Admin behavior
Documented against app commit ed7d6935. The same text lives in docs/agent/admin.md in the app repo.
Administration
Section titled “Administration”Users, companies, and which modules a role can open. The active company and year switches are docs/agent/shell.md. This module is where those companies and the rights are stored.
Middleware: auth.check, then module:user, module:company, or module:roleaccess. Role id 1 sees the whole Administrator menu.
Screens
Section titled “Screens”| Path | View | What it is |
|---|---|---|
GET /admin/users | resources/views/pages/users/index.blade.php | Users. Add, edit, password, and company attach are modals. |
GET /admin/companies | resources/views/pages/accounts/index.blade.php | Companies. Add, edit, currency, and user attach are modals. IMAP test and Gmail connect are actions on this page. |
GET /admin/roleaccesses | resources/views/pages/roleaccess/index.blade.php | Role by module matrix. |
GET /admin/companies/gmail/callback is not a page. It is the Google redirect. It sits outside auth.check so Google can return, and GmailOAuthController@callback sends the browser back to login if the session token is missing.
Off-screen
Section titled “Off-screen”Users: POST /admin/users creates a user. POST /admin/users/{id} updates it. POST /admin/users/password/{id} sets the password. POST /admin/users/attach/{id} attaches a company. GET /admin/users/delete/{id} deletes the user. None of these write bogføringer.
Companies: POST /admin/companies and POST /admin/companies/{id} store the company, including the currency the posting conversion compares against. POST /admin/companies/attach/{id} and GET /admin/companies/detach/{userId}/{id} maintain account_user. GET /admin/companies/delete/{id} deletes the company. Deleting a company does not by itself delete its bogføringer. Check account_id foreign keys before assuming cascade.
POST /admin/companies/imap/test (AccountController@testImap) opens the mailbox and returns success or the error. It does not download invoices. GET /admin/companies/gmail/connect starts OAuth. POST /admin/companies/gmail/disconnect/{id} drops the stored token. The fetch that uses those settings is the button on faktura-scan (docs/agent/faktura-scan.md). imap:fetch-invoices is commented out of the scheduler and does not run.
POST /admin/roleaccesses (RoleAccessController@save) stores which module slugs a role has. The slugs are the module: middleware values and the session('access') list the navbar reads. fiapprover is what gates faktura-indbakke status and batch approve. Removing bogforing hides the daybook, the inbox, the scan pages, salg, and bank import together, because those routes share module:bogforing.
A new module needs a slug in ModuleSeeder, a module: middleware on its routes, a navbar check, and a column on this matrix. Adding only the route will hide it from every role except id 1.