#Route structure
Phase 8 latest (2026-10-14): Step 0 pushed (2899bd1); 8.5 Connect an existing OSS panel + server list/view built and pushed (Pair 2 API62–64, up to 5be6dec; response field system_info (was facts); tested live on an OSS test server; API address (https://api.…) + token only — panel web address refused with oss_not_a_panel). Next: 8.4 → 8.1 → 8.3. Connect a panel.
No language in the address (Bhavik, 2026-10-05): paths are the same in every language (/dashboard, never /en/dashboard), like the OSS panel. The chosen language is kept in a cookie (and the user profile once it has a language field); first visit uses the browser language if supported, else English. Languages: en, es, de, fr, pt, ja, ru, hi. No routes exist yet: frontend-2 only has the scaffold app/page.js. Missing
#Public routes — (auth) group
| Route | Page |
|---|---|
/login | Login (+ 2FA step, IP-approval notice) |
/register | Register (?invite=<token>, ?ref=, ?aff=) |
/verify-email | "Check your inbox" + resend |
/verify-email/{id}/{hash} | Verification result — corrected 2026-10-09 from /verify/:token; two parameters, a signed-URL shape |
/forgot-password | Request reset |
/reset-password | Set new password — corrected 2026-10-09: no path parameter, the token arrives in the query string |
/invitations/:token | Accept invitation (set password / join) |
/approve-ip | IP approved / expired — corrected 2026-10-09 from /ip-approval/:key; no parameter |
/auth/social/{provider}/callback | Social login landing — corrected 2026-10-09 from /oauth/:provider/callback |
/confirm-email-change | Email-change result — new 2026-10-09, asked for by name in the backend's API reference. The token arrives in the query string (?token=…) and the call is made without a login, because the link may be opened on a different device from the one that asked for the change |
/ | Redirect to /dashboard (or login) |
#Protected routes — (app) group (logged in)
| Route | Page | Permission |
|---|---|---|
/organizations/new | Create first/next organization | logged in |
/dashboard | Dashboard | org member |
/organizations | My organizations | logged in |
/organizations/:id/settings | Organization settings | Organization manage |
/account/profile | Profile | logged in |
/account/security | Password, 2FA, IP whitelist, sessions, login history | logged in |
/account/notifications | Channels + email preferences | logged in |
/account/api | API access | logged in |
/notifications | All notifications | logged in |
#Permission-protected routes (current organization)
| Route | Page | Permission |
|---|---|---|
/servers | Server list | Servers view |
/servers/new | Add server (connect / create) | Servers manage |
/servers/:id | Overview | Servers view + OSS dashboard |
/servers/:id/applications (/:appId/...) | Applications | application |
/servers/:id/databases | Databases | database |
/servers/:id/system-users | System users | system_user |
/servers/:id/services | Services | service |
/servers/:id/{firewall,cron-jobs,backups,php,node,fail2ban,logs,disk-cleaner,settings,activity} | Later sections | matching OSS permission |
/providers | Provider accounts | Providers view |
/blueprints · /new · /:id | Blueprints | Blueprints view/manage |
/members | Members + invitations | Members view |
/roles · /:id | Roles | Roles view |
/plans | Plans | Plans view |
/billing/plan | Choose a plan — the required step right after sign-up (Bhavik, 2026-10-09; replaces the removed trial). Empty state when the admin has created no plans | Signed in; no plan yet |
/subscription | Subscription | Subscription view |
/billing · /wallet · /transactions · /invoices · /payment-methods · /auto-recharge · /settings | Billing | Billing view |
/billing/return | Payment return → verification | Billing view |
/audit-log | Audit log | Audit view |
Organization: the current organization is not in the page URL (it comes from the cookie + switcher), but it is in every API path. Alternative: /o/:orgSlug/... page URLs (shareable links). D-18.
#Per-group files
Each route group has loading.js, error.js, not-found.js. Detail segments (servers/[id]) have their own not-found and an "unreachable" state.
#Map
B17.1 /admin readiness: proposed guarded administrator entry/own identity only, using normal login; Pair1 discovery/identity APIs built. Dashboard/sidebar/business routes remain specifications, not built access promises. Discovery true cannot authorize every admin route; verified/current administrator required on entry.
Removed 2026-10-16 (Pair 1): GET /account/admin-access and GET /admin/me no longer exist. Admin entry = role / is_administrator from the login/profile response + the filtered sidebar GET /admin/menu (API59). The admin's role and permissions now come with /admin/menu (admin_role, permissions — added 2026-10-16 05:22).
