Custom Backend Admin Dashboard Framework

ROLE: Full-stack developer building a secure admin dashboard INPUT: {project_name}, {admin_email}, {admin_password_hash} DATABASE: Use ONLY src/server/lib/admin-db.ts for all database operations. Do NOT modify or reference any other database connection in this project. PROCESS: 1. Scaffold a /admin/login page with Email and Password fields 2. On submit, POST credentials to /api/auth/admin/login 3. Server validates against the admin database (admin-db.ts), issues a signed session cookie (httpOnly, sameSite: strict) 4. All /admin/* routes check for valid session — redirect to /admin/login if missing 5. Logout route at POST /api/auth/admin/logout clears the session cookie CONSOLE LOGGING — add to every API route and middleware: - console.log('[admin-auth] Login attempt:', { email, timestamp: new Date().toISOString() }) - console.log('[admin-auth] DB query result:', { found: !!user, timestamp }) - console.log('[admin-auth] Session created:', { sessionId, email }) - console.error('[admin-auth] ERROR:', error.message, error.stack) - console.log('[admin-middleware] Route check:', { path: req.path, hasSession: !!req.session?.adminId }) CONSTRAINTS: - Never store plaintext passwords — use bcryptjs with salt rounds >= 12 - Session secret must come from environment variable SESSION_SECRET - Login errors must return generic "Invalid credentials" — never reveal which field failed OUTPUT: Login page component, auth middleware, login/logout API routes, session setup

ROLE: Component-aware CMS architect INPUT: {site_url_or_codebase_path} DATABASE: Use ONLY src/server/lib/admin-db.ts for all database operations. Do NOT modify or reference any other database connection in this project. PROCESS: 1. Scan src/pages/ and src/layouts/ — enumerate every page route 2. For each page, identify every visual component in render order: navbar → hero → [section_2] → [section_3] → ... → footer 3. For each component, record: - component_name (e.g. "HeroSection") - file_path (e.g. "src/components/HeroSection.tsx") - editable_fields: text fields, image slots, CTA labels - image_slots: array of { slot_id, current_src, dimensions } 4. Output a structured JSON component_map and persist it to the admin database (admin-db.ts) CONSOLE LOGGING — add to every API route: - console.log('[component-scanner] Scanning page:', { route, timestamp: new Date().toISOString() }) - console.log('[component-scanner] Components found:', { route, count: components.length }) - console.log('[component-scanner] Saved to admin-db:', { pages: pageCount, totalComponents }) - console.error('[component-scanner] ERROR:', error.message, error.stack) QUALITY_GATE: - Every page must have at least navbar and footer mapped - No component may have an undefined image_slot if it renders an <img> OUTPUT_SCHEMA: { "pages": [ { "route": "/", "components": [ { "name": string, "file": string, "editableFields": string[], "imageSlots": { "id": string, "currentSrc": string, "width": number, "height": number }[] } ] } ] }

ROLE: Booking system architect INPUT: {service_types[]}, {admin_timezone}, {slot_duration_minutes}, {stripe_price_id} DATABASE: Use ONLY src/server/lib/admin-db.ts for all database operations. Do NOT modify or reference any other database connection in this project. PROCESS: MODULE: AvailabilityManager - Admin UI: weekly calendar grid, click to toggle slots open/closed - POST /api/admin/availability — save slot configuration to admin-db.ts - GET /api/availability?date={date} — return open slots for client calendar MODULE: ClientBookingFlow - Frontend: date picker → available time slots → service selection → Stripe checkout - POST /api/bookings/create-checkout — create Stripe session with slot metadata - POST /api/bookings/confirm (webhook) — mark slot booked in admin-db.ts, send confirmation email MODULE: AdminBookingView - Table of upcoming bookings: client name, service, time, status - Cancel/reschedule actions with automatic client notification email CONSOLE LOGGING — add to every API route and webhook: - console.log('[availability] Slot query:', { date, slotsFound: slots.length }) - console.log('[booking] Checkout session created:', { sessionId, slotId, service }) - console.log('[booking] Webhook received:', { type: event.type, sessionId }) - console.log('[booking] Slot confirmed in admin-db:', { bookingId, slotId }) - console.error('[booking] ERROR:', error.message, error.stack) CONSTRAINTS: - Booked slots must be locked immediately on checkout session creation (not on payment) - Expired unpaid sessions must release the slot after 15 minutes - All times stored in UTC, displayed in admin_timezone OUTPUT: Availability API, booking API, client calendar component, admin booking table, Stripe webhook handler