This repository was archived by the owner on Oct 25, 2026. It is now read-only.
Repository navigation
Admin Panel
The panel lives at /admin with its own sign-in at /admin/login.
- E-mail and password, plus the authenticator code once a staff member turns on two-step sign-in from My security. Recovery codes cover a lost phone.
- A session that didn't come through the staff sign-in (a customer session, a remember-me cookie) is refused.
- Every admin URL returns 404 to anyone who isn't staff.
- Sessions sign out after 30 minutes idle; the staff login is throttled for 15 minutes after failures.
| Role | Can |
|---|---|
| Owner | Everything, including refunds, bans and managing staff |
| Pharmacist | Prescriptions, stock and prices, moving orders along |
| Support | Orders, customer profiles and usernames (no refunds, no bans) |
The owner adds staff by e-mail, changes roles, removes access and resets a lost phone's two-step sign-in. The last owner can never be demoted. From the command line:
php artisan user:admin <email> --role=owner|pharmacist|support [--revoke] [--reset-2fa]- Today at Zovita: to-do cards (prescriptions, orders to confirm, low and sold-out stock), revenue, orders, average order and new customers against the previous period, and charts with a table view.
-
Prescriptions: accept, reject or leave pending with a note to the customer. Anything not reviewed within 24 hours is accepted automatically by
prescriptions:auto-approve(every 10 minutes) and labelled "auto-approved". - Customers: search, filters and a full activity timeline (sign-ins, views, bag, orders, prescriptions, profile changes, device and IP).
- Orders: status workflow, card payment and refunds.
- Products: stock and price at a glance.
Every page has a "How this page works" guide and a ? next to each heading, written for non-technical staff.
 |
 |
| Prescription review with 24 h auto-accept | Customer detail: activity, username, ban wizard |
| Severity | Effect |
|---|---|
| Temporary (1 day / 1 week / 1 month / custom) | Account locked until the date |
| Permanent | Account locked; the e-mail, phone and device can't register again |
| Deep | Also blocks the IP, its network (/24 IPv4, /64 IPv6) and browser fingerprint site-wide |
E-mail matching is canonical (Gmail dots and +aliases are folded). A banned person sees a calm "account suspended" page with the reason and end date.