Admin panel

The admin SPA (@aw-chat/admin) is for operators and content authors. It talks to the same @aw-chat/server over /admin/* (and uses /files/ for media). End users never see this UI.

Deploy

1. Bootstrap a super-admin against the production database:

   pnpm --filter @aw-chat/server admin:create <username> <password> [email]

2. Build and host the SPA:

   • Same-origin with the API: empty VITE_API_BASE.
   • Separate origin (common): build with VITE_API_BASE=<api public URL> and add that admin origin to the API’s CORS_ORIGINS.

Docker: apps/admin/Dockerfile (nginx). See Deployment.

Auth

• Credentials live in Postgres admin_users (scrypt). Env ADMIN_USER / ADMIN_PASS are ignored.
• Login exchanges Basic for a short-lived HMAC session token (ADMIN_SESSION_SECRET, default TTL 12h via ADMIN_SESSION_TTL_MS).
• The SPA keeps the token in sessionStorage and sends it as Bearer.
• Failed logins are rate-limited by client IP — set TRUST_PROXY_HOPS=1 behind nginx or all admins share one lockout bucket.

Permissions

Permission	Gates
manage_posts	Channel posts, media, schedule/publish
manage_reasons	Complaint / CSAT / request topic lists
view_logs	Admin audit log
view_feedback	CSAT + complaints tables
manage_users	Create / edit / deactivate admins
moderate_comments	Comment queue, hide/delete, mute/ban

Super-admins (is_super) implicitly have every permission. The last active super-admin cannot be removed or demoted.

Main surfaces

Area	Purpose
Posts / editor	Author channel posts (rich text, media, buttons, comments toggle)
Statistics	Channel engagement charts (STATS_TZ buckets hours)
Reasons	Nested request topics + flat complaint/CSAT labels
CSAT / Complaints	Ratings and formal complaints from the SDK
Comments	Moderation queue (reported / filtered / hidden / deleted)
Comment bans / moderators	Per-channel mute/ban; assign in-feed moderators
Users	Admin account management
Logs	Audit trail (admin_logs)

Channel vs Intercom

Admins do not run the Intercom inbox inside this SPA. Support conversations and tickets are handled in Intercom. This panel owns channel content, CSAT / complaints, reasons, comment moderation, and admin IAM.

Data residency: Data model.