Function createAdminRouter

src/server/web/admin.ts:26–93

(
  sessionManager: SessionManager,
  userStore: UserStore,
)

}

export function createAdminRouter(
  sessionManager: SessionManager,
  userStore: UserStore,
): Router {
  const router = Router();

  // All admin routes require admin role.
  router.use(requireAdmin);

  // ── Dashboard UI ──────────────────────────────────────────────────────────

  router.get("/", (_req, res) => {
    try {
      const p = join(import.meta.dirname, "public/admin.html");
      res.setHeader("Content-Type", "text/html");
      res.send(readFileSync(p, "utf8"));
    } catch {
      res.setHeader("Content-Type", "text/html");
      res.send(INLINE_ADMIN_HTML);
    }
  });

  // ── API: all active sessions ──────────────────────────────────────────────

  /**
   * GET /admin/sessions
   * Returns all active sessions across all users.
   */
  router.get("/sessions", (_req, res) => {
    const sessions = sessionManager.getAllSessions().map((s) => ({
      id: s.token,
      userId: s.userId,
      createdAt: s.created,
      ageMs: Date.now() - new Date(s.created).getTime(),
      alive: s.alive,
    }));
    res.json({ sessions });
  });

  // ── API: all connected users ──────────────────────────────────────────────

  /**
   * GET /admin/users
   * Returns all users that currently have at least one active session.
   */
  router.get("/users", (_req, res) => {
    res.json({ users: userStore.list() });
  });

  // ── API: force-kill a session ─────────────────────────────────────────────

  /**
   * DELETE /admin/sessions/:token
   * Force-kills the specified session regardless of which user owns it.
   */
  router.delete("/sessions/:token", (req, res) => {
    const { token } = req.params;
    const session = sessionManager.getSession(token);