# Backend UI And Performance Audit

## Fixed In This Pass

- Cached admin shared user data for Inertia responses for five minutes per user/update timestamp.
- Cached admin notification bell data briefly to avoid repeated counts on every admin navigation.
- Cached dashboard data briefly and reduced dashboard chart queries from per-day/per-model counts to grouped date queries.
- Added dashboard action items for draft news, new contacts, active vacancies, and recent media so the dashboard is now closer to an admin command center.
- Optimized settings group summaries from repeated per-group count/latest queries to one grouped query.
- Reduced noisy media logs from `info` to `debug`.
- Optimized gallery admin listing to use `items_count` instead of loading every gallery item.
- Fixed gallery detail image/video counters to use `file_type` counts from the database.
- Added route-level code splitting for Inertia admin pages. The production admin entry dropped from the old large single chunk pattern to a smaller entry plus page chunks.
- Added a reusable React Media Picker and wired it into shared resource forms plus settings file fields.
- Added selected-media path support to services, teams, projects, news, events, products, product categories, galleries, and settings.
- Added image thumbnail/responsive variant generation for media records using predictable small/medium/large WebP files.
- Added media picker thumbnails so the picker does not load full-size images for card previews.
- Added task-based settings sections with section-level save actions.
- Added security settings for login throttling, password policy, hidden login path guidance, session timeout, and 2FA readiness.
- Connected login throttling and password policy settings to the auth layer.
- Added an optional email one-time-code 2FA challenge for admin login. It is off by default and activates when `two_factor_enabled=true` and `two_factor_enforcement=required`.
- Added `php artisan media:generate-thumbnails` to regenerate responsive variants for existing media.

## Admin UI Gaps

- Resource pages still feel too generic. The shared `Admin/Resources/*` screens are useful, but important modules need more domain-specific layouts, especially Media, Settings, Orders, Projects, and Vacancies.
- Settings are now task-sectioned inside each group, but the top-level Settings index could still become a richer task launcher instead of using the generic resource list.
- Media selection is now available in shared forms and settings. Remaining work is deeper module-specific pickers, gallery item selection from existing media, and richer media metadata editing.
- The dashboard now has an action center. Remaining work is deeper health checks: failed payments, pending orders, missing images, broken links, and SEO gaps.
- Bulk operations are inconsistent across modules. Some resources have bulk actions, others still require item-by-item work.
- The admin shell is now branded, but it still needs a more refined visual system: tighter tables, consistent filter bars, better empty states, clearer destructive-action states, and module-specific icons.

## Performance Risks

- Admin route-level code splitting is active. The admin entry is smaller, but shared libraries still make the base chunk meaningful, so future work should split more shared admin utilities only where it helps.
- Dashboard/media aggregate counters are cached briefly. Other module index counters should still be audited as data grows.
- Notification counts are now cached briefly, but invalidation is time-based. A later improvement should clear the cache when new notifications/contact/order states change.
- Some repositories still eager-load full relationships where counts would be enough. Gallery was fixed; other modules should be reviewed similarly.
- Media uploads now generate predictable responsive WebP variants. Remaining work is using those variants consistently in every frontend Blade template and adding regeneration commands for old files.
- Theme/reference files are now ignored, but deployments need a documented asset-publish step per site branch so missing `public/frontend` assets do not break the frontend.
- Search is mostly database `LIKE` search. For larger sites, content search should move to indexed full-text search or a search service.
- Long-running imports/uploads should use queues where possible, especially theme staging, media optimization, emails, and notification fan-out.

## Security/Operational Gaps

- Hidden admin login reduces casual discovery but is not real security by itself. Login throttling, password policy, and email-code 2FA are now setting-driven. Remaining security work is per-user 2FA enrollment/recovery codes and a production mail deliverability check.
- Role/permission assignment needs regular audit tooling so a CMS owner can see who has publishing, settings, user, and payment permissions.
- Activity logs exist, but critical admin actions should have clear filters and export/reporting.
- Backups should be operationalized: database, storage uploads, settings export, and frontend assets per site branch.

## Recommended Next Optimization Order

1. Use responsive media variants consistently in frontend Blade templates.
2. Add per-user 2FA enrollment, recovery codes, and an admin recovery process.
3. Build a richer top-level Settings task launcher.
4. Add cached aggregate counters for more heavy admin index pages.
5. Add deeper dashboard health checks for orders, payments, missing images, broken links, and SEO.
6. Continue replacing generic resource pages with module-specific admin screens.
7. Add operational backup/export flows for database, storage uploads, settings, and frontend branch assets.