Admin panel and settings

The backend serves a web admin panel at /admin. There you change every setting, manage admin accounts, and see what the backend does.

#What the panel shows

• Questions, cost, players, servers, errors and cancellations, answer times, tokens, web searches, the cost of a question, models, tools, and the busiest players, by day.
• Each run's numbers and the shape of its trace: steps, models, tools and whether they worked, tokens, and timings.
• With billing on: licenses, payments, revenue, refunds, budgets granted by hand, and blocked licenses. “Refund and revoke” on a license's page returns every payment through the bot, stops its subscription, tells the payer in Telegram, and revokes the license for good: its key answers LICENSE_INVALID, and the server takes a new license with /allay link. Telegram refunds only whole payments, so there is no partial refund. Delete removes a license and its budget windows; its payments stay. A paid license without a refund sends you to “Refund and revoke” first, and only an owner may delete it anyway, after a warning about the payer's rights and a second agreement.

Nobody sees what players asked, what Allay answered, what tools were given and returned, or what Allay remembers about a player. The backend never sends those to the browser, whatever the role. Since 6.4 the panel names players with the name and UUID of their last question and shows their faces (see Security and privacy).

Statistics come from a runs collection, one document per run with numbers only, kept 400 days, plus daily rollups whose sums stay forever and whose lists of players go after 400 days.

#Servers

The Servers page lists each Minecraft server by who pays. Each is headed by the name its owner set (server.name in the plugin's config, Allay 6.5; unique on the backend, otherwise the server's random id), then the address players join with (server.address, Allay 6.4) past a middle dot, and its MOTD below. It also shows the game software and version, the plugin's version, questions, players, cost, and the last question. Admins also see the address each server connects from; one marked internal reaches the backend over a private network they share, like a plugin on the same machine. A license's page shows the same for each server behind it.

#Players

The Players page lists players with their face, name, servers, questions, errors, tokens, average answer time, cost, language, and first and last question. Players who last asked before 6.4 show their pseudonym until their next question. The search takes the start of a name, a UUID, or a pseudonym. A player's page adds their UUID, operator status, questions by day and by hour, and their kinds of runs, models, and tools.

A player's page has Actions for admins, on one server the player asked on:

• Clear session: Allay forgets the conversation so far, as after the player's own /allay new. Memories stay.
• Block and Unblock: a blocked player gets PLAYER_BLOCKED on that server until someone unblocks them. Blocked players on the Players page lists every block, erased players too.
• Erase: memories, session, agents' threads, and traces go, and runs keep only numbers.

The backend finds who a pseudonym is in the player directory (everyone who asked since 6.4), among the players who agreed to the notice on that server (since 6.1), or among those with memories there. When none knows them, there's no session to clear, and erasing removes what's left: their runs' ties and traces. Erase a player under the list picks the player by name from that server's players, with face and UUID, and still takes a UUID or a pseudonym typed in. Every action lands in the audit log under the pseudonym.

#Create the first account

On a self-hosted backend (SELFHOSTED=1, with PLUGIN_TOKEN set in the backend and the plugin):

1. In the game, as an operator, run /allay init.
2. The plugin shows a link that works once, for 30 minutes. A new /allay init replaces a pending link.
3. Open it: the setup page makes you the panel's owner.

A backend with billing on prints a setup code to its log at start instead.

With ADMIN_USERNAME and ADMIN_PASSWORD (or ADMIN_PASSWORD_HASH) in the environment, that account is the owner, setup is off, and the panel goes straight to sign-in.

#Recover a forgotten password

1. On a self-hosted backend that already has an account, run /allay init again.
2. This time the link opens a recovery page, with the same rules: once, for 30 minutes.
3. Enter your name and a new password. Every other session of that account ends, and the audit log notes it.

An owner can also set a new password for anyone on the Accounts page. On a backend with billing on, that's the only way back. The environment's admin is the last resort: its password lives in ADMIN_PASSWORD or ADMIN_PASSWORD_HASH, never in the panel.

#Roles

• Owners do everything, other accounts included.
• Admins change settings and billing, and clear, block, and erase players.
• Viewers only read, and don't see payers' Telegram ids.

Every change lands in the audit log with its old and new value, secrets masked, kept 365 days. The API shows only the last four characters of a secret.

#Sessions and sign-in

A session lasts 7 days from its last use, in an HttpOnly, SameSite=Strict cookie. Sign-in locks for 15 minutes after 5 wrong passwords for one name, or 10 from one address (an IPv6 /64 counts as one). Behind a proxy, set TRUSTED_PROXIES, or every visitor shares the proxy's address.

#Settings

Each setting keeps the name of the environment variable it was before 5.7. Changes apply to the next run, except those marked “after a restart”. A self-hosted backend hides the billing and Telegram groups.

#Model

#Search

#Limits

#Sessions

#Tracing

#Billing (hosted backends only)

#Telegram (hosted backends only)

#Address

#Access

Next: Who pays for the model