Admin overview

What this is

This address takes eligible administrators to the Paid Acquisition Report. There is no separate Admin overview screen. Use the sidebar to open a specific administration area.

Common questions

Why did I land on the Paid Acquisition Report instead of an Admin overview?

The former overview is no longer a screen of its own. Administrators are sent to the primary reporting surface instead.

Where do I manage clients, users, or system settings?

Open the matching item in the Admin section of the sidebar. Clients, Users, Sync Health, Issues, ClickUp Audit, MCP Guide, Spend Guards (when you hold that permission), and System each have their own screen. Parity Check has no sidebar entry and is opened by direct link.

Why can’t I open an admin screen?

Admin screens are limited to eligible administrator roles. If you are sent to the portal or asked to sign in, ask a platform administrator to check your access.

What happened to the older admin links?

Several older links now open the current Clients, ClickUp Audit, or Settings area instead. Management for brands and ad accounts now happens within each client.

Which admin screens are actually available now?

Clients, Users, Sync Health, Issues, ClickUp Audit, MCP Guide, Spend Guards, and System (the settings screen) each have their own sidebar entry. Parity Check is reachable only by direct link. Everything else has moved into one of these.

How to use it

1. Sign in and open the Paid Acquisition Report.
2. Use the Admin section of the sidebar to choose the area you need.
3. Open the related page guide for instructions on that area.

For developers — routes, guards, and internals

• Route: /admin
• Guard: admin-tier only, enforced in src/app/admin/layout.tsx — no session → /login?callbackUrl=/admin, non-admin-tier role → /portal.

No screenshot — the route is a pure redirect. Source review on 2026-08-26 shows /admin redirecting to /marketing; verify the deployed route separately before making a current runtime claim.

Features

• Redirect, not a page. The standalone Admin Overview page was removed; src/app/admin/page.tsx is a one-line redirect('/marketing'). Admins land on the Paid Acquisition Report, and the Admin section of the sidebar (driven by nav.ts) starts at Clients and ends with System.

• The isAdminTier guard. Defined in src/lib/rbac.ts:

  export function isAdminTier(role: Role | null | undefined): boolean {
    return role === 'super_admin' || role === 'admin' || role === 'account_manager';
  }

  This is the gate for the whole /admin/* segment. A stricter platform-admin gate (view_platform_admin: super_admin + admin only, account_manager denied) covers system settings, feature flags, ENV, sync-health and admin-user CRUD inside individual pages/APIs.

• Why the layout is the primary gate. The proxy (src/proxy.ts, Node runtime) authenticates but does no role checks (and its authorized callback matches /admin but not /api/admin/*); this Node-runtime layout, running in the same auth instance that signs the session cookie, is the primary server-side gate for the segment. Every /api/admin/* route additionally calls its own require* guard (e.g. requirePlatformAdmin).

• Safe redirect. Because AdminLayout has already gated the segment, the redirect in page.tsx only ever runs for a user who was allowed in.

• Segment map (source-reviewed redirects). Several /admin/* routes that the original manifest lists as standalone pages are now redirects:

  • /admin → /marketing (this page)
  • /admin/brands and /admin/ad-accounts → /admin/clients (management moved into the per-client Brands / Ad accounts tabs)
  • /admin/ad-bindings → /admin/clickup-audit?tab=links, /admin/ad-binding-requests → ?tab=requests, /admin/review-queue → ?tab=checks
  • /admin/magic-links → /admin/settings?tab=magic-links

  The remaining real pages are Clients, Users, Sync Health, Issues, ClickUp Audit, MCP Guide, Spend Guards, System (settings), and the direct-link Parity Check — each has its own page doc.

Key files

Kind	Path
Redirect page	src/app/admin/page.tsx
Segment guard	src/app/admin/layout.tsx
Role predicate	src/lib/rbac.ts (isAdminTier)
API guards	src/lib/admin-guard.ts (requirePlatformAdmin etc.)
API	none (redirect only)
Nav model	src/lib/nav.ts (Admin sidebar section; Clients, Users, Sync Health, Issues, ClickUp Audit, MCP Guide, Spend Guards, System)
Shell	src/components/admin/AdminSidebarShell.tsx
Auth gate	src/proxy.ts (Next.js 16's renamed middleware.ts, Node runtime) + src/lib/public-paths.ts (authn only; roles gate here)