⚙
Admin ConsoleRoles · Meetings · Friendships · Audit
Dashboard World Hub Meetings Friends Education Admin
Role: user

🔒 Admin / Moderator Login

This console can only be used by accounts with the admin or moderator role. Enter the staff passcode to elevate. Sessions expire after 30 minutes of activity.

First-run default passcode is BITHEREUM007-ADMIN-CHANGE-ME. Rotate it immediately from the Security panel below after logging in.
Scope
🛡 Elevated session active · remaining Auto-logout when expired.

👤 People & Roles

Everyone known to the local app (you + friends + chat partners). Assign roles, override stats, suspend.

NameRoleStats

🛠 Player Override (you)

Edit your local game profile. Useful for testing late-tier features without grinding. Admin only.

🛡 Per-user admin actions

Suspend / reactivate accounts, grant or debit reward balances, and force-unlock the village level path for any known person. Every action is audit-logged. Mirrors the backend permissions (account.suspend, account.reactivate, reward.grant, reward.debit, reward.correct, game.update.any) defined in ROLE_PERMISSION_MATRIX_V1.md.

·
·
Current: ·

📅 All meetings

Edit, cancel, or force-join any meeting regardless of visibility. Admin actions are audit-logged.

TitleHostWhenTypeVisibility👥

👥 Friendships & chat

Inspect friendships, remove abusive ones, view chat logs. Admin only · chat threads contain private content.

Friendships

FriendSince

Pending invites

CodeByUsed by

Chat threads

🔐 Security

Rotate admin passcode

Defense in depth

  • ✓ All user-rendered text is HTML-escaped (no innerHTML of raw input)
  • ✓ Invite codes restricted to [A-Za-z0-9_-]
  • ✓ Names + messages capped (256 / 2000 chars)
  • ✓ Admin passcode stored as SHA-256 digest only
  • ✓ Elevated session timeout: 30 minutes
  • ✓ Audit log of all elevated actions (capped at 500 entries)
  • ✓ CSP meta tag on this console (no inline event handlers)
  • ⚠ Real enforcement requires the server-side backend in BACKEND_API_V1.md · localStorage is NOT a security boundary.

📜 Audit log

Every elevated action is recorded here. Capped at 500 entries.