# Ujjain Simhastha Mahakumbh 2028 — Admin Panel

Separate Next.js admin application for viewing visitor registrations, reports,
admin activity, security events, network traffic, and infra health.
Shares the same MySQL database (`ujjain_khumbh`) as the public website.

## Quick start

```bash
cd admin
cp .env.example .env.local   # if present; or use existing .env.local
npm install
npm run db:init-security     # admins, sessions, activity, security, network tables + seed
npm run dev
```

Open [http://localhost:3002](http://localhost:3002).

### Seeded DB logins (after `db:init-security`)

| Username | Role | Password |
| --- | --- | --- |
| `superadmin` | superadmin | `ADMIN_BOOTSTRAP_PASSWORD` (fallback `ADMIN_PASSWORD`, default `admin@kumbh2028`) |
| `auditor` | auditor | same bootstrap password |

Login is username + password against the `admins` table (bcrypt). Legacy password-only
requests still work and map to username `superadmin`.

## Environment

| Variable | Purpose |
| --- | --- |
| `DB_*` | Same MySQL credentials as the website |
| `JWT_SECRET` | Signs admin session JWT (`jti` = session id) |
| `ADMIN_BOOTSTRAP_PASSWORD` | Seed password for first admins (preferred) |
| `ADMIN_PASSWORD` | Fallback seed password if bootstrap unset |
| `NEXT_PUBLIC_SITE_URL` | Public website URL (for pass links) |

## Database init

```bash
npm run db:init-security
```

Creates (if missing): `admins`, `admin_sessions`, `admin_activity_logs`,
`admin_login_logs`, `security_events`, `http_request_events`, `network_blocklist`.
Seeds `superadmin` + `auditor` only when `admins` is empty.

## Features

- Multi-admin DB authentication with roles and revocable sessions
- All registrations (search / filter by state & planned visit date)
- Report by state / planned visit date
- Admin activity log viewer
- Website registration audit (`audit_logs`)
- Security events (acknowledge / resolve)
- Network aggregates + IP blocklist
- Infra health (process memory, loadavg, MySQL ping; SNMP placeholder)
- Visit window reference: **1 April – 15 June 2028**