offset? Page size default?

                  Related work

                  • Beta allowlist endpoints + auth callback promotion logic landed alongside this issue (PR pending).
                  • Audit-log + unapprove + /users pagination/search would be the natural next backend chunk.

                  Metadata

                  Metadata

                  Assignees

                  No one assigned

                    Labels

                    No labels
                    No labels

                    Type

                    No type

                    Projects

                    No projects

                      Milestone

                      No milestone

                      Relationships

                      None yet

                      Development

                      No branches or pull requests

                      Issue actions

                      , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
                      Skip to content

                      feat(admin): admin portal UI — users, allowlist, roles, achievements, cosmetics #69

                      Description

                      @AndresL230

                      Goal

                      Build out the admin portal (frontend route already scaffolded in frontend/src/components/screens/Admin.tsx with tabs users | roles | achievements | cosmetics | analytics). This issue captures the full backend surface that exists today, gaps that block UI work, and decisions to make before implementation.

                      Auth gate

                      services/auth_guard.py::require_admin looks up the session user's user_roles and requires a row joining to roles where slug='admin'. Returns 401 (no session) or 403 (missing role). Every admin endpoint lives in routes/admin.py, mounted at /api/admin. is_admin: true is exposed on /api/auth/me for client routing.

                      Current backend surface

                      Users — /api/admin/users*

                      MethodPathBodyEffect
                      GET/usersAll users with decrypted name/email, is_approved, created_at, plus roles[] (id/name/slug/color).
                      PATCH/users/{user_id}/approveSets users.is_approved = true. No unapprove path.

                      Roles — /api/admin/roles*

                      MethodPathBodyEffect
                      GET/rolesAll roles, ordered by display_priority desc.
                      POST/rolesCreateRoleBodyInsert.
                      PATCH/roles/{id}partial dictWhitelist: name, color, icon, description, is_staff_assigned, is_earnable, display_priority. slug immutable.
                      DELETE/roles/{id}Hard delete; user_roles cascades.
                      POST/roles/assignAssignRoleBodyInsert user_roles. No conflict handling — re-assign 500s.
                      DELETE/roles/revokeRevokeRoleBodyDelete user_roles row.

                      Seeded roles: early-adopter, moderator, admin, verified, vip.

                      Achievements — /api/admin/achievements*

                      MethodPathBodyEffect
                      GET/achievementsAll achievements.
                      POST/achievementsCreateAchievementBodyInsert.
                      PATCH/achievements/{id}partial dictWhitelist: name, description, icon, category, rarity, is_secret.
                      DELETE/achievements/{id}Cascades to user_achievements, achievement_triggers, achievement_cosmetics.
                      POST/achievements/grantGrantAchievementBodyInsert user_achievements (409 if duplicate); fires check_achievements(user_id, \"manual_admin_grant\", {}).
                      POST/achievements/triggersCreateAchievementTriggerBodyInsert trigger row. No list/update/delete for triggers.

                      Cosmetics — /api/admin/cosmetics*

                      MethodPathBodyEffect
                      GET/cosmeticsAll cosmetics, ordered by type asc.
                      POST/cosmeticsCreateCosmeticBodyInsert.
                      PATCH/cosmetics/{id}partial dictWhitelist: name, asset_url, css_value, rarity, unlock_source. type and slug immutable.
                      DELETE/cosmetics/{id}Cascades to user_cosmetics, role_cosmetics.

                      Cosmetic types: avatar_frame, banner, name_color, title. Asset upload happens client-side directly to Supabase Storage (cosmetic-assets bucket); API stores the URL only.

                      Beta allowlist — /api/admin/allowlist*

                      MethodPathBodyEffect
                      GET/allowlistAll newsletter_emails rows (id, email, created_at, approved_at), newest first.
                      POST/allowlist/approveAllowlistEmailBodyUpsert email lowercased + approved_at = now().
                      POST/allowlist/revokeAllowlistEmailBodySet approved_at = NULL (preserves signup row). 404 if missing.

