DSH-12 — Back-office administration pages
Users, roles & permissions matrix, activity log, business settings, reference lists, app versions, data imports.
| Field | Details |
|---|---|
| Task code | DSH-12 |
| Phase | P1 — V1 build & integration |
| Product scope | V1 |
| Status | Planned |
| Start | Thu 26 Nov 2026 |
| Due | Sun 29 Nov 2026 |
| Responsible | Anis — Full-stack developer |
| Co-responsible | — |
| Effort | 1.25 person-day(s) planned · 5 from scratch · size S |
| Area · app | Back-office · dashboard |
| Depends on | SRV-27, DSH-01 |
| Unblocks | DQA-04 |
| Milestones | Back-office and reseller web V1 feature-complete |
Summary
Users, roles & permissions matrix, activity log, business settings, reference lists, app versions, data imports.
Description
Administrators manage users, rights, settings and reference data from these pages (cahier §3, §8, §9, §10, §13; ADM-01…ADM-03, ADM-05…ADM-08, AUD-01, AUD-03, SEC-06). This task delivers users with role assignment, deactivation that keeps history and password reset (BO-61), the roles and permissions matrix (BO-62), the activity log with filters, diff view and export (BO-63), business settings grouped by domain (BO-64), reference lists (BO-65), mobile app versions with forced update and maintenance mode (BO-66), data imports for products, resellers, users and stock (BO-67), and support regions with their wilayas, WhatsApp numbers and hours (BO-70). Settings follow the 17 Oct decisions: there is no stock display mode (availability only), orders are never auto-validated, and price display and visibility before validation are settings. Out of scope: notification templates (DSH-10).
Subtasks
| # | Subtask | Owner |
|---|---|---|
| 1 | BO-61 users: list (staff and delegates), create with roles, edit, « Désactiver » keeping history (SEC-06), reset password, sessions with revoke | Anis |
| 2 | BO-62 roles and permissions matrix: modules × actions checkboxes per role, SUPER_ADMIN locked, change summary before save | Anis |
| 3 | BO-63 activity log: filters user, AuditAction, entity, period; before/after diff drawer; export | Anis |
| 4 | BO-64 settings forms by group: commandes (minimum, cancel statuses, assisted hours, return window), stock (reserveOn, deductOn, default thresholds), prix (TTC/HT display, prices before validation), terrain (GPS tolerance, accuracy, sampling, retention), crédit, paiements, livraison, promotions, support | Anis |
| 5 | BO-65 reference lists: the 8 list keys with fr/ar labels, order, active flag | Anis |
| 6 | BO-66 app versions per app and platform: minimum and latest version, force update, maintenance mode and message | Anis |
| 7 | BO-67 data imports: type choice, template download, upload, dry-run report, apply, error rows, history of import jobs | Anis |
| 8 | BO-70 support regions: region list, wilaya assignment (multi-select and map), WhatsApp number E.164, hours, default region, coverage check for unassigned wilayas | Anis |
| 9 | Re-authentication for sensitive actions (permissions, settings, user deactivation) | Anis |
Deliverables
- apps/dashboard/src/app/[locale]/(app)/admin/{users,roles,audit,settings,reference-lists,app-versions,imports,support-regions}/…
- apps/dashboard/src/features/admin/ (permission matrix, settings forms, region editor, import wizard)
Acceptance criteria
- A deactivated user can no longer sign in, and their past actions remain in the activity log (SEC-06, ADM-01)
- Changing a permission in BO-62 takes effect at the user's next request and is logged as PERMISSION_CHANGE (ADM-02, AUD-01)
- Settings forms validate values (e.g. GPS tolerance in metres, positive minimum amount) and every change appears in BO-63 (ADM-03)
- Setting a minimum app version above the installed one makes the mobile app show the forced update screen (ADM-07)
- BO-70 refuses to save while a wilaya is unassigned or assigned to two regions (ADM-08)
- The activity log export contains the filtered rows (AUD-03)
Requirements covered
| Requirement | Title | Release |
|---|---|---|
| ADM-01 | Staff and delegate user management: create, assign roles, deactivate, reset password | V1 |
| ADM-02 | Roles and permissions editor | V1 |
| ADM-03 | Business parameters: order minimums, reservation status, GPS tolerance and frequency, credit policy, stacking, payment methods, delivery fees, return and after-sales windows | V1 |
| ADM-05 | Reference lists: business types, potentials, visit types, not-done reasons, issue tags, ticket types, carriers | V1 |
| ADM-06 | Initial imports: products, resellers, user accounts, stock | V1 |
| ADM-07 | Mobile app versions: minimum and latest version, forced update, maintenance mode | V1 |
| AUD-01 | Activity journal: logins, creations, modifications, validations, exports, deletions with user, time and context | V1 |
| AUD-03 | Audit log viewer with filters and export for authorised users | V1 |
| SEC-06 | Deactivate an account without deleting its history | V1 |
| ADM-08 | Support regions: wilayas grouped into regions, each with its WhatsApp support number and hours | V1 |
Screens
| Screen | Name | App |
|---|---|---|
| BO-61 | Users | BO |
| BO-62 | Roles & permissions matrix | BO |
| BO-63 | Activity log | BO |
| BO-64 | Business settings | BO |
| BO-65 | Reference lists | BO |
| BO-66 | Mobile app versions | BO |
| BO-67 | Data imports | BO |
| BO-70 | Support regions & WhatsApp numbers | BO |
API surface
| Endpoint group | Operations |
|---|---|
| Administration, settings & audit | 22 |
Test measures
- Playwright e2e: create a user with a role, change permissions, deactivate
- Component tests for the permission matrix and region coverage check
- Manual check with Imad: forced update and maintenance mode on the reseller app
KPI
- Delivered by Sun 29 Nov 2026 within 1.25 person-day(s).
- Every acceptance criterion above demonstrated before hand-off; linked requirements' acceptance criteria pass.
- Zero open critical defects, permission gaps or data-integrity regressions at sign-off.
Generated from content/plan/tasks.json by scripts/generate-team-tasks.mjs. Dates are computed by the scheduler (Sunday–Thursday weeks, holidays excluded) — change the plan, not this page.