Admin pane: richer authenticated tables for cm50_app (directory, full programme) #44

New issue

Open

opened 2026-06-24 15:44:50 +00:00 by casper-stevens · 0 comments

casper-stevens commented

2026-06-24 15:44:50 +00:00

Member

Follow-up to #3.

The cm50_app admin pane (in hero_components, ?service=cm50_app) currently round-trips only public, no-arg methods — the Programme tab uses news_pinned, and the default Docs/Playground tabs enumerate every method across all five domains. That satisfies #3's done-criteria.

But the genuinely useful admin tables can't be shown yet:

CRUD *_list* methods are deliberately disabled server-side (return forbidden).
The rich reads (participants_snapshot, program_snapshot, community_snapshot) require a session token the generic no-arg <Table> markup can't supply.

To surface the participant directory / full programme, pick one:

Session-aware table widget — extend the hero_components markup so a <Table> can attach an admin session token.
Unauthenticated admin-only read method on cm50_app (gated by the admin socket/claims) returning snapshot data.

Tier: P2.

Follow-up to #3. The cm50_app admin pane (in `hero_components`, `?service=cm50_app`) currently round-trips only **public, no-arg** methods — the Programme tab uses `news_pinned`, and the default Docs/Playground tabs enumerate every method across all five domains. That satisfies #3's done-criteria. But the genuinely useful admin tables can't be shown yet: - CRUD `*_list*` methods are deliberately **disabled** server-side (return `forbidden`). - The rich reads (`participants_snapshot`, `program_snapshot`, `community_snapshot`) require a **session token** the generic no-arg `<Table>` markup can't supply. To surface the participant directory / full programme, pick one: 1. **Session-aware table widget** — extend the hero_components markup so a `<Table>` can attach an admin session token. 2. **Unauthenticated admin-only read method** on cm50_app (gated by the admin socket/claims) returning snapshot data. Tier: **P2**.