fix: secure and wire the portfolio admin panel

[Dev-Sahad]

Summary

This PR hardens the existing admin panel and adds a new diagnostics feature.

Fixed

• Added server-side protection for /admin/* routes.
• Added protection for /api/admin/* endpoints.
• Prevented authenticated non-admin users from accessing the dashboard.
• Added graceful handling when Supabase environment variables are missing.
• Improved logout navigation with replace() and refresh().
• Simplified and stabilized responsive sidebar rendering.
• Added accessible labels to mobile menu controls.

New feature

• Added System Status to the admin sidebar.
• Added /admin/status diagnostics page.
• Added protected /api/admin/health endpoint.
• Checks application availability, Supabase configuration, database connectivity, response time, and deployment environment.

Required environment variables

• NEXT_PUBLIC_SUPABASE_URL
• NEXT_PUBLIC_SUPABASE_ANON_KEY
• Optional: ADMIN_EMAILS as a comma-separated allowlist.

The existing admin email remains as a compatibility fallback, but ADMIN_EMAILS is recommended for deployment configuration.

Validation note

The repository was reviewed through the connected GitHub integration. Network access from the local execution container was unavailable, so CI/build execution should run on this PR before merging.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
portfolio-v1	Building	Preview, Comment	Jul 20, 2026 9:10pm

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b779b22eae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Protect the health route in the active middleware

This handler relies on the new top-level middleware.ts for admin auth, but this app's app directory lives under src, and the existing middleware at src/middleware.ts is the one colocated with src/app; I checked its matcher and it does not include /api/admin/:path*. In that layout, an unauthenticated GET /api/admin/health reaches this route directly and returns environment/database status and Supabase error messages, so the admin diagnostics endpoint is public unless this path is added to src/middleware.ts or auth is enforced here.

Useful? React with 👍 / 👎.