ADMIN_GUIDE.md

Admin User Guide

Overview

Admin users have a special role in the system that will be used for developer/administrative tasks. Currently, admin users have:

• Special "Admin" badge on their profile
• role: 'admin' in the database
• Foundation for future admin-only features

Creating Admin Users

Option 1: Using the Script (Recommended)

1. Edit backend/scripts/createAdminUser.js and configure the admin user details:

   const adminData = {
     firstName: 'Your',
     lastName: 'Name',
     email: 'your-email@virginia.edu',
     password: 'your-secure-password',
     // ... rest of config
   };

2. Run the script:

   cd backend
   node scripts/createAdminUser.js

Option 2: Manually in Firestore

1. Go to Firebase Console → Firestore Database
2. Navigate to the users collection
3. Find your existing user document (or create a new one)
4. Update the role field to admin

Option 3: Temporarily Modify Signup

1. In frontend/app/(tabs)/signup.jsx, change line 53:

   // Change from:
   const result = await signup(firstName, lastName, email, password, 'member');
   
   // To:
   const result = await signup(firstName, lastName, email, password, 'admin');

2. Sign up through the app
3. Important: Change it back to 'member' afterwards!

Admin Features (Future)

Admin users will have access to:

• User management dashboard
• CIO approval/moderation
• Event moderation
• System analytics
• Content moderation
• Support ticket management
• System settings

Checking Admin Status

In Backend

// In any route with verifyToken middleware
const userDoc = await firestore.collection('users').doc(req.userId).get();
const isAdmin = userDoc.data().role === 'admin';

if (!isAdmin) {
  return res.status(403).json({ error: 'Admin access required' });
}

In Frontend

// In any component with AuthContext
const { user } = useAuth();
const isAdmin = user?.role === 'admin';

{isAdmin && (
  <AdminOnlyFeature />
)}

Security Notes

1. Never hardcode admin credentials in the frontend code
2. Admin accounts should use strong passwords
3. Limit admin accounts to trusted developers only
4. Consider adding 2FA for admin accounts in production
5. Log all admin actions for audit trails

Current Allowed Roles

• member - Regular users
• cio_exec - CIO executives
• admin - System administrators (developers)