Loading…
/system is platform administration: the user-management console where
super-admins search, inspect, edit roles, link accounts to
Family records, and purge unauthorised accounts. There is
no /system landing UI —
page.tsx
runs requirePermission("org:sys:manage") and immediately redirects to
/system/users. (The old mocked "System Status" page was consolidated into
Observability; /system no longer serves it.)
| Route | Purpose | Guard |
|---|---|---|
/system | Redirect stub → /system/users | org:sys:manage (page.tsx) |
/system/users | User console — search, pagination, role edit, link-family, purge | org:sys:manage (inherited from /system gate) |
The console renders role labels, hierarchy, and protected-role Badges from
lib/auth/rbac-shared.ts (ROLE_LABELS, ROLE_PERMISSIONS,
PROTECTED_ROLES, ROLE_HIERARCHY) and admin-editable fields from
ADMIN_PROFILE_FIELDS (lib/types/user-profile.ts).
| Method | Path | Guard | Purpose |
|---|---|---|---|
GET / POST | /api/admin/users | checkRole("org:sys:manage") | List / provision users |
GET / PATCH / DELETE | /api/admin/users/[id] | Same | Read / update / remove one user |
POST | /api/admin/users/[id]/link-family | Same | Attach a Family member record |
POST | /api/admin/users/purge-unauthorized | Same | Remove unauthorised accounts |
The console also reads /api/admin/family for the link-family picker.
org:sys:manage permission and role hierarchy