annlite-admin

The secure administrative dashboard for the Ann Lite ecosystem.

Purpose

Content moderation, charity project management, donation/transaction visibility, user and role management, transparency reporting, and platform settings — all operating exclusively through annlite-backend's authenticated, RBAC-guarded API.

Architecture

annlite-admin/
├── app/
│   ├── dashboard/
│   ├── content/         # moderation queue — enforced workflow via backend
│   ├── charity/          # project creation (charity:manage)
│   ├── donations/          # read-only, pending a backend listing endpoint
│   ├── users/                # users:manage
│   ├── transparency/
│   ├── settings/
│   └── login/
├── components/
│   └── RequireAuth.tsx        # UI convenience guard — NOT the security boundary
├── lib/
│   ├── api.ts                   # authenticated backend client (Bearer token)
│   └── auth.tsx                   # session/auth context
├── tests/
└── docs/ARCHITECTURE.md

See docs/ARCHITECTURE.md for the full authorization model — in short, this app's own role checks are UX only; annlite-backend's middleware is the actual authority.

Installation

npm install
cp .env.example .env.local

Configuration

• NEXT_PUBLIC_API_BASE_URL — points at annlite-backend

No database credentials or payment provider secrets belong in this repository.

Development

npm run dev
npm run build
npm start

Testing

npm test

tests/boundaries.test.ts asserts: no database client is ever imported in app/, no payment credentials appear anywhere, sensitive pages are wrapped in a role-gated guard, and the content moderation page always calls the backend rather than mutating state locally.

Security Considerations

• Strong authentication + RBAC. Every write action is ultimately authorized by annlite-backend; this app cannot grant itself permissions the backend doesn't recognize.
• No direct database access, ever, from this application.
• Session token stored in sessionStorage (not localStorage) and cleared on any 401 response.
• Content publication always follows the same enforced DRAFT → REVIEW → APPROVED → PUBLISHED workflow as the backend — this app cannot skip a step.

Related Ann Lite Repositories

• Depends on: annlite-backend (all data and authorization), annlite-design-system (all UI)
• Used by: Ann Lite content editors and administrators only