                      Pre-approved emails are auto-promoted to users.is_approved=true on their next OAuth callback (routes/auth.py:308-345). No mid-session promotion.

                      Gaps blocking the UI

                      • Analytics tab is in Admin.tsx's tab union but has no backend — needs new endpoints (user growth, session counts, document volume, etc.) before it's functional.
                      • No audit log — nothing records who approved a user, granted a role, or whitelisted an email. user_roles.granted_by exists but the route doesn't auto-fill it from the session.
                      • No pagination on any list endpoint — /users, /roles, /achievements, /cosmetics, /allowlist return everything every time.
                      • No search/filter on /users — can't find by name/email/role server-side.
                      • No "unapprove" / suspend / ban / delete userPATCH /users/{id}/approve is one-way.
                      • No "impersonate user" for support flows.
                      • Self-protection — nothing prevents an admin from revoking their own admin role or deleting the admin role row.
                      • Achievement triggers: only POST exists; can't list/delete via API.
                      • Role-cosmetic / achievement-cosmetic linking tables exist (role_cosmetics, achievement_cosmetics) but no admin endpoints.
                      • "Last sign-in" field referenced in Admin.tsx types isn't returned by /users.
                      • /users decrypts every user's name + email per request — fine at current scale, hot CPU path past hundreds of rows; pagination amplifies the urgency.

                      Proposed tab structure

                      TabStatusNotes
                      UsersBackend exists, needs additionsPagination, search, unapprove, last_sign_in.
                      AllowlistBackend complete (just landed)Single-list view with approve/revoke + add-by-email.
                      RolesBackend completeAdd fix for re-assign 500 (use upsert). Surface granted_by (auto-fill from session).
                      AchievementsBackend mostly completeAdd list/delete for triggers; expose achievement_cosmetics linking.
                      CosmeticsBackend completeAdd role_cosmetics linking UI.
                      AnalyticsBackend missing entirelyDecide scope (DAU/MAU? per-feature counts?) before scoping UI.

                      Decisions needed

                      1. Unapprove: do we want the inverse of PATCH /users/{id}/approve? (Likely yes — manual mistake recovery.)
                      2. Audit log scope: a single admin_audit_log table with (actor_id, action, target_type, target_id, payload, created_at), or per-table audit columns?
                      3. Analytics scope: out of scope for v1, or include simple counts (total users, approved users, signups by day)?
                      4. Self-protection rules: prevent revoking own admin? Prevent deleting last admin? Prevent deleting admin role row?
                      5. Pagination shape: cursor or offset? Page size default?

                      Related work

                      • Beta allowlist endpoints + auth callback promotion logic landed alongside this issue (PR pending).
                      • Audit-log + unapprove + /users pagination/search would be the natural next backend chunk.

                      Metadata

                      Metadata

                      Assignees

                      No one assigned

                        Labels

                        No labels
                        No labels

                        Type

                        No type

                        Projects

                        No projects

                          Milestone

                          No milestone

                          Relationships

                          None yet

                          Development

                          No branches or pull requests

                          Issue actions

                          , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
                          Skip to content

                          feat(admin): admin portal UI — users, allowlist, roles, achievements, cosmetics #69

                          Description

                          @AndresL230

                          Goal

                          Build out the admin portal (frontend route already scaffolded in frontend/src/components/screens/Admin.tsx with tabs users | roles | achievements | cosmetics | analytics). This issue captures the full backend surface that exists today, gaps that block UI work, and decisions to make before implementation.

                          Auth gate

                          services/auth_guard.py::require_admin looks up the session user's user_roles and requires a row joining to roles where slug='admin'. Returns 401 (no session) or 403 (missing role). Every admin endpoint lives in routes/admin.py, mounted at /api/admin. is_admin: true is exposed on /api/auth/me for client routing.

                          Current backend surface

                          Users — /api/admin/users*

                          MethodPathBodyEffect
                          GET/usersAll users with decrypted name/email, is_approved, created_at, plus roles[] (id/name/slug/color).
                          PATCH/users/{user_id}/approveSets users.is_approved = true. No unapprove path.

