sdarbinyan/marketplaces
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(admin): users and permissions

Browse Source 
Sprint 25.

New features/admin/users/ module, net-new /:lang/backoffice/users route +
Dashboard Quick Action.

- users: name, Telegram username, scope (marketplace vs office admin),
  role (inline change), status (active/invited/suspended), last login
- 4 built-in roles (owner/admin/editor/viewer) with flat permission lists
- invitations: email + role + scope form, pending list + revoke (no email
  actually sends - local record only)
- passwordless login confirmed already real (AdminAuthService Telegram QR,
  docs/BACKEND.md item 1) - linked, not reimplemented
- per-user mock session list (device/IP/last-active, revoke) - flagged as
  mock since the real AdminAuthService only ever tracks the current
  browser's session
- per-user audit log dialog (role/status changes), same pattern as
  Sprint 24's per-transaction audit, intentionally separate from the
  system-wide log planned for Sprint 26

docs/ADMIN.md + docs/BACKEND.md (new item 14) updated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
sdarbinyan
2026-07-15 11:05:21 +04:00
parent 7d65913245
commit 17adc9e9fd
12 changed files with 455 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/SPRINT-PLAN.md
View File

@@ -52,9 +52,11 @@ Notify user: **from Sprint 20 (Categories) once product↔category link + admin
- [x] `docs/ADMIN.md` (new Sprint 24 section), `docs/BACKEND.md` item 13 added
- Commit: `feat(admin): transaction management`
## Sprint 25 — Users & Roles
- [ ] Users/roles/permissions models (local), marketplace vs office admin distinction
- [ ] Invitations, passwordless login (reuse existing Telegram QR pattern), session/device manager, audit trail
## Sprint 25 — Users & Roles ✅ done
- [x] Users/roles/permissions models (local, 4 built-in roles), marketplace vs office admin distinction
- [x] Invitations, passwordless login confirmed already real (Telegram QR, AdminAuthService — linked not reimplemented), session/device manager (mocked), per-user audit trail
- [x] Wired into Dashboard Quick Actions + new `/​:lang/backoffice/users` route
- [x] `docs/ADMIN.md` (new Sprint 25 section), `docs/BACKEND.md` item 14 added
- Commit: `feat(admin): users and permissions`
## Sprint 26 — Monitoring