Skip to main content

​
Coverage

All 90 page routes are mapped below. Redirect entries have their own description within a related guide, rather than a duplicate implementation guide. Dynamic brackets describe route parameters. Hosts are templates, not deployment URLs.

​
Mahallu Admin (69)

​
Control Panel (15)

​
Mahallu Member (3)

​
Marketing (3)

​
Review notes

  • Family bulk house assignment and removal only show success; they make no persistence request. Specification.
  • Member bulk deletion suppresses per-record failures; reported success can exceed deleted records. Specification.
  • Family intake makes sequential requests; later errors can leave a house/family or some members saved. Specification.
  • Website branding, password, visibility, and domain changes are local state; analytics is an empty presentation. Specification.
  • Tenant billing plans, usage, and payment presentation use fixed/display data; control billing operations are API-backed. Specification.
  • Dedicated report date/basis controls are not passed to their server data loaders; report-catalog entries include approximations/fixed rows. Specification.
  • Member certificate/aid buttons submit no requests. Prayer times and some membership/health badges are fixed text. Specification.
  • Website shortcuts and the dues notification point to routes absent from this inventory. Specification.
  • The setup entry reads a stored draft; the current wizard does not continuously persist its edits. Specification.

​
Additional source findings

  • OTP login uses a server-log development provider; there is no SMS gateway. Member login.
  • Member/public feeds call operator-JWT-protected endpoints and can appear empty for member-only or anonymous sessions. Public home.
  • Collection custom-field required markers are not all checked by the submit handler, and GENERAL/NO_TARGET targeting differs. Record collection.
  • Tenant guards currently elevate platform-membership accounts and bypass permissions for OWNER/ADMIN contexts. Shared navigation.
  • Account parent selection sends parentId, but DTOs require parentAccountId; strict validation rejects the request. Chart of accounts.

​
Verification boundary

Behavior was traced through route components, rendered dialogs, data helpers, API controllers/DTOs, and relevant guards/services. The route inventory stores source paths and hashes so future source changes can be detected. No authenticated app/browser journey, real SMS, payment, certificate, or destructive operation was executed. The documentation preview is a separate check from application behavior.Source commit: 0995e04fcebfe19561950bed799c0c70cf5595db. Local application changes may exist; hashes capture the files actually reviewed.