Build admin layout and access control

Stand up the admin shell and lock it down before adding data.

First time here? Paste the Context Pack first so the AI understands your project - open it from the header above.

Prompt Capsule

Create the admin dashboard layout and protect it. Requirements: an /admin route with sidebar or tab navigation for each managed entity; access restricted to admin users (route guard AND backend enforcement on every admin endpoint - non-admins get 403); a visible 'access denied' experience for non-admins; loading skeletons for the shell. State how a user becomes admin in this app (flag on the user record) and create one admin account for testing.

Paste into EmergentFull Build: complete implementation prompt with explicit requirements

Quick is short. Full Build is recommended for most steps. Strict forces real logic when the AI keeps faking output.

Actual change check

Expected after this step

A protected /admin area with navigation and a working admin test account.

Should NOT happen

An existing feature broke
A button only logs to console
Data disappears after refresh
Errors fail silently with no visible state

This is what should exist before you continue. If reality does not match, do not move on.

Your notes for this step

Track what changed, failed, or needs follow-up. Notes export with the flow.

Pass the Verify Gate to complete this step

Verify before continuing

Do not move on until every check is true. The complete button stays locked until then.

Non-admin users cannot open /adminAdmin API endpoints reject non-admins with 403A test admin account exists and works

Do not continue if…

! Stats cards showing hardcoded numbers
! Tables rendering static arrays instead of database queries
! Delete/disable that only removes the row from local state
! Admin routes reachable by any logged-in user

If the AI messes this up

Use this when:

- it only made visual forms or placeholder UI
- buttons do nothing or only log to console
- data is not persisted - state disappears on refresh
- something that worked before is now broken

Use this when the AI fakes progress or breaks the feature. It forces a real fix.

Admin routes are open to any user. Add a real admin check on the route guard and on every admin endpoint - hiding the link is not access control.