                          Roles — /api/admin/roles*

                          MethodPathBodyEffect
                          GET/rolesAll roles, ordered by display_priority desc.
                          POST/rolesCreateRoleBodyInsert.
                          PATCH/roles/{id}partial dictWhitelist: name, color, icon, description, is_staff_assigned, is_earnable, display_priority. slug immutable.
                          DELETE/roles/{id}Hard delete; user_roles cascades.
                          POST/roles/assignAssignRoleBodyInsert user_roles. No conflict handling — re-assign 500s.
                          DELETE/roles/revokeRevokeRoleBodyDelete user_roles row.

                          Seeded roles: early-adopter, moderator, admin, verified, vip.

                          Achievements — /api/admin/achievements*

                          MethodPathBodyEffect
                          GET/achievementsAll achievements.
                          POST/achievementsCreateAchievementBodyInsert.
                          PATCH/achievements/{id}partial dictWhitelist: name, description, icon, category, rarity, is_secret.
                          DELETE/achievements/{id}Cascades to user_achievements, achievement_triggers, achievement_cosmetics.
                          POST/achievements/grantGrantAchievementBodyInsert user_achievements (409 if duplicate); fires check_achievements(user_id, \"manual_admin_grant\", {}).
                          POST/achievements/triggersCreateAchievementTriggerBodyInsert trigger row. No list/update/delete for triggers.

                          Cosmetics — /api/admin/cosmetics*

                          MethodPathBodyEffect
                          GET/cosmeticsAll cosmetics, ordered by type asc.
                          POST/cosmeticsCreateCosmeticBodyInsert.
                          PATCH/cosmetics/{id}partial dictWhitelist: name, asset_url, css_value, rarity, unlock_source. type and slug immutable.
                          DELETE/cosmetics/{id}Cascades to user_cosmetics, role_cosmetics.

                          Cosmetic types: avatar_frame, banner, name_color, title. Asset upload happens client-side directly to Supabase Storage (cosmetic-assets bucket); API stores the URL only.

                          Beta allowlist — /api/admin/allowlist*

                          MethodPathBodyEffect
                          GET/allowlistAll newsletter_emails rows (id, email, created_at, approved_at), newest first.
                          POST/allowlist/approveAllowlistEmailBodyUpsert email lowercased + approved_at = now().
                          POST/allowlist/revokeAllowlistEmailBodySet approved_at = NULL (preserves signup row). 404 if missing.

                          Pre-approved emails are auto-promoted to users.is_approved=true on their next OAuth callback (routes/auth.py:308-345). No mid-session promotion.

                          Gaps blocking the UI

                          • Analytics tab is in Admin.tsx's tab union but has no backend — needs new endpoints (user growth, session counts, document volume, etc.) before it's functional.
                          • No audit log — nothing records who approved a user, granted a role, or whitelisted an email. user_roles.granted_by exists but the route doesn't auto-fill it from the session.
                          • No pagination on any list endpoint — /users, /roles, /achievements, /cosmetics, /allowlist return everything every time.
                          • No search/filter on /users — can't find by name/email/role server-side.
                          • No "unapprove" / suspend / ban / delete userPATCH /users/{id}/approve is one-way.
                          • No "impersonate user" for support flows.
                          • Self-protection — nothing prevents an admin from revoking their own admin role or deleting the admin role row.
                          • Achievement triggers: only POST exists; can't list/delete via API.
                          • Role-cosmetic / achievement-cosmetic linking tables exist (role_cosmetics, achievement_cosmetics) but no admin endpoints.
                          • "Last sign-in" field referenced in Admin.tsx types isn't returned by /users.
                          • /users decrypts every user's name + email per request — fine at current scale, hot CPU path past hundreds of rows; pagination amplifies the urgency.

