sdarbinyan bac415d003 feat: UI-only permission gate for admin routes (cosmetic pending backend) ...

adminAuthGuard only checked isAuthenticated() - any signed-in admin
could reach any route. The live Telegram/QR auth (Mechanism A) carries
no role claim, so a real gate needs a backend change (tracked in
BACKEND-API-REFERENCE.md).

Added AdminPermissionsService + requireAdminPermission() guard factory
that derive a permission set locally by matching the Telegram username
against the mock Users domain's roleId - the same local-only stand-in
already used for the rest of that domain. Wired onto /backoffice/users
requiring 'users.manage'. Explicitly cosmetic: backend must
independently authorize every mutation regardless of what this guard
decides.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-08-13 07:22:01 +04:00

.github/workflows

arch(sprint1): enforce boundaries and cycle checks in ci

2026-07-03 02:16:03 +04:00

.impeccable

changes

2026-07-19 15:28:35 +04:00

.vscode

very first commit

2026-01-18 18:57:06 +04:00

docs/context/features

docs: replace 62 scattered/stale markdown files with two living references

2026-08-13 03:17:09 +04:00

files

api auth

2026-06-01 00:47:26 +04:00

public

fix(storefront): release-candidate walkthrough fixes

2026-07-24 09:46:51 +04:00

src

feat: UI-only permission gate for admin routes (cosmetic pending backend)

2026-08-13 07:22:01 +04:00

tools/architecture

arch(sprint1): enforce boundaries and cycle checks in ci

2026-07-03 02:16:03 +04:00

.editorconfig

very first commit

2026-01-18 18:57:06 +04:00

.gitignore

chore: ignore .claude/ worktrees and graphify-out/ knowledge-graph output

2026-07-15 00:53:42 +04:00

angular.json

chore(build): raise initial-bundle error budget so ng build succeeds

2026-07-19 22:03:28 +04:00

BACKEND-API-REFERENCE.md

docs: replace 62 scattered/stale markdown files with two living references

2026-08-13 03:17:09 +04:00

GAPS-AND-IMPROVEMENTS.md

docs: replace 62 scattered/stale markdown files with two living references

2026-08-13 03:17:09 +04:00

karma.conf.js

perf: drop @lucide/angular, hand-roll used icons - initial bundle 13.68MB -> 2.64MB

2026-08-06 10:55:00 +04:00

nginx.conf

docs(nginx): clarify SPA fallback and API proxy patterns in onboarding template

2026-07-14 12:22:21 +04:00

ngsw-config.json

fixes

2026-03-24 02:25:50 +04:00

package-lock.json

perf: drop @lucide/angular, hand-roll used icons - initial bundle 13.68MB -> 2.64MB

2026-08-06 10:55:00 +04:00

package.json

perf: drop @lucide/angular, hand-roll used icons - initial bundle 13.68MB -> 2.64MB

2026-08-06 10:55:00 +04:00

proxy.conf.json

bug-fixes

2026-07-09 01:40:22 +04:00

skills-lock.json

feat(product): add reusable Product Experience 2.0

2026-07-10 13:10:35 +04:00

start

phone number and address

2026-05-28 12:56:41 +00:00

tsconfig.app.json

chore(deps): update Angular core/cli/animations/common/compiler/forms/platform-browser/router/service-worker 21.1.5 -> 22.0.8

2026-07-26 19:06:43 +04:00

tsconfig.json

cleaned up

2026-06-21 23:42:39 +04:00

tsconfig.spec.json

chore(deps): update Angular core/cli/animations/common/compiler/forms/platform-browser/router/service-worker 21.1.5 -> 22.0.8

2026-07-26 19:06:43 +04:00

Description

No description provided

16 MiB

Languages

TypeScript 71.4%

HTML 15.3%

SCSS 11.9%

Shell 1.3%

JavaScript 0.1%