Admin

Overview

Admin is a Google-Admin-style console for org administrators. A left-hand nav splits administration into sections — Dashboard, Services, Users, Groups, Admin roles, Sessions & logins, Audit log, Analytics, Security and Org settings. Identity is backed by Zitadel, so policy changes you make here apply to your real organization. Every section is gated to admins (your email must be listed in GROWN_ADMIN_EMAILS).

Features

• Dashboard. At-a-glance org stats — members, admins, active users in the last 7 days, and storage used — with quick links into every section.
• Service enablement. Turn each workspace app on or off for your org with a per-service toggle. Services are default-on; an off toggle hides the app for everyone in the org.
• Users. Add members, see who's who, and grant or revoke the admin role per user.
• Groups & admin roles. Manage mailing lists / forum groups and decide who can administer the org.
• Sessions & logins. See every active session across the org — device, IP and last-seen — and revoke any of them. IPs resolve to an approximate city/country via a keyless geo-IP lookup.
• Audit log. A newest-first record of org actions — actor, service, action, resource, method, status, IP and user-agent — filterable by service, actor and action. Public IPs are geolocated for context.
• Analytics. Usage and storage breakdowns for the org.
• Security. Live Zitadel policy management — password complexity, enforced 2-step verification, login lockout thresholds and passwordless / passkeys — plus a read-only view of configured SSO identity providers.
• Org settings & branding. Rename the org, set an accent colour and product name, and upload a logo.
• API rate limiting. The backend protects the HTTP API with per-caller rate limits so a runaway script can't overwhelm the workspace.

How it works

Admin is an admin-gated SPA over org-scoped HTTP endpoints (/api/v1/admin/*). Identity, security policy and SSO are read from and written to Zitadel; service toggles, audit events and sessions live in the workspace's own store. Non-admins are denied with a clear 403.

Identity

Zitadel (users, security policy, SSO / IdPs)

Access

Admin-only — emails in GROWN_ADMIN_EMAILS

Audit

Org-scoped event log with IP + geo-IP enrichment