Admin Access

Admin Access

The administrator backend is available at /admin, but access is permission aware. Users without the required RBAC role or permission should be redirected away from admin-only surfaces.

Assigning a Role

Use the role assignment script with an email or user id:

npm run rbac:assign -- --email=user@example.com --role=admin

Available role names include super_admin, admin, editor, and viewer.

Access Checklist

• The user must exist in the database.
• The role assignment must be present.
• Admin pages and server actions must enforce permission checks.
• Public pages should link to /admin only when the user is authorized.