                          Proposed tab structure

                          TabStatusNotes
                          UsersBackend exists, needs additionsPagination, search, unapprove, last_sign_in.
                          AllowlistBackend complete (just landed)Single-list view with approve/revoke + add-by-email.
                          RolesBackend completeAdd fix for re-assign 500 (use upsert). Surface granted_by (auto-fill from session).
                          AchievementsBackend mostly completeAdd list/delete for triggers; expose achievement_cosmetics linking.
                          CosmeticsBackend completeAdd role_cosmetics linking UI.
                          AnalyticsBackend missing entirelyDecide scope (DAU/MAU? per-feature counts?) before scoping UI.

                          Decisions needed

                          1. Unapprove: do we want the inverse of PATCH /users/{id}/approve? (Likely yes — manual mistake recovery.)
                          2. Audit log scope: a single admin_audit_log table with (actor_id, action, target_type, target_id, payload, created_at), or per-table audit columns?
                          3. Analytics scope: out of scope for v1, or include simple counts (total users, approved users, signups by day)?
                          4. Self-protection rules: prevent revoking own admin? Prevent deleting last admin? Prevent deleting admin role row?
                          5. Pagination shape: cursor or offset? Page size default?

                          Related work

                          • Beta allowlist endpoints + auth callback promotion logic landed alongside this issue (PR pending).
                          • Audit-log + unapprove + /users pagination/search would be the natural next backend chunk.

                          Metadata

                          Metadata

                          Assignees

                          No one assigned

                            Labels

                            No labels
                            No labels

                            Type

                            No type

                            Projects

                            No projects

                              Milestone

                              No milestone

                              Relationships

                              None yet

                              Development

                              No branches or pull requests

                              Issue actions

                              , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
                              Skip to content

                              feat(admin): admin portal UI — users, allowlist, roles, achievements, cosmetics #69

                              Description

                              @AndresL230

                              Goal

                              Build out the admin portal (frontend route already scaffolded in frontend/src/components/screens/Admin.tsx with tabs users | roles | achievements | cosmetics | analytics). This issue captures the full backend surface that exists today, gaps that block UI work, and decisions to make before implementation.

                              Auth gate

                              services/auth_guard.py::require_admin looks up the session user's user_roles and requires a row joining to roles where slug='admin'. Returns 401 (no session) or 403 (missing role). Every admin endpoint lives in routes/admin.py, mounted at /api/admin. is_admin: true is exposed on /api/auth/me for client routing.

                              Current backend surface

                              Users — /api/admin/users*

                              MethodPathBodyEffect
                              GET/usersAll users with decrypted name/email, is_approved, created_at, plus roles[] (id/name/slug/color).
                              PATCH/users/{user_id}/approveSets users.is_approved = true. No unapprove path.

                              Roles — /api/admin/roles*

                              MethodPathBodyEffect
                              GET/rolesAll roles, ordered by display_priority desc.
                              POST/rolesCreateRoleBodyInsert.
                              PATCH/roles/{id}partial dictWhitelist: name, color, icon, description, is_staff_assigned, is_earnable, display_priority. slug immutable.
                              DELETE/roles/{id}Hard delete; user_roles cascades.
                              POST/roles/assignAssignRoleBodyInsert user_roles. No conflict handling — re-assign 500s.
                              DELETE/roles/revokeRevokeRoleBodyDelete user_roles row.

                              Seeded roles: early-adopter, moderator, admin, verified, vip.

                              Achievements — /api/admin/achievements*

                              MethodPathBodyEffect
                              GET/achievementsAll achievements.
                              POST/achievementsCreateAchievementBodyInsert.
                              PATCH/achievements/{id}partial dictWhitelist: name, description, icon, category, rarity, is_secret.
                              DELETE/achievements/{id}Cascades to user_achievements, achievement_triggers, achievement_cosmetics.
                              POST/achievements/grantGrantAchievementBodyInsert user_achievements (409 if duplicate); fires check_achievements(user_id, \"manual_admin_grant\", {}).
                              POST/achievements/triggersCreateAchievementTriggerBodyInsert trigger row. No list/update/delete for triggers.

