# Administration

Current platform authority protects User management, audits, flags and diagnostics.

## What an Admin can do [#what-an-admin-can-do]

The admin area manages Users, bans, roles, Sessions and passwords, and reads the Audit Log. It also manages feature flags and app-update configuration and exposes diagnostics. The platform User role is distinct from an Org role.

Navigation uses the observed Session for presentation. Server operations use `adminProcedure` or `adminWriteProcedure` and re-read current authority. A stale sidebar, a demotion or an impersonation cannot preserve old admin permissions.

## Audited changes [#audited-changes]

The admin capability dispatches Better Auth operations inside the existing transaction and audit coordination. Keep those mutations behind that capability instead of writing auth tables directly. Per-User timelines and the global Audit Log expose different authorized views of the same security history.

Impersonation runs with the target User's exact permissions. An admin impersonating a non-admin loses admin access until stopping impersonation. Never recover authority from the `impersonatedBy` field.

## Extend [#extend]

Add a schema, server operation and localized hook/view. Test unauthenticated access, ordinary Users, a revoked/demoted Admin and impersonation. Destructive actions use the existing dialog patterns rather than `window.confirm`. Diagnostics must return safe status and never echo credentials.


## Key files [#key-files]

- [`packages/api/src/routers/admin.ts`](https://github.com/CarlosZiegler/doro/blob/main/packages/api/src/routers/admin.ts)
- [`packages/api/src/lib/admin-api.ts`](https://github.com/CarlosZiegler/doro/blob/main/packages/api/src/lib/admin-api.ts)
- [`packages/auth/src/admin-audit.ts`](https://github.com/CarlosZiegler/doro/blob/main/packages/auth/src/admin-audit.ts)
- [`packages/api/src/routers/audit.ts`](https://github.com/CarlosZiegler/doro/blob/main/packages/api/src/routers/audit.ts)
- [`apps/web/src/hooks/use-app-nav.ts`](https://github.com/CarlosZiegler/doro/blob/main/apps/web/src/hooks/use-app-nav.ts)