feat(admin): admin app foundation#1967
Merged
Merged
Conversation
Sixteen tasks plus pre-flight and wrap, covering migration 0012, the auth-shell package extraction, policies + middleware, the admin sub-app, the apps/admin scaffold, the adaptive shell, dashboard, audit reader, CI lane, manual ops, and a Playwright smoke. Each task is bite-sized with exact file paths, complete code, expected output, and a commit step. Tracks GitHub #1956.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Moves AuthKitProvider mount, RootErrorBoundary, and useApi hook into @us-rse/auth-shell so both the web SPA and the upcoming admin app can share them without diverging. apps/web shims become thin re-exports.
Walks the WorkOS→canonical-user merge chain (depth 5), hydrates leadership terms (joined to leadership_positions for positionType/label), chaired groups, and chaired events in one parallel DB round-trip, then gates entry on canEnterAdminApp and stashes ActorContext on c.var.actor. Also extends Variables in types.ts with the optional actor field.
Adds requirePolicy middleware factory, the /api/admin Hono sub-app (auth → actorContext in order), and GET /api/admin/me so the SPA can bootstrap actor context on load.
Adds GET /api/admin/audit endpoint gated to super_admin (systemTier >= 2). Supports filtering by actorId, action substring, targetType, targetId, and a created_at date range. Cursor encodes createdAt|id for stable keyset pagination across millisecond-level ties. Limit capped at 200.
Vite + React + Tailwind app on port 5174 with AuthShell provider, project-reference TS configs, and Cloudflare Pages _redirects.
Wire auth callback, useActorContext polling /admin/me every 60s, frontend policy mirror, NotEntitled gate, and App routing so the shell knows who the actor is before rendering nav items.
Adds AdminShell layout wrapper with role-gated Sidebar nav, TopBar with sign-out, useNavSections hook, and stub routes for all sections. App.tsx now renders the shell instead of the debug gate.
Replaces the corner-of-the-page Sign-in placeholder with a centered, branded landing surface that matches the public site palette and gives the admin app a real first impression. Loading/pending/error states now share the same shell so the boot sequence reads as one continuous surface.
Calls signIn() on mount the first time per tab so an admin who is already signed in elsewhere (usrse.org, another browser tab) lands straight in the admin app — WorkOS silently SSOs them via its session cookie and our callback runs without a button press. Keeps the styled manual sign-in card as a fallback for the rare case where they came back unauthenticated (cancelled the WorkOS prompt or their session is invalid), so there's always an escape route. Sign-out paths (TopBar, NotEntitled) clear the per-tab attempt flag so the next visit gets the auto-redirect experience again instead of being stuck on the manual card.
Copy the full Tailwind @theme block, keyframes, base layer, and custom utilities from apps/web into apps/admin, keeping the design-system tokens import and dropping MapLibre overrides. Replace Stub with a ComingSoon editorial component, refine TopBar/Sidebar/AdminShell chrome, bump SignInPage wordmark weight, replace NotEntitled inline styles with Tailwind classes, and standardize all purple accent bars to purple-500.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1956.
Spec:
docs/superpowers/specs/2026-05-09-admin-app-foundation-design.mdPlan:
docs/superpowers/plans/2026-05-09-admin-app-foundation.mdSummary
Establishes the admin-app foundation — workspace, auth posture, role/permission model, audit infrastructure, and frontend shell — so the ten subsystem specs queued behind it (members, vocab, organizations, groups, events, recognition, forms, elections, communications, operations) can land on a stable target.
Schema
staffvalue onuser_roleenum (migration 0012); legacyadminbackfilled and kept for one rev.Backend (packages/api)
lib/policies/— five pure-function policies (canEnterAdminApp,canApproveVocab,canMergeUsers,canEditGroup,canEditEvent,canViewAuditLog) + 19 Vitest tests.middleware/actorContext.ts— walks user merge chain, loads leadership terms + chair memberships, populatesc.var.actor.middleware/policy.ts—requirePolicyfactory.middleware/audit.ts— afterware that writes oneaudit_logrow per mutating admin request.routes/admin/— Hono sub-app mounted at/api/admin/*withrequireAuth → requireActorContext → auditMiddleware. Endpoints:/me, cursor-paginated/audit.routes/webhooks.ts—handleUserCreatednow links legacy CSV rows by email on first WorkOS sign-in (previously silently failed on email unique-constraint).Frontend
packages/auth-shellpackage — extracts WorkOSAuthShell,RootErrorBoundary,useApifromapps/webso both SPAs share one identity surface.apps/adminSPA — Vite + React 19 + Router 7 + Tailwind, design-system tokens fully wired.users.roleand environment-aware (localhost:5174in dev,admin.us-rse.orgin prod,VITE_ADMIN_URLoverride).Infra
.github/workflows/deploy-admin.ymlfor the new Pages project..github/workflows/deploy.ymltriggers extended to include this branch.dev:web,dev:admin,dev:api.Test plan
usrse.org(or the relevant preview) — user dropdown shows "Admin portal" when role isstafforsuper_admin, hidden otherwise./admin/auditloads recent rows (super_admin only).Out of scope (deferred, tracked by separate issues)
Manual ops still required
us-rse-adminis provisioned and servesadmin.us-rse.org.VITE_WORKOS_CLIENT_IDset as a Production + Preview env var on the admin Pages project.