Admin Console

Routes under app/admin/*. All gated by the persisted app role users.role = 'admin'.

Surfaces

Route	Capability	Status
/admin/users	List + filter (kind, role, KYC, blocked, email search), pagination	🟢
/admin/users/[id]	Detail; KYC override; per-merchant fee rates; feature flags (orders / payouts / invoices); block / unblock	🟢
/admin/transactions	List + filter (type, status, asset, date, actor email); pagination 50/page; per-asset totals footer	🟢
/admin/fees	Edit global platform_fees knobs (send fee, buy-external rate, payout recipient cap); audit log on every save	🟢
/admin/emails + /admin/emails/[id]	View outbound mock_emails (filterable by kind)	🟢
/admin/ledger	Ledger-entry inspection	🟢
/admin/invoices	Invoice oversight	🟢
/admin/orders	API-order oversight	🟢
/admin/payouts + /admin/payouts/[id]	Payout batch + row oversight	🟢
/admin/reconciliation	Reconciliation runs, drift per asset, outbound-halt clear	🟢
/admin/jobs	pg-boss queue visibility	🟢
/admin/logs	Investigation log review, with redaction (lib/v2/admin/logs/redact.ts) and export (export.ts)	🟢
/admin/history	Cross-surface activity history	🟢
/admin/pages + /new + /[id]/edit	CMS page authoring (cms_pages)	🟢
/admin/faq + /new + /[id]/edit	FAQ authoring (faq_articles)	🟢
/admin	Admin landing	🟢

Operator-facing safety rails

• Admins cannot impersonate blocked accounts.
• Admins cannot block other admins from the console.
• Fee-rate changes write to audit_log with the previous + next value.
• Fee edits reject non-numeric / negative input (error=invalid).
• audit_log is append-only at the database level (0012_audit_log_append_only) — admins cannot rewrite history.
• Wallet slug rotation is admin-only and audited with the acting admin's id.

Planned

Surfaces specified in the PRD/refactor brief but not yet shipped. Privileged-action requirements + audit metadata expectations live in 14-Operations#Privileged actions.

Route (planned)	Capability	Notes
/admin/wallets	Omnibus / platform wallet visibility, balances, value, privileged Send	No page exists. adminWalletsRouter today only rotates a wallet's public_slug. See Glossary#Omnibus.
Policy versioning on /admin/pages	Version-aware consent popup on next login	Page authoring shipped; the version bump → consent popup half did not.
/admin/users/[id] role-split grants	Role-split admin grants	Feature flags + per-merchant rates shipped; role split still tracked at 09-Open Questions#Admin role split.
Admin-side subaccount review	View merchant subaccounts, audit invitations, freeze if needed	Blocked on 03-Domains#Subaccounts, which is not built.
Refund / reverse affordance	Reverse a bad payout or order settlement without manual SQL	09-Open Questions#Admin gaps.
Bulk export beyond logs	CSV/JSON export across /admin/transactions, /admin/users	/admin/logs has export; the other tables do not. Invoices export separately via /api/invoices/export.
Notification preferences view	Per-user opt-in/opt-out toggles (transactional, policy, marketing)	notifications delivery shipped; preferences did not.

Shipped since this page was last accurate

/admin/ledger, /admin/invoices, /admin/orders, /admin/payouts, /admin/reconciliation, /admin/jobs, /admin/logs, /admin/history, /admin/pages, /admin/faq — all previously listed as planned or missing.

Missing capabilities (today)

• No bulk CSV export of /admin/transactions or /admin/users (logs and invoices do export).
• No "refund" or "reverse" affordance for bad payouts; manual SQL only.
• No notification-preferences view per user.
• No omnibus Wallets surface.
• No policy-version consent flow (page authoring only).
• No undo on KYC override or fee-rate change.
• See 09-Open Questions#Admin gaps.

Drawbacks

• See 08-Risks and Drawbacks#Admin.