Skip to main content

Admin & automation

Beyond the shopper app and the seller portal, Drape has an internal admin surface and a set of autonomous background agents. Both are gated to admins.

The primary admin is now the web dashboard

On the shipped main mobile app these (admin) screens still exist, but the going-forward admin is the standalone web dashboard admin.drape.to (Drape-admin-v1) — far richer (bulk actions, email campaigns, moderation, audit logs). On the Postgres develop branch the mobile admin screens are removed in favor of it.

Admin screens (mobile)

The mobile (admin) route group is small and operational:

ScreenWhat it does
dashboard.tsxPlatform stats (users, products, previews) plus admin tools
products.tsxGlobal product management (CRUD across all stores)
stores.tsxStore / brand management
store-admin/index.tsx (top-level)Per-store admin stats dashboard

These call the ADMIN-gated /api/admin/* endpoints, which are protected by the get_admin_user() dependency (is_admin == true). There is also a separate POST /api/admin/login that authenticates against ADMIN_PASSWORD.

Autonomous cron agents

backend/agents/ holds a small fleet of agents that run as Render cron jobs, not inside the web service. They exist because a solo founder cannot manually QA a biometric AI pipeline every day.

Render cron

app_tester
hourly smoke tests

render_tester
every 6h — live try-on matrix

bug_fixer
Anthropic-drafted fixes → bug_reports

quality_monitor

render_optimizer

image_validator

mongodb-backup

drape-qa-reporter
Playwright

bug_reports / render_logs

AgentRole
app_testerHourly smoke tests against the running app
render_testerEvery 6 hours, runs a live try-on matrix across products
bug_fixerUses Anthropic Claude to draft fixes into the bug_reports collection — the only place anthropic is imported
quality_monitorWatches render quality signals
render_optimizerTunes render parameters
image_validatorValidates garment / body images

The ADMIN-only /api/agents/* endpoints surface these agents' reports (quality report, test report, bug reports) and can trigger some on demand.

Why this matters for the audit

Because anthropic and requests are used only by these cron agents and never by the web service, the dependency audit recommends moving them out of the production requirements.txt into a dev/agent requirements file.