nmemmert 7006fbf544 Add admin panel restricted to a single designated account
Adds a full admin view (users + projects, with view/delete) gated
server-side by ADMIN_EMAIL in server/auth.js (defaults to the site
owner's account, overridable via env var for other deployments). The
gate is enforced on every /api/admin/* route, not just hidden in the
UI — verified a non-admin session gets 403 even when it hits the
endpoints directly. Deleting a user leaves their projects in place
(not cascade-deleted) so admin cleanup can't accidentally destroy
someone's study data.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-06 13:07:54 -04:00
S
Description
No description provided
22 MiB
Languages
JavaScript 97%
Shell 2.4%
Dockerfile 0.2%
HTML 0.2%
CSS 0.2%