Backend — Admin Dashboard

Consenti ships a full admin SPA (Preact + Tailwind CSS) baked directly into the @consenti/api package. No separate deployment or build step is needed — it is served from dist/dashboard/ inside the package.

Enabling the dashboard

createConsenti({
  storage: { driver: 'node:sqlite', path: './consenti-data' },
  auth: { mode: 'local', adminEmail: '[email protected]', adminPassword: process.env.CONSENTI_ADMIN_PASSWORD! },
  dashboard: true,   // ← enables the SPA
})

The dashboard is then available at /consenti/ (or your configured basePath).

Dashboard sections

Auth modes

Profile creation wizard

Creating a profile follows a 4-step wizard:

Step 1 — Profile metadata

Step 2 — Cookie Template

Select or create a Cookie Template. Clicking Next calls POST /admin/profiles/validatewith the template's cookies and the chosen compliance group:

• Compliance errors (red): block advancing to Step 3 until resolved
• Compliance warnings (amber): show an acknowledgment checkbox — must be checked to proceed, but do not block saving

Step 3 — UI Template and locale authoring

Select or create a UI Template. New templates start blank; click Load Defaults in the amber callout to populate a starter structure.

• + Add locale opens a searchable BCP 47 locale selector
• Non-default locale tabs show the default locale's copy as placeholder text in heading, subheading, and category-heading inputs
• Import / Export: JSON exports all locale tabs as locales.json; CSV exports the current locale tab; Import accepts both formats and auto-creates missing locale tabs

Step 4 — Content and readability

Enter localised copy (heading, body HTML) for the main banner, GPC banner, and preference modal categories. Inline advisory warnings appear when:

• Heading exceeds 80 characters
• Average sentence length in body exceeds 25 words
• Total word count in body exceeds 150 words

These are informational only — the profile can still be saved.

Profile activation and hot-serve

Profiles are inactive after creation. To serve them via geo-routing:

1. Click Activate in the profile list or call POST /admin/profiles/:id/activate
2. Consenti copies locale JSON files from ${profileId}/${version}/ to ${complianceGroup}/
3. The static file route serves these files immediately — zero DB on the hot path

Only one profile per compliance group can be active. Activating a new profile automatically deactivates the existing one.

Profile version history

Every profile save creates an immutable snapshot. The version history page shows:

• Left panel: list of all versions with dates
• Right panel: prettified JSON for the selected version; locale switcher dropdown

Template save safety

When saving a Cookie Template or UI Template that is used by one or more profiles, a confirmation dialog lists the affected profiles. You must confirm before changes are applied.

• Deleting a Cookie Template used by active profiles is blocked (422) — deactivate the profiles first
• Removing cookies from a Cookie Template is blocked if any profile's compliance group requires those cookies

Serving behind a reverse proxy

location /consenti/ {
    proxy_pass http://localhost:3001/consenti/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}