                              Cosmetics — /api/admin/cosmetics*

                              MethodPathBodyEffect
                              GET/cosmeticsAll cosmetics, ordered by type asc.
                              POST/cosmeticsCreateCosmeticBodyInsert.
                              PATCH/cosmetics/{id}partial dictWhitelist: name, asset_url, css_value, rarity, unlock_source. type and slug immutable.
                              DELETE/cosmetics/{id}Cascades to user_cosmetics, role_cosmetics.

                              Cosmetic types: avatar_frame, banner, name_color, title. Asset upload happens client-side directly to Supabase Storage (cosmetic-assets bucket); API stores the URL only.

                              Beta allowlist — /api/admin/allowlist*

                              MethodPathBodyEffect
                              GET/allowlistAll newsletter_emails rows (id, email, created_at, approved_at), newest first.
                              POST/allowlist/approveAllowlistEmailBodyUpsert email lowercased + approved_at = now().
                              POST/allowlist/revokeAllowlistEmailBodySet approved_at = NULL (preserves signup row). 404 if missing.

                              Pre-approved emails are auto-promoted to users.is_approved=true on their next OAuth callback (routes/auth.py:308-345). No mid-session promotion.

                              Gaps blocking the UI

                              • Analytics tab is in Admin.tsx's tab union but has no backend — needs new endpoints (user growth, session counts, document volume, etc.) before it's functional.
                              • No audit log — nothing records who approved a user, granted a role, or whitelisted an email. user_roles.granted_by exists but the route doesn't auto-fill it from the session.
                              • No pagination on any list endpoint — /users, /roles, /achievements, /cosmetics, /allowlist return everything every time.
                              • No search/filter on /users — can't find by name/email/role server-side.
                              • No "unapprove" / suspend / ban / delete userPATCH /users/{id}/approve is one-way.
                              • No "impersonate user" for support flows.
                              • Self-protection — nothing prevents an admin from revoking their own admin role or deleting the admin role row.
                              • Achievement triggers: only POST exists; can't list/delete via API.
                              • Role-cosmetic / achievement-cosmetic linking tables exist (role_cosmetics, achievement_cosmetics) but no admin endpoints.
                              • "Last sign-in" field referenced in Admin.tsx types isn't returned by /users.
                              • /users decrypts every user's name + email per request — fine at current scale, hot CPU path past hundreds of rows; pagination amplifies the urgency.

                              Proposed tab structure

                              TabStatusNotes
                              UsersBackend exists, needs additionsPagination, search, unapprove, last_sign_in.
                              AllowlistBackend complete (just landed)Single-list view with approve/revoke + add-by-email.
                              RolesBackend completeAdd fix for re-assign 500 (use upsert). Surface granted_by (auto-fill from session).
                              AchievementsBackend mostly completeAdd list/delete for triggers; expose achievement_cosmetics linking.
                              CosmeticsBackend completeAdd role_cosmetics linking UI.
                              AnalyticsBackend missing entirelyDecide scope (DAU/MAU? per-feature counts?) before scoping UI.

                              Decisions needed

                              1. Unapprove: do we want the inverse of PATCH /users/{id}/approve? (Likely yes — manual mistake recovery.)
                              2. Audit log scope: a single admin_audit_log table with (actor_id, action, target_type, target_id, payload, created_at), or per-table audit columns?
                              3. Analytics scope: out of scope for v1, or include simple counts (total users, approved users, signups by day)?
                              4. Self-protection rules: prevent revoking own admin? Prevent deleting last admin? Prevent deleting admin role row?
                              5. Pagination shape: cursor or offset? Page size default?

                              Related work

                              • Beta allowlist endpoints + auth callback promotion logic landed alongside this issue (PR pending).
                              • Audit-log + unapprove + /users pagination/search would be the natural next backend chunk.

                              Metadata

                              Metadata

                              Assignees

                              No one assigned

                                Labels

                                No labels
                                No labels

                                Type

                                No type

                                Projects

                                No projects

                                  Milestone

                                  No milestone

                                  Relationships

                                  None yet

                                  Development

                                  No branches or pull requests

                                  Issue actions