Admin V2

[KevinMulhern]

Title	Author	Date
Admin V2	Kevin	07/10/2023

Roll our own admin

Summary

We currently use the Active Admin framework for the admin section on the site. It’s allowed us to build a basic admin system fast, but will limit us eventually.

We don’t have a lot of features in our admin system at the moment, but we’ve talked quite a bit about adding more this year. This is the ideal time to move to our own system instead of going deeper into Active Admin.

Motivation

• Admin is mostly CRUD, it will be easy to build and extend our own with vanilla Rails.
• Rolling our own admin future proofs us. We will be able to do whatever we need without compromising and hacking it to work with whatever a library expects.
• The Active Admin DSL expects things to be done a certain way. If we need to go off script and do something remotely different, it can be very difficult and messy when it would have otherwise been easy with vanilla rails.
• Active admin lags behind the latest developments in Rails. It need Sass and jQuery to run and doesn't work very well with the new asset management gems for Rails.
• We’ll be able to reuse frontend components we use on the rest of the site instead of relying on the limited amount of UI components Active Admin provides

Suggested implementation

Scope

• The goal will be to reach feature parity with the existing system.

Approach

• We will put the new system behind an /admin_v2 base route. That will allow us to build the new system in small chunks and keep the legacy system accessible and working until feature parity is reached.
• All new admin related files to be within an admin namespace so there is a clear boundary between the core system and admin.
• Focus on building out the index and details pages for flags until feature complete first. Announcements will be able to reuse most of the same components.

Auth

• Admin accounts will be stored in a new admin_users table instead of using an admin flag on the main users table.
  • To keep things secure, there will be no gateway to create admin accounts outside of the admin system. New admin will be invited via email instead of signing up on a page somewhere.
  • When someone leaves the team - their admin account will be deactivated instead of deleted to ensure data integrity with audit logs.
  • When someone rejoins, it will reactivate their account and send them a password reset email.

Drawbacks

N/A

Alternatives

There are many alternative admin libraries for Rails. But, I don't think we should go down that route. We'd still be tied to how they want things done instead of having the flexibility of our own system.

Additional

Adding 2fa to admin accounts would be a nice follow up to this.

[ManonLef]

Nice plan!