Download the PHP package ados-labs/enterprise-admin-panel without Composer

Enterprise Admin Panel

Author: Nicola Cucurachi Enterprise Lightning Framework - Package 0

Admin panel with cryptographic dynamic URLs. No predictable /admin endpoints.

What This Does

Traditional admin panels use /admin. Attackers know this. They scan for it. They brute-force it.

This panel generates URLs like:

• 128-bit entropy per URL
• 2FA enabled by default
• Emergency access token (bypasses login + 2FA)
• /admin returns 404

Features Overview

Requirements

• PHP 8.2+
• PostgreSQL 14+ or MySQL 8.0+
• Redis 7+ (optional, for distributed circuit breaker)
• Docker/OrbStack (for local development)

Installation

Step 1: Create Project

Step 2: Create composer.json

Step 3: Install Dependencies

Step 4: Start Database Services

Option A: Use the included docker-compose.yml

Option B: Use existing database

Skip docker-compose and configure your existing database in Step 5.

Step 5: Create .env File (REQUIRED)

Important: Create this BEFORE running the installer!

Step 6: Run Installer

IMPORTANT: Save the output! You will see:

• Admin URL - Secret URL (shown only once!)
• Password - Generated secure password
• Master CLI Token - Required for all CLI commands

Step 7: Start Web Server

Step 8: Access Admin Panel

Open the URL shown in Step 6 (NOT /admin!)

Two-Factor Authentication (2FA)

Supported Methods

Email 2FA (Default)

Email 2FA works out of the box with Mailpit (development) or any SMTP server.

Development: View codes at http://localhost:8025 (Mailpit)

TOTP Setup

Users can enable TOTP from their profile:

1. Click "Enable Authenticator App"
2. Scan QR code with Google Authenticator/Authy
3. Enter verification code to confirm
4. Save 8 recovery codes (XXXX-XXXX format)

Telegram 2FA

1. Create a Telegram bot via @BotFather
2. Get the bot token
3. User sends /start to your bot
4. Get user's chat ID from the message

Discord 2FA

1. Create a Discord webhook in your server settings
2. Add webhook URL to .env
3. Configure user's Discord ID

Slack 2FA

1. Create Slack Incoming Webhook in your workspace
2. Add webhook URL to .env
3. Configure user's Slack ID

Enable Notification Channels in Database

Enable channels via admin config:

Recovery Codes

When TOTP is enabled, 8 recovery codes are generated:

• Format: XXXX-XXXX (hex)
• One-time use
• Stored as bcrypt hashes
• Can be regenerated from profile

Session Management

Features

• 256-bit session IDs - Cryptographically secure
• Database-backed - No filesystem dependency
• 60-minute lifetime - With activity-based extension
• Multi-device tracking - View/revoke sessions

Session Lifecycle

1. Login → 60-minute session created
2. Activity within last 5 minutes before expiry → Extended by 60 minutes
3. No activity → Session expires
4. Explicit logout → Session destroyed

Configuration

API

CLI Commands

All commands are in vendor/ados-labs/enterprise-admin-panel/elf/.

All commands require triple authentication:

• --token= Master CLI token
• --email= Admin email
• --password= Admin password

Available Commands

Get Admin URL

Change Password

Password Requirements:

• Minimum 12 characters
• At least 1 number
• At least 1 special character (!@#$%^&*-_=+)

Rotate Admin URL

Effects:

• New 128-bit URL generated
• Old URL returns 404
• All admins notified via their preferred channel

Create Emergency Access Token

Security:

• ONE-TIME USE
• Bypasses password AND 2FA
• Store offline (print and secure)

Use Emergency Token

Or via browser:

Notification System

Channels

Notification Types

• 2FA Verification Codes - 6-digit OTP, 5-minute expiry
• URL Rotation - New URL, reason, timestamp
• Security Alerts - Failed logins, suspicious activity
• Recovery Tokens - Emergency access instructions

API

Security Features

URL Security

CSRF Protection

• Per-session CSRF tokens (256-bit)
• Constant-time comparison (hash_equals)
• Auto-regeneration available

Audit Logging

All actions are logged:

Logged events:

• login_success, login_failed
• 2fa_enabled, 2fa_disabled
• password_changed
• session_created, session_destroyed
• url_rotated
• emergency_token_created, emergency_token_used

Database Pool

• Connection pooling with LIFO reuse
• Circuit breaker (trips on failures, auto-recovers)
• Distributed state via Redis
• Metrics and monitoring

Dashboard Features

The admin dashboard includes real-time metrics:

• Database Pool - Connections, queries, circuit breaker state
• Redis - Workers, memory, commands
• Audit Log - Recent activity
• System Info - PHP version, memory usage

Project Structure

After installation:

Services

Documentation

See the docs/ folder:

• Quick Start - Get running fast
• CLI Commands - All CLI commands in detail
• Performance - OPcache, Redis, caching
• Database - Database access and configuration
• Architecture - System design

Development Setup (Package Maintainers)

If you're developing the package itself (not using it as a dependency), follow these steps:

Prerequisites

Your test project must have both packages installed:

Get Admin URL (Development)

IMPORTANT: Run the command from your test project directory, not from the package directory!

Why? The CLI scripts need access to both enterprise-admin-panel AND enterprise-psr3-logger classes. Your test project's vendor/autoload.php has both, while the package's own vendor/ only has its direct dependencies.

After Modifying composer.json in the Package

If you change composer.json in enterprise-psr3-logger or enterprise-admin-panel (e.g., removing/adding autoload files), you must reinstall in your test project:

This refreshes the autoloader with the new configuration.

Troubleshooting

"DB_PASSWORD is required"

Create .env with DB_PASSWORD before running the installer.

"404 Not Found" on /admin

Expected. Use the secret URL from installation.

Lost the admin URL?

If using as dependency:

If developing the package:

2FA codes not arriving

Email: Check Mailpit: http://localhost:8025

Telegram:

1. Verify bot token: curl https://api.telegram.org/bot<TOKEN>/getMe
2. Verify chat ID: User must have sent /start to your bot

Discord/Slack: Test webhook manually with curl

"Class not found" errors in CLI commands

Error: Class "AdosLabs\AdminPanel\Bootstrap" not found or Class "AdosLabs\EnterprisePSR3Logger\LoggerFacade" not found

Cause: You're running the command from the wrong directory. The package's own vendor/ doesn't include all required dependencies.

Solution: Run from your test project directory:

"Failed to open stream: should_log_stub.php"

Error: require(...should_log_stub.php): Failed to open stream: No such file or directory

Cause: The composer.lock file has stale autoload configuration after the package was updated.

Solution: Reinstall dependencies:

Connection refused

Make sure Docker services are running:

License

MIT License - see LICENSE