Admin shortcut in the account menu, switched on per study user from /admin; v2.25.0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

server/data.js

@@ -1394,6 +1394,8 @@ export function sanitizeStudyUsers(value) {
       studyRemindersEnabled,
       enrolledStudySlugs,
       completedStudySlugs,
+      // Only the admin panel can set this (see PATCH /api/admin/study-users/:id)
+      adminShortcut: item?.adminShortcut === true,
       currentStreak: Number.isFinite(item?.currentStreak) && item.currentStreak > 0 ? Math.floor(item.currentStreak) : 0,
       longestStreak: Number.isFinite(item?.longestStreak) && item.longestStreak > 0 ? Math.floor(item.longestStreak) : 0,
       lastStudiedDate: typeof item?.lastStudiedDate === 'string' ? item.lastStudiedDate : null,

server/routes/admin-assets.js

@@ -239,6 +239,7 @@ export function register(app) {
         currentStreak: user.currentStreak ?? 0,
         longestStreak: user.longestStreak ?? 0,
         reengagementSentAt: user.reengagementSentAt ?? {},
+        adminShortcut: user.adminShortcut === true,
       }
     }))
 
@@ -282,12 +283,16 @@ export function register(app) {
     const user = state.studyUsers.find(u => u.id === req.params.id)
     if (!user) { res.status(404).json({ message: 'User not found.' }); return }
 
-    const { displayName, newPassword, addEnrollment, removeEnrollment } = req.body ?? {}
+    const { displayName, newPassword, addEnrollment, removeEnrollment, adminShortcut } = req.body ?? {}
 
     if (typeof displayName === 'string') {
       user.displayName = displayName.trim().slice(0, 80)
     }
 
+    if (typeof adminShortcut === 'boolean') {
+      user.adminShortcut = adminShortcut
+    }
+
     if (typeof newPassword === 'string') {
       if (newPassword.length < 8 || newPassword.length > 200) {
         res.status(400).json({ message: 'Password must be 8–200 characters.' }); return
@@ -314,7 +319,7 @@ export function register(app) {
 
     user.updatedAt = new Date().toISOString()
     queueStudyUsersWrite()
-    res.json({ ok: true, displayName: user.displayName, enrolledStudySlugs: user.enrolledStudySlugs })
+    res.json({ ok: true, displayName: user.displayName, enrolledStudySlugs: user.enrolledStudySlugs, adminShortcut: user.adminShortcut === true })
   })
 
   app.delete('/api/admin/study-users/:id', requireAdminAuth, async (req, res) => {

server/routes/study-auth.js

@@ -70,6 +70,9 @@ export function register(app) {
       subscribeNewsletter: user?.subscribeNewsletter !== false,
       studyRemindersEnabled: user?.studyRemindersEnabled === true,
       avatarUrl: user ? getStudyAvatarUrl(user) : '',
+      // Shows an Admin link in the account menu. Only the admin panel can turn this on, and the link
+      // still lands on the admin sign-in, so it grants no access by itself.
+      adminShortcut: user?.adminShortcut === true,
       // Studies the student can open: enrolled ones plus any they have finished
       enrolledStudySlugs: user ? getAccessibleStudySlugs(user) : [],
       completedStudySlugs: Array.isArray(user?.completedStudySlugs) ? user.completedStudySlugs : [],