# Admin Control Center & Hardening Implementation Plan

> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.

**Goal:** Turn the existing admin panel into a cleaner command center and harden admin authentication without changing public API behavior.

**Architecture:** Preserve all current admin endpoints and backend modules. Add security helpers in `includes/auth.php`, environment-backed configuration in `config/config.php`, grouped navigation in the shared header, and fail-safe operational summaries in the dashboard.

**Tech Stack:** PHP 8.1+, MySQL/PDO, vanilla HTML/CSS/JS.

**Spec:** `docs/superpowers/specs/2026-09-14-admin-control-center-hardening-design.md`

## Global Constraints
- Do not change existing Android API response formats.
- Do not require new PHP packages.
- Do not require a database migration.
- Preserve every existing admin page URL.

---

### Task 1: Authentication hardening
**Files:** Modify `includes/auth.php`, `admin/login.php`; Test `tests/test_admin_hardening.php`.
**Produces:** CSRF helpers, secure session initialization, login throttling, regenerated sessions.
- [ ] Write failing tests for CSRF and login-throttle helper behavior.
- [ ] Run tests and confirm failure.
- [ ] Implement helpers and login changes.
- [ ] Re-run tests and confirm pass.

### Task 2: Environment-backed secrets
**Files:** Modify `config/config.php`; Test `tests/test_admin_config.php`.
**Produces:** `env_value()` helper and environment overrides for DB/API/admin config with stable bcrypt fallback.
- [ ] Write failing static/config test.
- [ ] Run and confirm failure.
- [ ] Implement environment-backed constants.
- [ ] Re-run and confirm pass.

### Task 3: Grouped responsive navigation
**Files:** Modify `admin/partials/header.php`, `admin/partials/footer.php`; Test `tests/test_admin_navigation.php`.
**Produces:** grouped/collapsible sidebar with active group and mobile toggle; CSRF auto-injection for POST forms.
- [ ] Write failing navigation structure test.
- [ ] Run and confirm failure.
- [ ] Implement grouped navigation and responsive JS/CSS.
- [ ] Re-run and confirm pass.

### Task 4: Command dashboard
**Files:** Modify `admin/index.php`.
**Produces:** Live/Upcoming/Feed/Health status cards, cron freshness, quick actions, safe optional-module handling.
- [ ] Add fail-safe summary helpers locally in dashboard.
- [ ] Add status cards and quick actions.
- [ ] Run syntax checks.

### Task 5: Final verification and packaging
**Files:** Update `README.md`; package whole `Server/` tree.
- [ ] Document the new admin/security behavior and env variables.
- [ ] Run all helper tests.
- [ ] Run `php -l` for every PHP file.
- [ ] Create final ZIP and run `unzip -t`.