Administration interface and settings drafts
Account administration uses current authorization. It follows the saved interface language. Administration does not require mailbox onboarding.
Navigation and identity
The desktop layout uses a 48 px header, 216 px navigation, and 32 px menu rows. Mobile uses a Sheet with larger touch targets.
The signed-in application actor and deployment tenant determine administration authority. Rights combine direct actor memberships and usable evidence from linked Microsoft subjects. Selecting another mailbox does not narrow those administration rights. Mailbox visibility and provider credentials remain separate checks. See actor-wide authorization.
The account menu offers switching, adding an account, and logout.
Back to MailGen returns to the last authenticated MailGen route. The shared workspace retains mailbox view state during the session. A full reload cannot restore that in-memory state. Settings drafts persist separately.
Help appears after about 700 ms of pointer hover and on keyboard focus. Disabled actions explain their restriction. Confirmation uses AlertDialog. Selection uses Select or Combobox.
| Route | Content |
|---|---|
/admin/user-management | Directory members, groups, entitlements, bulk actions |
/admin/group-management | Group hierarchy, permission tree, model grants |
/admin/llm-providers | Providers, logos, credentials, connection tests |
/admin/llm-models | Models grouped by provider identity |
/admin/settings | Categorized policy table with one save |
/admin/storage | Aggregate and per-user usage |
/admin/aiManagement redirects to the provider page.
Providers and models
Creation/editing can save name, type, description, enablement, and logo together. Logo normalization precedes database mutation. Logo and metadata share a transaction. API keys and encrypted provider configuration use separate audited actions and permissions.
The upload interface accepts PNG, JPEG, WebP, and simple SVG up to 160 KB. The backend bounds the data URL at 230000 characters and decoded input at 4000000 pixels. The server rejects active SVG and external references. It produces a PNG no larger than 128×128 px and 100000 bytes. It stores the tenant-owned bytes in PostgreSQL. This does not expose S3 management.
Model cards show protocol, modalities, context/output limits, prices, capabilities, and defaults. Discovery is searchable. Manual model IDs are supported. An empty price means unknown. Zero explicitly means free. Existing provider/model target identity cannot change, so a group grant cannot redirect to a different model.
The original five-provider, 33-model Seed snapshot is historical catalog metadata. It does not prove current price or capability. Reseeding preserves administrator edits, secrets, defaults, and intentional deletions. See catalog behavior.
One settings draft
Search, categories, and Changed only filter the table. The default page size is 25 rows. Each setting shows its value, enforcement, root exception, and source. Structured values offer an editor and secondary JSON view.
Save changes sends every changed field across all pages and filters. Discard changes asks for confirmation, then clears the whole draft.
The local draft key is:
ecas:admin:policies:v2:<encoded-actor>:<encoded-tenant>:<encoded-member-or-organization>
It stores edited values, original values, and server revision. It excludes provider keys, secret configuration, and cURL text. The draft belongs to the actor, deployment tenant, and member/organization target. Switching a mailbox account keeps that same administration draft. If browser storage is unavailable or full, the interface warns and keeps editing state in memory.
GET /policies returns presentation metadata and an opaque revision. PUT /policies takes that revision, optional member scope, and all edits. The server checks all permissions and values before writing. One invalid item rejects the batch. PUT /policies/:key remains a compatibility endpoint.
| Result | Behavior |
|---|---|
400 | Field validation error. Draft remains |
409 | Server revision changed. No automatic overwrite |
| Success | Clear saved edits only after server confirmation |
Review updated settings compares original and current values. Each conflict needs a choice. Apply review rebases the draft only. It does not save to the server.
cURL import
Import parses HTTP configuration without running a shell, making a request, or resolving DNS. For example:
curl -XGET -H "Content-type: application/json" -d '{asd}' 'https://dummy.geg/ger'
This imports GET, the header, and the raw {asd} body. -d implies POST only without an explicit method. Supported compact and long flags work. Shell expansion and file reads are rejected. Invalid input returns explanatory 400 errors.
Later execution still enforces HTTPS, public destinations, DNS pinning, timeouts, and size bounds. See external prerequisites.