Admin dashboard

PLUR Enterprise ships a server-rendered admin dashboard at /admin. Same design language as plur.ai (Outfit font, dark/light themes, PLUR brand palette). Cookie-based session, CSRF-protected forms, server-side RBAC.

Access

Open https://plur.your-org.com/admin and log in via your configured IdP (OIDC/SAML/GitHub/GitLab). There are no local password accounts. Admin rights come from the ADMIN_USERS env allowlist (or an explicit role in ROLE_USERS).

Surfaces

/admin — Overview

At-a-glance health: users, engram counts by scope, activity, top engrams.

/admin/users

• List users with role, account status.
• View per-user activity.
• GDPR tooling: per-user data export and right-to-be-forgotten flow.

/admin/teams

• Group tree with memberships — read-only, populated by IdP sync (SCIM, GitHub, GitLab).

/admin/engrams

• List engrams by scope, type, status; inspect provenance and visibility.
• Pin / unpin, retire / reactivate, rescope (editor role; audited).
• Triage queue, conflict and dangling-reference views.
• Review policies: per-scope pre-publish review; matching engrams start as drafts pending approval.
• Knowledge packs: define, preview, and export packs from the dashboard.

/admin/audit

• Filter audit rows; export CSV / JSONL for compliance archives.
• See Audit log for the signed-chain model.

/admin/insights

• Activity, quality, people, topics, and ROI views over engram usage.

SSO & provisioning

• /admin/oidc-providers — configure OIDC providers (multiple allowed).
• /admin/saml-providers — configure SAML 2.0 IdPs.
• /admin/scim-tokens — manage SCIM bearer tokens. See SCIM.
• GitHub/GitLab OAuth are configured via env vars; sync can be triggered from /admin/settings.

/admin/settings

• Org metadata, sync triggers, service accounts.

The /me user portal

Distinct from /admin. Every authenticated user gets:

• /me — your engrams, recent activity.
• /me/api-keys — issue and revoke your own API keys.
• /me/webhooks — subscribe your own webhooks; inspect delivery history.

The split is deliberate: /admin is for admins, /me is for everyone. They use the same auth but separate routers (src/admin/router.ts and src/admin/me-router.ts).

RBAC

Three global roles, assigned via env allowlists (ROLE_USERS wins, then ADMIN_USERS → admin, default viewer):

Role	Capabilities
viewer	Read-only across the admin surfaces.
editor	Viewer + engram mutations (retire, pin, rescope, triage) + sync triggers.
admin	Editor + system config (SSO providers, SCIM tokens, service accounts, settings).

Roles are org-global — there is no per-scope role assignment yet. The dashboard enforces these checks server-side via src/admin/rbac.ts; there is no client-side gate.

CSRF

Every state-changing form on /admin and /me carries a CSRF token. Double-submit cookie pattern (src/admin/csrf.ts). Non-form clients send an X-Plur-Csrf header instead.

Server-side rendering

The admin dashboard is server-rendered HTML — not a single-page app. Single Node process, no separate frontend build, strict CSP (nonce-per-response inline scripts only), Outfit font + JetBrains Mono, dark/light toggle.

Code: src/admin/views.ts for the templates, src/admin/queries.ts for the data layer.