Overview

Admin UX is under src/app/[locale]/(admin)/admin/* (orders, users, presets, posts, invitations, monitoring, debug tools, etc.). All sensitive routes must align with ADMIN_EMAILS (and optional DB flags) checked in src/lib/admin.ts and /api/admin/check-permission.

Permission model

GET /api/admin/check-permission — uses auth() session email vs process.env.ADMIN_EMAILS, with DB fallback in route.
Individual admin API routes should verify admin before mutating data (pattern: check-permission or inline isAdmin).

Key API groups

Area	Example routes
Presets	`/api/admin/preset-modules`, `/api/admin/preset-websites`, `full-sync-presets`
Content	`copy-admin-content`, `template-content`, `clear-news-cache`
Stats / debug	`profile-stats`, `stats`, `debug-env`, `debug-modules`
Binance / news ops	`sync-binance-alpha`, `reprocess-binance-alpha`, `clean-duplicate-events`
Users / invites	`invitations`, `set-admin`

Data flow

Admin handlers → services (src/services/admin-*.ts, etc.) → models / Drizzle — same layering rule as the rest of the app (services orchestrate, models persist).

Key files

src/lib/admin.ts — email allowlist.
src/app/api/admin/check-permission/route.ts — front door check for SPA.

Dependencies

Environment

ADMIN_EMAILS — server-side allowlist; NEXT_PUBLIC_ADMIN_EMAILS mirrors for client checks (src/lib/admin.ts).
ADMIN_SECRET_KEY — optional Bearer for some ops; clear-news-cache also accepts CRON_SECRET_KEY.
DATABASE_URL

Database (src/db/schema.ts)

users (e.g. is_admin, admin user listing)
posts (CMS under /admin/posts)
preset_module_types, preset_websites (preset sync and editing)
orders (orders admin UI), news cache tables when clearing or fixing news (news_items_cache, binance_alpha_news_cache, etc.)

Admin back office