Admin Interface

Admin Interface

oCMS provides a modern admin panel built with HTMX and Alpine.js.

Login and Account Access

Administrators and editors land at /admin after login. Public users land at /account and cannot access administration. An authenticated visit to /login uses the same destinations. See Login Security.

The Account Dashboard reuses the admin header, collapsible sidebar, cards and mobile navigation with account-only links. Administrators and editors can visit it directly; their normal admin navigation remains available at /admin.

Dashboard

The admin dashboard at /admin/ provides:

• Statistics Overview — Key metrics about your site
• Recent Submissions — Latest form submissions
• Quick Actions — Frequently used operations

Admin Routes

Editor Routes (editor + admin access)

• /admin/ — Dashboard
• /admin/events — Event log
• /admin/pages — Page management
• /admin/tags — Tag management
• /admin/categories — Category management
• /admin/media — Media library
• /admin/menus — Menu management
• /admin/forms — Form builder and submissions
• /admin/widgets — Widget management
• /admin/themes/settings — Theme settings (for active theme)

Admin-Only Routes

• /admin/users — User management
• /admin/languages — Language management
• /admin/config — Site configuration
• /admin/themes — Theme list, activation, archive import, and inactive custom theme deletion
• POST /admin/themes/import — Install a validated .tar.gz HTML theme
• POST /admin/themes/{name}/delete — Delete an inactive custom theme after confirmation
• /admin/modules — Module list and toggle
• /admin/api-keys — API key management
• /admin/webhooks — Webhook management
• /admin/redirects — Content redirect rules
• /admin/cache — Cache statistics and clear
• /admin/scheduler — Scheduled jobs management
• /admin/export — Content export
• /admin/import — Content import
• /admin/docs — Site documentation

Theme Management

At Admin > Themes, upload a .tar.gz and activate the newly installed theme. Import does not activate it automatically and needs no server restart. Delete controls appear for inactive custom themes; active and core themes are protected, including custom overrides of core themes. Deletion retains saved settings and widgets for reinstallation.

Import and deletion require an administrator and CSRF validation and are disabled in demo mode. The admin labels and feedback are available in English and Russian. See Theme System for archive limits, packaging rules, and the bundled Tiny Sample archive.

Feed documentation

/admin/docs lists the public RSS/Atom site, category and tag endpoints in English and Russian. Feeds are built into core and need no module activation or new admin setting; configure the existing site URL and publish posts to make subscriptions available. See Feeds for content and language rules.

Bulk Actions

Bulk multi-select and bulk delete/revoke are available on delete-capable paged admin lists.

Supported Views

View	URL	Action
Pages	/admin/pages	Bulk delete
Tags	/admin/tags	Bulk delete
Users	/admin/users	Bulk delete
API Keys	/admin/api-keys	Bulk revoke (deactivation)
Media	/admin/media	Bulk delete
Form Submissions	/admin/forms/{id}/submissions	Bulk delete

Read-only pagers (events, page versions, webhook deliveries, scheduler task runs) do not have bulk actions.

Behavior

• Selection scope is current page only
• Selection is reset when navigating to another page
• A confirmation dialog is shown before bulk delete/revoke
• Operations use partial success: valid IDs are processed; missing/protected IDs, and IDs that could not be processed, are returned in failed
• A request with no IDs, a non-positive ID or more than 200 unique IDs is rejected as a whole
• After success, the current page is reloaded to refresh counts and rows

API Endpoints

All bulk endpoints accept:

{"ids": [1, 2, 3]}

Success response:

{"success": true, "deleted": 2, "failed": [{"id": 3, "reason": "..."}]}

Endpoints:

• POST /admin/pages/bulk-delete
• POST /admin/tags/bulk-delete
• POST /admin/users/bulk-delete
• POST /admin/api-keys/bulk-delete
• POST /admin/media/bulk-delete
• POST /admin/forms/{id}/submissions/bulk-delete

List Sorting

Column sorting is available on delete-capable admin pagers.

Query Parameters

• sort=<field> — Column to sort by
• dir=asc|desc — Sort direction

The sort state is URL-driven and preserved across pagination and items-per-page changes.

UI Behavior

• Table views use sortable column headers
• Media (grid view) exposes sort controls in the filter bar
• Active sorting is highlighted with a visible pill-style header state
• Clicking the active column toggles direction
• Changing sort field resets to page 1
• Invalid values safely fall back to per-view defaults

Default Sort

Pages default to sort=updated_at&dir=desc when no sort params are provided.

Sort Safety

Sorting is whitelist-based per view. Only predefined fields are accepted for ORDER BY. User input is never interpolated directly into SQL clauses.

Items Per Page

Delete-capable views include an items-per-page selector:

• Options: 10, 20, 50, 100 (media also includes 24 for its legacy default)
• State is URL-only via per_page query parameter
• Changing items per page resets to page 1
• Pagination, per-page, and bulk actions preserve active sorting parameters

Event Logging

All admin actions are recorded in the event log at /admin/events:

• Content changes (create, update, delete, publish)
• User management actions
• Configuration changes
• Scheduler events
• Login attempts (see Login Security)