Admin Surface

@lastshotlabs/slingshot-admin is the admin HTTP surface for Slingshot. It is intentionally thin: auth and managed-user logic come from providers, not from the plugin itself.

When to use it

Use the admin package when you need:

• admin route mounting with centralized guards
• managed user CRUD against your auth backend
• permissions-aware admin actions and audit logging

Quick start

bun add @lastshotlabs/slingshot-admin @lastshotlabs/slingshot-permissions

import { createAdminPlugin } from '@lastshotlabs/slingshot-admin';
import {
  createMemoryAccessProvider,
  createMemoryManagedUserProvider,
} from '@lastshotlabs/slingshot-admin/testing';
import {
  createMemoryPermissionsAdapter,
  createPermissionEvaluator,
  createPermissionRegistry,
} from '@lastshotlabs/slingshot-permissions';

const registry = createPermissionRegistry();
const adapter = createMemoryPermissionsAdapter();
const evaluator = createPermissionEvaluator({ registry, adapter });

const admin = createAdminPlugin({
  accessProvider: createMemoryAccessProvider(),
  managedUserProvider: createMemoryManagedUserProvider(),
  permissions: { registry, adapter, evaluator },
});

Production notes

• Keep the access provider and managed-user provider outside the plugin.
• Use createAuth0AccessProvider() or a comparable provider for real deployments.
• Enable mailRenderer only when you actually need admin mail previews or sends.

Go deeper

• Package docs
• Permissions guide