Make review an explicit human action

A hidden page is not an access rule.

The public form accepts a request, but reading the inbox requires an operator session. The server checks the session inside every /api/admin/ route. Someone who knows the endpoint still needs permission.

curl -i http://127.0.0.1:3000/api/admin/enquiries

With no session, the response should be 401 and contain no enquiries. Sign in through the local operator page and inspect the inbox again. The configured password is kept in the server environment. The login form sends the entered password to the server for verification, then receives a random session token in an HttpOnly cookie. In HTTPS deployments that cookie is also Secure.

Read the original, then write the next step.

Prepare a draft, compare it with the original, and add a reviewer note. Mark reviewed only after you have checked it. Reload the inbox to confirm that the note and review state were saved.

The state means reviewed, not sent, quoted, or accepted as a project. This reference has no mail delivery integration. A new draft resets the record to new so an older review cannot silently approve a changed draft.

Know whose permissions the app can express.

This is one operator’s inbox. It does not model separate staff roles or customer organisations. Giving multiple customers the operator password would let them read the same inbox. A customer portal needs a different account and record-ownership design.

For a practical exercise, add a reviewed-by label only after defining who the reviewer is. Do not record a fictional identity just because the database has a field for it. Learn the difference between a display label and authenticated identity.