MoonAir control room

Users

Manage MoonAir.in admin access, roles, Firebase identities, API secret fallback and route-level permissions.

Not checked
AuthFirebase + secretServer-side API checks
RolesScopedadmin, super_admin, marketing, sales, ops
Public accessSeparatedNo public table editor
Allowlist

Restrict admin emails with environment-backed allowlist.

Role claims

Verify Firebase custom claims server-side.

Session hygiene

Do not trust client-only route hiding.