Admin Panel and Dashboard Internals

The administrative interface at /admin (configurable with APP_ADMIN_URL): how it is assembled, which permission guards each area, and where each screen's code lives.

In the user guide: Admin Panel Overview and Dashboard.

The shell

Every admin page is rendered inside <x-admin-layout> (class App\View\Components\AdminLayout), which renders resources/themes/admin/layouts/app.blade.php:

• <x-admin-sidebar /> — the sidebar, built from MenuManager::adminMenus().
• <x-application-header /> — top bar with user menu and notifications.
• Breadcrumbs::render() — from routes/breadcrumbs.php (and each module's routes/breadcrumbs.php). The browser title is built from the current breadcrumb.
• <x-application-alerts /> and <x-application-messages /> — flash messages (->withSuccess(), ->withErrors()).
• {{ $slot }} — your content.
• Blade stacks you can push to: page_header (inside <head>, usually @vite styles), page_scripts (before </body>), and the footer_scripts section.

resources/views/admin/example.blade.php

<x-admin-layout>
    @push('page_header')
        @vite(['Modules/Example/resources/scss/admin/example.scss'])
    @endpush

    <div class="card">
        <div class="card-body">{{ __('example::example.hello') }}</div>
    </div>

    @push('page_scripts')
        @vite(['Modules/Example/resources/js/admin/example.js'])
    @endpush
</x-admin-layout>

Modules wrap this in their own layout component (for example Modules/Booking/resources/views/components/booking-admin-layout.blade.php) to push their Vite assets once.

Sidebar and the permission behind each entry

The core entries are registered by App\Helpers\Admin\AdminAsideMenu inside AdminTheme, once per admin request, only for the entries the current user may see. A user who lacks every permission of a group never gets the group.

Plugins add their own groups (Booking, TruCommerce, Payments). See Admin menu and dashboard for the API.

Core admin screens → code

All routes below are in routes/admin.php, inside auth, verified, 2fa, with the permission shown as a ->can() on each route.

The dashboard

The dashboard view is a single line — @dashboard('admin.dashboard') — and everything on it comes from the Dashboard registry. The directive renders rows, and each row renders its items according to their type (widget, include, component or html). Widgets may be rendered synchronously or asynchronously (Arrilot async widgets).

Any plugin can define its own named dashboard with Dashboard::for('myplugin.dashboard') and render it with @dashboard('myplugin.dashboard'). Rows and items accept an optional permission so a widget only appears for users who hold it.

Notifications, profile and security in the admin

• Two-factor authentication is enforced by the 2fa alias on the admin route group; enrolment lives under admin.mfa / admin.twofactor.update.
• DemoClearance blocks write routes for demo accounts — see Architecture.

Extending the admin panel