# Admin & automation

Beyond the shopper app and the seller portal, Drape has an internal admin surface
and a set of autonomous background agents. Both are gated to admins.

:::info[The primary admin is now the web dashboard]
On the shipped `main` mobile app these `(admin)` screens still exist, but the
going-forward admin is the standalone web dashboard
[admin.drape.to](../architecture/web-surfaces.md) (`Drape-admin-v1`) — far richer
(bulk actions, email campaigns, moderation, audit logs). On the Postgres
`develop` branch the mobile admin screens are removed in favor of it.
:::

## Admin screens (mobile)

The mobile `(admin)` route group is small and operational:

| Screen | What it does |
|---|---|
| `dashboard.tsx` | Platform stats (users, products, previews) plus admin tools |
| `products.tsx` | Global product management (CRUD across all stores) |
| `stores.tsx` | Store / brand management |
| `store-admin/index.tsx` (top-level) | Per-store admin stats dashboard |

These call the ADMIN-gated `/api/admin/*` endpoints, which are protected by the
`get_admin_user()` dependency (`is_admin == true`). There is also a separate
`POST /api/admin/login` that authenticates against `ADMIN_PASSWORD`.

## Autonomous cron agents

`backend/agents/` holds a small fleet of agents that run as **Render cron jobs**,
not inside the web service. They exist because a solo founder cannot manually QA a
biometric AI pipeline every day.

```mermaid
graph TB
    subgraph "Render cron"
        AT["app_tester<br/>hourly smoke tests"]
        RT["render_tester<br/>every 6h — live try-on matrix"]
        BF["bug_fixer<br/>Anthropic-drafted fixes → bug_reports"]
        QM["quality_monitor"]
        RO["render_optimizer"]
        IV["image_validator"]
        Backup["mongodb-backup"]
        QA["drape-qa-reporter<br/>Playwright"]
    end
    RT --> Mongo[("bug_reports / render_logs")]
    BF --> Mongo
```

| Agent | Role |
|---|---|
| `app_tester` | Hourly smoke tests against the running app |
| `render_tester` | Every 6 hours, runs a live try-on matrix across products |
| `bug_fixer` | Uses Anthropic Claude to draft fixes into the `bug_reports` collection — the **only** place `anthropic` is imported |
| `quality_monitor` | Watches render quality signals |
| `render_optimizer` | Tunes render parameters |
| `image_validator` | Validates garment / body images |

The ADMIN-only `/api/agents/*` endpoints surface these agents' reports
(quality report, test report, bug reports) and can trigger some on demand.

:::info[Why this matters for the audit]
Because `anthropic` and `requests` are used **only** by these cron agents and
never by the web service, the [dependency audit](../audit/dependencies.md)
recommends moving them out of the production `requirements.txt` into a dev/agent
requirements file.
:::