b434c9b68d
Adds the SvelteKit /admin route tree backed by the admin endpoints landed in PR 1-4. Pages: Overview (alerts + summary cards), Users (list / promote-demote / delete), Mangas (list with sync state + expandable per-chapter state), System (live disk/mem/cpu bars, refreshing every 5s). Security model: the backend's RequireAdmin extractor is the actual boundary. /admin/+layout.ts calls getSystemStats() at load and translates the response — 401 → redirect to /login, 403 → throw SvelteKit error(403) which renders the framework error page. The header's "Admin" link is hidden unless `session.user?.is_admin`, but that's UX only. Carries `is_admin: boolean` through to the frontend User TS type so the header check works and so admin tables can show role per row. Vitest covers lib/api/admin.ts (10 tests: list/delete/PATCH for users, sync-state filter for mangas, nested chapter route, system disk-nullable case). Playwright is intentionally deferred until the routes stabilise — admin UI is operator-only and changes shape often in v0.
32 lines
1.1 KiB
TypeScript
32 lines
1.1 KiB
TypeScript
// /admin gate. The backend's RequireAdmin extractor is the actual
|
|
// security boundary — this load function just calls a tiny admin
|
|
// endpoint and translates the response into either a redirect (no
|
|
// session) or SvelteKit's framework error page (403 forbidden).
|
|
// The session.user?.is_admin check elsewhere is UX only.
|
|
//
|
|
// `ssr=false` because the session store is browser-only (see
|
|
// $lib/session.svelte.ts) — server-side load can't read the cookie
|
|
// anyway in this app's deployment shape.
|
|
|
|
import { error, redirect } from '@sveltejs/kit';
|
|
import { ApiError } from '$lib/api/client';
|
|
import { getSystemStats } from '$lib/api/admin';
|
|
import type { LayoutLoad } from './$types';
|
|
|
|
export const ssr = false;
|
|
|
|
export const load: LayoutLoad = async () => {
|
|
try {
|
|
const stats = await getSystemStats();
|
|
return { stats };
|
|
} catch (e) {
|
|
if (e instanceof ApiError && e.status === 401) {
|
|
throw redirect(302, '/login');
|
|
}
|
|
if (e instanceof ApiError && e.status === 403) {
|
|
throw error(403, 'admin access required');
|
|
}
|
|
throw e;
|
|
}
|
|
};
|