Admin Module
What admin-basic installs
$ asa install admin-basicReal admin control surface. Not a CRUD table with a sidebar.
This is real output from our architecture service — not a downloadable template.
Admin Dashboard
domains/admin/dashboard/ — requires admin.access permission
Total Users
1,247
Active Subscriptions
389
Admin Actions (24h)
17
Recent Activity
Assigned 'support' to user@example.com
admin@company.com · 2 min ago
Impersonating user@example.com (reason: billing issue)
admin@company.com · 15 min ago
Updated profile for john@example.com
owner@company.com · 1h ago
User Management
domains/admin/users/ — requires admin.users.list permission
| Name | Role | Actions |
|---|---|---|
Jane Smith jane@company.com | owner | Edit|Impersonate |
John Doe john@example.com | admin | Edit|Impersonate |
Sarah Connor sarah@example.com | support | Edit|Impersonate |
Mike Wilson mike@example.com | user | Edit|Impersonate |
Safe Impersonation
domains/admin/impersonation/ — requires admin.impersonate permission
Start Impersonation
Required. Stored in audit log. Min 3 characters.
HttpOnly cookie. Server-side only. No fake JWT.
Security: Admin session stays admin. Impersonation is server-side context. All actions are audit-logged with actor + subject chain. Auto-expires after TTL.
Immutable Audit Log
domains/admin/audit-log/ — requires admin.audit.view permission
admin@company.com → mike@example.com
Reason: Billing issue resolved
admin@company.com → mike@example.com
Reason: Billing issue investigation
owner@company.com → sarah@example.com
Reason: Promoted to support
admin@company.com → spam@example.com
Reason: Spam account
Immutable: DELETE and UPDATE blocked by RLS policy. No admin can erase their own audit trail. Append-only by design.
Permission-Based Guards
shared/admin/guards.ts — check permissions, not role strings
// Every admin handler uses permission guards:
const { user, response } = await requirePermission(
request, PERMISSIONS.USERS_LIST
);
if (response) return response; // 403 + audit logged
// Built-in roles:
// owner → all 9 permissions
// admin → users.list, users.edit, roles.assign
// support → users.list, impersonate, audit.view
// Lint rule SEC-003 blocks admin routes without guards.
// Lint rule ENT-002 blocks role === 'admin' checks.Why Founders Care About Admin
Technical depth → business impact
Impersonate users to see exactly what they see — without sharing passwords or asking for screenshots. Faster resolution, happier customers.
Immutable audit log means you know who did what and when. Required for SOC 2, expected by enterprise customers, essential for trust.
Permission guards prevent support staff from accessing billing. Granular RBAC means the right people have the right access — nothing more.
Admin that customers trust. Not a CRUD table.
Resolve issues safely, track every action, and control access — from install.