pub fn create_admin_pages_router(
app_state: Arc<AppState>,
) -> Router<Arc<AppState>>Expand description
Pages only an admin may see.
Registration is invite-only: POST /api/auth/register has always been
admin-gated, but the page carrying its form was public, so an anonymous
visitor was handed a signup form whose every submission is refused. The
page now sits behind the same gate as the endpoint it posts to.
Layer order matters: auth must run before admin, which reads the
extension auth inserts, and redirect_on_auth_error wraps both so an
HTML visitor is redirected rather than shown a JSON error.