# Admin Operations — ALGA ARENA Esports Platform

**Date:** 2026-07-20

## Access

**URL prefix:** `/admin`  
**Middleware:** `auth`, `verified`, `active`, `admin`  
**Layout:** `resources/views/layouts/admin.blade.php`

Non-admin users receive HTTP 403 from `EnsureAdmin` middleware.

---

## Dashboard

**Route:** `GET /admin` → `Admin\DashboardController@index`

Summary metrics (pending registrations, payment proofs, moderation queue counts).

---

## User Management

**Controller:** `Admin\UserController`

| Route | Action |
|-------|--------|
| GET `/admin/users` | List/search users |
| GET `/admin/users/{user}` | User detail + registrations |
| POST `/admin/users/{user}/suspend` | Set status suspended |
| POST `/admin/users/{user}/reactivate` | Set status active |

**Policy:** `UserPolicy@suspend` (admin, not self)  
**Audit:** `user.suspended`, `user.reactivated`

Suspended users logged out via `EnsureUserIsActive`.

---

## Player Profiles

**Route:** `GET /admin/player-profiles`  
**Controller:** `Admin\PlayerProfileController@index`

Read-only listing — no direct profile editing in admin.

---

## Games Catalog

**Resource:** `/admin/games` (except show)  
**Controller:** `Admin\GameController`

CRUD for games and nested catalog configuration. Uses `games` disk for assets.

---

## Events

**Controller:** `Admin\EventController`

| Route | Purpose |
|-------|---------|
| GET `/admin/events` | List/filter events |
| GET/POST `/admin/events/create` | Create draft |
| GET/PUT `/admin/events/{event}/edit` | Update |
| POST `/admin/events/{event}/publish` | Open registration |
| POST `/admin/events/{event}/cancel` | Cancel event |

---

## Event Registrations

**Controller:** `Admin\EventRegistrationController`

| Route | Action class |
|-------|--------------|
| GET `.../registrations` | List with status filter |
| POST `.../approve` | `ApproveRegistrationAction` |
| POST `.../reject` | `RejectRegistrationAction` |
| POST `.../promote` | `PromoteWaitlistAction` |
| GET `.../export` | CSV export (gate: `export-participants`) |

---

## Manual Payment Methods

**Resource:** `/admin/payment-methods` (except show)  
**Controller:** `Admin\ManualPaymentMethodController`

Manage global offline payment channels assigned to events.

---

## Payment Proof Review

**Controller:** `Admin\PaymentProofReviewController`

| Route | Action |
|-------|--------|
| GET `/admin/payment-proofs` | Pending proof queue |
| POST `/admin/payment-proofs/{proof}/confirm` | `ConfirmPaymentAction` |
| POST `/admin/payment-proofs/{proof}/reject` | `RejectPaymentAction` |

---

## Content Moderation

**Controller:** `Admin\ModerationController`

| Route | Purpose |
|-------|---------|
| GET `/admin/moderation` | Pending records + videos tabs |
| POST `/admin/moderation/records/{record}` | Approve/reject/hide record |
| POST `/admin/moderation/videos/{video}` | Approve/reject/hide video |

**Gates:** `moderate-records`, `moderate-videos`  
**Actions:** `ModerateRecordAction`, `ModerateVideoAction`

**Known issue:** Controller imports `App\Actions\Content\*` namespace which does not exist — should be `App\Actions\Records\` and `App\Actions\Videos\`.

---

## Audit Logs

**Route:** `GET /admin/audit-logs`  
**Controller:** `Admin\AuditLogController@index`  
**Gate:** `view-audit-logs`

Displays `audit_logs` with user, action, subject morph, old/new values.

### Logged actions (non-exhaustive)

| Action key | Trigger |
|------------|---------|
| `event.created` | Event create |
| `event.updated` | Event update |
| `event.published` | Publish |
| `registration.approved` | Approve registration |
| `registration.rejected` | Reject registration |
| `registration.promoted` | Waitlist promote |
| `registration.cancelled` | Cancel |
| `payment.confirmed` | Approve proof |
| `payment.rejected` | Reject proof |
| `record.moderated` | Record moderation |
| `video.moderated` | Video moderation |
| `user.suspended` | Suspend user |
| `user.reactivated` | Reactivate user |

---

## System Settings

**Route:** `GET /admin/settings`  
**Controller:** `Admin\SettingController@index`  
**Gate:** `manage-settings` (**super_admin only**)

Settings stored in `system_settings` table (e.g. `content_auto_approve`).

---

## Admin Route Map

```
/admin
├── / (dashboard)
├── /users
├── /player-profiles
├── /games (resource)
├── /events
│   └── /{event}/registrations
├── /payment-methods (resource)
├── /moderation
├── /payment-proofs
├── /audit-logs
└── /settings
```

All route names prefixed `admin.*` — see `routes/admin.php`.

---

## Role Capabilities Matrix

| Capability | Admin | Super Admin |
|------------|-------|-------------|
| Dashboard | ✓ | ✓ |
| Users | ✓ | ✓ |
| Games | ✓ | ✓ |
| Events | ✓ | ✓ |
| Registrations | ✓ | ✓ |
| Payments | ✓ | ✓ |
| Moderation | ✓ | ✓ |
| Audit logs | ✓ | ✓ |
| System settings | — | ✓ |

---

## Operational Notes

1. **No queue worker required for notifications** — notifications implement `ShouldQueue` but `QUEUE_CONNECTION=sync` in dev/tests.
2. **Export CSV** streams via chunked query — suitable for moderate participant counts.
3. **Destructive ops** — game/event delete uses soft deletes where model supports it; user suspend is reversible.