The admin frame, request preparation and shared components

The preparation that runs at the start of every admin request, the event handlers of the left menu and the header, and the shared components: error page, no-permission page, document modal, company and store picker.

The admin frame consists of three layers: the preparation that runs at the start of every request, the event handlers that extend the menu and the header, and the shared components reused by the modules. They have no function permission of their own; the calling module's permission decides.

Request preparation

At the start of every admin request, in this order:

Time zone Europe/Budapest, also for the database connection.
JSON and error safety net armed; the built-in error page redirected to the system's own admin error page.
Deployment detection: when the signature of the file set changes, the template and OPcache are cleared.
Service libraries registered (permission, feature catalogue, subscription, quota, payment, update and about 45 more); a missing or damaged file produces a descriptive log line.
Maintenance guard during an update: AJAX requests get a 503 JSON (MAINTENANCE), pages are redirected to the Update Manager.
On a full page load (dashboard or own page) automatic migration and completion of the super administrator's route permissions from the controllers found on disk.
Once per session, self-healing of the user's basic route permissions.
Upsell guard: on a full page, if the list function is locked (reason: subscription or debt), redirect to the offer page with the locked route, the reason and the return address.

Left menu and header

The menu event handler runs only if the user has basic access to the module settings and the module is enabled. Each item is shown according to canSee(route, 'list'); the four Users items and the SQL runner only with isSuper(). Some subscription items (Credit account, Subscription offer) are hidden.

Header element	Condition
Error log link	super or access to the error log route; registration does not add the event, and the code does not show whether another path does
Notification bell	super or access to the notification route
Maintenance (broom)	super only
Subscription warning	unpaid fee, end of trial, renewal

The company selector inserted into the header points to the invoice list, but the template does not render the company list. For the common/header snippet the code does not show that it is loaded from anywhere.

Shared components

Component	Behaviour
`common/adminerror`	Error page inside the admin frame; with `debug` permission the last 25 lines of the error log (at most 8 KB from the end of the file). If the frame itself fails, minimal HTML.
`common/denied`	No-permission page in the frame; if the UI mode is `upsell` and the user has `subscription/upsell` + `order`, a link to the offer with `reason=subscription`.
`common/docmodal`	Markup and captions of the shared document modal; it fetches no data, the bytes come from the document centre's preview endpoint.
`common/companypicker`	`rows`: active companies of the company group within the content scope, if `canAction` grants the caller's permission; `respond`: JSON in three shapes; `addlink`: link to the company form only with `canSave('company/company', 0)`.
`common/storepicker`	Store tick boxes (0 = "Default"); saving is done by the owning model.

Permissions

The components and the preparation have no function key of their own. The error page details depend on the module's debug key, which is not classified in the seeds.

Data used

Table names carry the installation's own prefix in the database. The preparation uses the setting and user_group tables (route permissions) and the migration log tables.

Related topics: menu and header permissions maintenance

Request consultation Back to home