Account Dashboard

Account Dashboard

The account dashboard at /account shows the signed-in user's own account details. Public users land here after login. Administrators and editors land at /admin and can also visit /account directly. See Login Security for the complete login destination table.

Core does not provide public self-registration. Administrators or imports provision accounts; the public role grants no administration access.

Account Details

The dashboard displays:

• Name
• Email address
• Account creation date
• Last login date, or a message when no login has been recorded

The overview is read-only. It does not provide profile editing, password changes or account deletion. Selecting another user through a URL parameter does not change whose details are displayed.

Shared Dashboard Layout

The page uses the same header, collapsible sidebar, cards and mobile navigation as the Admin Interface. Its navigation contains My account, Two-factor authentication (/account/security, see Login Security), Visit website and Logout, including when an administrator or editor visits it. The sidebar brand and header profile link lead to /account; administrative settings, content, API documentation and module links are omitted.

The interface is available in English and Russian and uses the same saved language preference and localized dates as login and administration. Language selection submits to POST /language, then returns through /login to the landing page for your role. Account URLs have no language prefix. Logout uses the existing POST /logout action. Site themes do not need an account template.

Privacy and Access

The page requires a valid session and a recognized admin, editor or public role. Anonymous visitors are redirected to login; unrecognized roles receive 403. Authentication reloads the current user and role on each protected request. Deleted users and sessions invalidated by password changes must sign in again.

Responses containing account details use Cache-Control: private, no-store and noindex, nofollow. See Security and Login Security for session and role behavior.

Upgrading an Existing Site

/account is a reserved, unprefixed core route. Before upgrading, rename any page slug, alias, module route or language prefix that already uses it. The account dashboard takes precedence; conflicting content is not renamed or deleted automatically.

New account language prefixes are refused, and legacy conflicting prefixes cannot override the core route. Content redirect rules, including wildcard rules, cannot intercept /account or paths below it. Similar paths such as /accounting retain their normal content redirect behavior. New pages and aliases cannot use the account slug, robots.txt disallows /account, and first-party analytics does not record it.

No database migration or site-theme changes are required.