Dedicated admin surface at admin.agentlab.in (Google auth + MFA)

[harshitsinghbhandari]

Move all admin actions off the main app and onto a dedicated subdomain.

Goal

admin.agentlab.in becomes the sole surface for admin/moderation actions. The main app (agentlab.in) no longer renders /admin — either the route 404s for everyone or redirects to the subdomain.

Why

• Strong isolation between admin and user-facing surfaces. A vuln in the public app can't reach admin actions.
• Different identity stack — Google auth (operator's primary identity) + MFA. Admin authentication is no longer coupled to the GitHub OAuth path used for end users.
• Closes the remaining residual concern from audit C5 (C5: dev.agentlab.in preview shares prod admin allowlist + Supabase project #45 / accepted-risk for v1): even with one admin, admin actions live on a domain that the user app can't pivot to via cookie reuse, XSS, or session leakage.

Scope sketch

• New Next.js deployment (or same monorepo, separate Vercel project) at admin.agentlab.in.
• Auth: Google OAuth via NextAuth Google provider. MFA enforced (TOTP via NextAuth credentials extension OR a separate library).
• Sole-admin-allowlist via env var (same pattern as today's ADMIN_GITHUB_LOGINS, but ADMIN_GOOGLE_EMAILS).
• Same Supabase backend — service-role client on the admin app talks to the existing public.* + mod_actions etc.
• Migrate all app/admin/* routes from the main app to the admin subdomain.
• Main app's /admin route is removed; replace with a 404 or a redirect to admin.agentlab.in.
• Audit log (mod_actions) writes still go to the same table; no schema changes needed.

Open product calls (decide at planning time)

• Identity provider: Google only, or Google + WebAuthn?
• MFA implementation: TOTP via authenticator app, or push-based?
• Where do reports / pending tags surface for non-admin moderators (if we ever have plural admins)?
• Does the admin app live in the same monorepo (admin/ subdir) or a separate repo? Probably monorepo for type sharing — mirror the CLI decision.

Timing

Way later. Not for v1, not for v1.1, not pre-launch. After CLI ships and the platform has actual moderation volume. Single-admin reality for v1 means this is hardening, not blocker.

Related

• Audit C5 (C5: dev.agentlab.in preview shares prod admin allowlist + Supabase project #45) — closed as accepted-risk; this issue is the post-launch fix.
• For the launch flip itself, the lighter mitigation is to add if (VERCEL_ENV !== 'production') return false to requireAdmin AS PART of the flip commit, so dev.agentlab.in's admin disables the moment prod admin comes alive.