Telegram-Market/telegram-shop
1
1
Fork 0
Code Issues 43 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

Super Admin Role & Auth System #124

New Issue
Open
opened 2026-07-09 14:23:10 +00:00 by NW · 0 comments
NW commented 2026-07-09 14:23:10 +00:00
Owner
Copy Link

Overview

Implement super admin role differentiation in the web admin panel. Currently the admin panel treats all logged-in users equally. We need:

Requirements

  1. Role-based access in admin panel: Distinguish between admin and super_admin roles in the web panel
  2. Super admin middleware for web routes: Add requireSuperAuth middleware for sensitive routes (seed phrase viewing, commission management)
  3. Session role tracking: Store role in the auth token payload (admin vs super_admin)
  4. Visual role indicator: Show role badge in the admin panel header/sidebar
  5. Super admin exclusive menu items: Seed Viewer, Commission Dashboard only visible to super admins

Acceptance Criteria

  • Auth token includes role field
  • requireSuperAuth middleware blocks non-super-admin users
  • Sidebar shows role badge next to username
  • Super admin-only menu items are hidden for regular admins
  • All existing admin functionality still works for both roles

Technical Notes

  • Current auth: src/admin/auth.js uses ADMIN_SECRET env var
  • Current role check: src/middleware/auth.js has isSuperAdmin() for Telegram
  • Need to extend web auth to check SUPER_ADMIN_IDS against telegram_id or a new admin_users table
  • Consider adding admin_users table with role field for web panel access control
## Overview Implement super admin role differentiation in the web admin panel. Currently the admin panel treats all logged-in users equally. We need: ## Requirements 1. **Role-based access in admin panel**: Distinguish between admin and super_admin roles in the web panel 2. **Super admin middleware for web routes**: Add requireSuperAuth middleware for sensitive routes (seed phrase viewing, commission management) 3. **Session role tracking**: Store role in the auth token payload (admin vs super_admin) 4. **Visual role indicator**: Show role badge in the admin panel header/sidebar 5. **Super admin exclusive menu items**: Seed Viewer, Commission Dashboard only visible to super admins ## Acceptance Criteria - [ ] Auth token includes role field - [ ] requireSuperAuth middleware blocks non-super-admin users - [ ] Sidebar shows role badge next to username - [ ] Super admin-only menu items are hidden for regular admins - [ ] All existing admin functionality still works for both roles ## Technical Notes - Current auth: src/admin/auth.js uses ADMIN_SECRET env var - Current role check: src/middleware/auth.js has isSuperAdmin() for Telegram - Need to extend web auth to check SUPER_ADMIN_IDS against telegram_id or a new admin_users table - Consider adding admin_users table with role field for web panel access control
NW added this to the Super Admin Panel & Product Evolution milestone 2026-07-09 14:23:10 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
phase::1
Phase 1: Security
 phase::1
Phase 1
 phase::1
Phase 1
 phase::2
Phase 2: Architecture
 phase::2
Phase 2
 phase::3
Phase 3: Admin API
 phase::3
Phase 3
 phase::4
Phase 4: Web UI
 phase::4
Phase 4
 phase::5
Phase 5: Quality
 phase::5
Phase 5
 priority::critical
Critical priority
 priority::critical
Critical priority
 priority::high
High priority
 priority::high
High priority
 priority::medium
Medium priority
 priority::medium
Medium priority
 type::bug
Bug fix
 type::bug
Bug
 type::feature
New feature
 type::feature
Feature
 type::infra
Infrastructure
 type::infra
Infrastructure
 type::refactor
Code refactoring
 type::refactor
Refactoring
 type::security
Security issue
 type::security
Security
 type::testing
Testing
 type::testing
Testing
No Label
Milestone
No items
No Milestone Super Admin Panel & Product Evolution
Projects
Clear projects
No project
Assignees
Clear assignees
NW
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Telegram-Market/telegram-shop#124
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?