feat(admin): menus + sessions UI + impersonation + privacy + plugin admin pages - #491
Merged
Conversation
tayebmokni
enabled auto-merge (squash)
May 26, 2026 22:09
Add navigation menus surface — a `menus` + `menu_items` schema with dot-separated ltree-style paths, a goroutine-safe Store (Memory + Pgx), the /api/v1/admin/menus REST routes gated by manage_themes, an Admin UI at /appearance/menus with drag-to-reorder, and a core/navigation block renderer that resolves menu_id to items through a MenuResolver injected on the render Context. Closes #54. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Tayeb Mokni <tayeb.mokni@gmail.com>
Wire the existing GET/DELETE /api/v1/auth/sessions backend into a
Settings → Sessions page. Lists each live session with device label,
IP, created/last-seen stamps. Per-row Revoke button revokes a single
session via DELETE /sessions/{id}; "Sign out of all other devices"
hits DELETE /sessions (the server scopes the bulk delete to the
non-current set). Both flows update optimistically and revert on
ApiError.
Closes #205.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Tayeb Mokni <tayeb.mokni@gmail.com>
Add POST /api/v1/admin/users/{id}/impersonate (gated to
super_admin) that mints a session as the target user and stamps an
`impersonation` flag, the actor user ID, and the actor's original
session token into the session data. A companion
GET/DELETE /api/v1/auth/impersonation pair surfaces the banner
state and tears the impersonation down (restoring the actor's
original cookie). On the frontend the authenticated layout renders
<ImpersonationBanner> at the top of every authenticated surface;
<ImpersonateButton> can be dropped onto user detail pages. Every
start emits an audit event with both actor and target pinned.
Closes #211.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Tayeb Mokni <tayeb.mokni@gmail.com>
Add a privacy-group seed to the settings registry covering cookie policy URL/text, audit/sessions/login-attempts retention windows, and the GDPR self-service toggle. Wire a Settings → Privacy page that PATCHes through the existing registry endpoint. The POST /api/v1/account/data/export route reads the toggle on every request — when an operator flips it off the endpoint returns 403 with code "gdpr_disabled", and the producer is never invoked. Closes #225. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Tayeb Mokni <tayeb.mokni@gmail.com>
…228) Extend the gonext.io/v1 plugin manifest with an admin_pages array (slug + label + optional icon + optional capability), expose GET /api/v1/admin/plugin-pages that flattens admin_pages across every active plugin's manifest, and render a "Plugins" sidebar section that fetches it at runtime. The catch-all route /plugins/{plugin}/{slug} hosts the plugin's frontend module via a dynamic-import bridge to the (out-of-tree) plugin frontend host — when the host isn't bundled the bridge falls back to a "no module registered" placeholder so the route still renders. Closes #228. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Tayeb Mokni <tayeb.mokni@gmail.com>
tayebmokni
force-pushed
the
feat/admin-final-polish
branch
from
May 26, 2026 22:14
4ef39cc to
33f0f9c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #54, #205, #211, #225, #228.