Previously, any authenticated user could access /admin, /admin/moderation,
/admin/platform, /admin/transfers, and /admin/roles — the ProtectedRoute
only checked isAuthenticated, not role. Exposed the admin Command Center
UI to listeners/creators (critical security flaw).
Changes:
- ProtectedRoute accepts requireAdmin prop; redirects to /dashboard when
authenticated user lacks admin/super_admin role or is_admin=true
- New wrapAdminProtected() helper in routeConfig
- All /admin/* routes now use wrapAdminProtected
Note: Backend API still enforces admin checks independently — this fix
only prevents the UI from being shown to non-admins.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Update auth, playlists, tracks, search, profile, dashboard, player,
settings, and social features. Add e2e audit specs for all major pages.
Update ESLint config, vitest config, and route configuration.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- EducationPage with 3 tabs: Catalog, My Courses, Certificates
- HLS.js video player integration for course lessons
- Course enrollment, progress tracking, and certificate display
- TypeScript types matching backend models
- API service layer for all education endpoints
- Lazy loading route configuration
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Distribution types, API service, and page component
- Distributions list with platform-specific status badges
- External streaming revenue table with summary cards
- Platform icons and status colors for Spotify/Apple Music/Deezer
- ARIA labels for accessibility
- Lazy-loaded route at /distribution
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add subscription types, service, and page component
- Pricing page with Free/Creator/Premium plan cards
- Monthly/yearly billing toggle (17% savings on yearly)
- Current subscription status display
- Cancel/reactivate subscription controls
- Invoice billing history table
- ARIA labels for accessibility
- Lazy-loaded route at /subscription
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Create ComingSoon.tsx: simple placeholder showing feature name and
"under development" message with proper Tailwind styling
- Replace LazyGear, LazyLive, LazyEducation, LazyQueue, LazyDeveloper
route elements with <ComingSoon feature="..." />
- Remove unused lazy imports for ghost components
Users navigating to /gear, /live, /education, /queue, /developer will
now see a clear "Coming Soon" message instead of broken components
that depend on non-existent backend APIs.
Addresses audit finding D5: 5 ghost routes without backend.
Co-authored-by: Cursor <cursoragent@cursor.com>
Mark /gear, /live, /education, /queue, /developer routes as PLANNED
with a comment indicating no backend exists yet. These routes render
frontend components but have no corresponding API endpoints.
No routes removed — this is documentation only, zero regression risk.
Addresses audit finding: section 2 (product/code inconsistencies).
Co-authored-by: Cursor <cursoragent@cursor.com>
Created comprehensive demo page at /design-system showcasing:
- All 9 button variants with sizes
- All 6 card variants
- Badges (8 variants) and Tags (3 variants)
- Avatars (4 variants, 6 sizes) with status indicators
- AvatarGroup component
- Typography with gradient text
- Special effects (glows)
- Animations (pulse, spin, shake)
Route added to router as public page for easy testing.
Access at: http://localhost:3000/design-system
- Added ErrorBoundary to all public routes (login, register, forgot-password, verify-email, reset-password)
- Added ErrorBoundary to public user profile page (/u/:username)
- Added ErrorBoundary to protected routes: dashboard, marketplace, chat
- Added ErrorBoundary to settings/sessions route
- Added ErrorBoundary to admin/roles route
- Added ErrorBoundary to tracks/:id route
- Added ErrorBoundary to playlists/* route
- Added ErrorBoundary to search route
- Added ErrorBoundary to notifications route
- Added ErrorBoundary to error pages (404, 500)
- All pages now have error boundaries for graceful error handling
- Error boundaries provide fallback UI with retry and home navigation options
- Created dedicated Notifications page with full notification management
- Added notification service with API integration (get, mark as read, mark all as read)
- Added filtering by status (all/unread/read) and type (message/track/mention/system/etc)
- Added mark as read functionality for individual notifications
- Added mark all as read functionality
- Added notification type icons and labels
- Added notification timestamps with relative time formatting
- Added notification links support for navigation
- Added empty states for no notifications
- Added loading and error states
- Integrated with backend notification APIs
- Added route /notifications to router
- Added lazy loading for NotificationsPage component
- Added visual distinction for unread notifications (badge, background)
- Added notification type badges
- Created dedicated Search page with unified search interface
- Added search functionality for tracks, playlists, and users
- Implemented tabs for filtering results by type (All/Tracks/Playlists/Users)
- Added search query debouncing for performance
- Added URL query parameter synchronization (q, type)
- Added pagination for each result type
- Added empty states for no query and no results
- Added loading states for all search operations
- Added error handling for search failures
- Integrated with existing search APIs (tracks, playlists, users)
- Added search service for user search API
- Added route /search to router
- Added lazy loading for SearchPage component
- Added result previews in All tab (6 items per type)
- Added View All buttons to navigate to specific tabs