B17.11 revised (2026-10-16, Pair1): no separate admin Organizations screen — admins open a user's organization under Users → user → Organizations (API69), which gets tabs members, servers, charges, deleted servers (with restore), subscription, backups (users.organizations.*, view/manage; only members can be built now, the rest wait for Phases 7–8). Catalog back to 59 permissions, 33 sidebar screens. ⚠ Deleted servers + restore conflicts with Bhavik's 'not in V8' rule (D-63).
Latest B17.3 (Pair1): GET /api/v1/admin/menu built, active verified administrator; role-filtered translated group/title/Lucide/localURL/order/parent, no role→empty. 59 permissions, 34 sidebar screens at that time — now 53 permissions / 33 sidebar screens after B17.11 (2026-10-16); tabs/actions no URLs. Queue-size page/permission removed, Horizon instead. B17.4+ business/viewer unbuilt; menu≠working destination, Pair2 availability unconfirmed. Menu states.
B17.4 latest: Pair1 admin Activity log API60 GET /api/v1/admin/activity BUILT; active verified administrator+admin-activity view, private/no-store. Table/filters/pagination/snapshot targets read-only, separate admin feed; account/org feed unaffected. B17.5+ still unbuilt,Pair2unconfirmed. Activity screen.
B17.6 latest (2026-10-12): Pair1 admin Users API61–68 BUILT — list/counts/view/create/ban/unban/verify/delete, deleted users, referred users; statuses active/pending/banned (no locked); admins can't ban/delete themselves or other administrators. Users are now soft deleted (also self-delete B3.7) — the email can still sign up again, nothing changes on screen. B17.5 and B17.7+ still unbuilt, Pair2 unconfirmed. Users screens.
B17.7 latest (2026-10-12): Pair1 admin User details API69–76 BUILT — organizations, login history, account activity, 2FA status/turn off (backup codes counted only), IP whitelist view/turn off/remove IP; new users.activity view permission (60 admin permissions); servers tab waits for Phase 8. Admin changes show in the user's activity as by a ServerAvatar admin. B17.5 and B17.8+ still unbuilt. User details.
B17.10 latest (2026-10-14): Pair1 Login as user API77 BUILT — users.login-as manage only; normal user login without password/2FA/IP whitelist; refused for own account/administrators/banned users; recorded only in admin activity. Login as user.
B17.15 latest (2026-10-14): Pair1 admin Promo codes API78–81 BUILT — list/create/on-off/delete (soft, name stays taken, history kept); no edit after creation; cohort renamed customer_type (all/new/existing). Promo codes.
B17.17 latest (2026-10-16): Pair1 admin Site settings API93–97 BUILT — basic details (branding, uploads, custom header/footer, links) + company billing details (tax % = checkout tax); public GET /site-settings before login. D-64 open (custom code). Site settings.
B17.12 Part 1 (2026-10-17): Pair1 admin Servers API114–119 BUILT — list/view/edit (name, hostname, IP) + user/organization Servers and Deleted servers tabs; live parts later. Servers are now soft deleted (hidden from users). Deleted list = D-63 conflict. Admin servers.
B17.19 (2026-10-17): Pair1 admin General settings API103–113 BUILT — display message (banner for every user via API97 display_message), trial mode on/off (not used — V8 has no trial, D-56), referral program settings, Slack webhook for admin alerts. User settings / temporary domain / support email removed (57 permissions, 31 screens). General settings.
B17.23 (2026-10-16): Pair1 admin Error monitor API99–101 BUILT — list/view/resolve unhandled request/job/command errors (secrets removed, kept 2 days, reopen on repeat). Error monitor.
B17.6 edit (2026-10-16): Pair1 admin Edit a user API98 BUILT — profile, email (no confirmation), password, role, admin role, status for any account incl. administrators; lockout guard. Edit a user.
B17.20 Part 1 latest (2026-10-14): Pair1 admin Integration keys API82–88 BUILT — social login (GitHub/Google), Turnstile, payment gateways (Stripe/PayPal/Instamojo, test/live keys, webhook URLs); secrets write-only. SMTP + test mail (Part 2) next. Integration keys.
B17.20 Part 2 (2026-10-15): Pair1 admin SMTP + test email API89–92 BUILT (saved vs server-default settings, write-only password, test email with short failure reason, reset to defaults). Integration keys complete except cloud platforms (to confirm). SMTP.