Overall Background

Aivory’s most operational configurations are done on the admin console: upstream channel and model, user and quota, credits and redeem code, moderation, backup migration, usage reports, etc., all stored in the database, after saving is valid for subsequent requests, without the need to restart the service.

The way of entry.

There are two background entrances, each requiring the role of the current account. admin:

The entrance	Explained
The sidebar menu.	Click on the account header in the lower left corner of the chat interface, and the "admin console" item in the menu is visible only to administrators.
direct visits /admin	Enter the browser address bar. https://你的域名/admin It will automatically jump to the System > Global Settings page.

Access to non-administrator accounts /admin The path will be redirected directly to the home page, the page itself will not render, and the corresponding management API will not be called. The Back to Chat button in the upper left corner of the background can be returned to the main interface at any time.

When accessed on the mobile side, the left side navigation is included in the hamburger menu, and after clicking it slides from the left side, the functionality is consistent with the desktop end.

Where did the first manager come from?

When new deployments (0 users) are deployed, access to the site automatically goes to the first-run setup page. /setup The first account created by filling in the mailbox, name, password (at least 8 characters) becomes an administrator and logs in automatically (without mailbox verification). /setup That is, permanent invalidity (returns 409). Operation for the first time。

Navigation structure

The left-hand navigation consists of 6 flat menu items, each aggregating several related pages, and then switching through the secondary tag page at the top of the content zone. The following table lists all pages and their responsibilities:

The menu	Secondary label	The path	duty	The Manual
The system	All set up.	/admin/settings	Default/task/examination model, context compression, registration switch, daily limit, SMTP	Place set up.
The system	Form of registration.	/admin/oauth	OAuth Third-Party Login Provider Configuration	Place set up.
The system	Moderation is	/admin/moderation	Global violation keywords, audit model, intercepting clues	Channel and Model
The system	Announced	/admin/announcement	Announcement for all station users	Place set up.
The system	Backup and Migration	/admin/backup	Complete library backup ZIP, site configuration JSON export/import	Backup and Migration
The model	The channel	/admin/channels	Upstream API channel: Base URL + API Key + Protocol Type	Channel and Model
The model	The model	/admin/models	Creation, launch, capacity, pricing, group quota of the model	Channel and Model
Capacity	Skilled	/admin/skills	Skills packageined by administrators, model loaded as needed	Channel and Model
Capacity	The picture style.	/admin/image-styles	Official style of drawing model.	Images are generated
Capacity	Tools	/admin/tools	Search backend, sandbox address and other tools	The Sandbox Deployment
Capacity	The archive	/admin/documents	embedding model, MinerU analysis, RAG injection parameters, upload limits	The knowledge base
Capacity	The voice	/admin/audio	Speech related arrangements.	Place set up.
The User	The User	/admin/users	Search, numbering, changing roles, reset passwords, blocking, conversation drilling	Users, quota and credits
The User	user group	/admin/user-groups	Member Level: Price, Function, Time Effect Credits	Users, quota and credits
The User	redeem code	/admin/redeem-codes	Mass-generating redeem code, granting user group and validity	Users, quota and credits
The workspace	The workspace	/admin/workspaces	Team Sharing Space Overview and Governance	The workspace
The data	Used quantity	/admin/usage	API call records by line: filtering, errors, deletion	quantity and analysis.
The data	analyzed	/admin/analytics	Overall Usage Trends: Overall, Submodel, Subuser	quantity and analysis.

Several navigation behaviors are described:

• sidebar items and secondary tags are highlighted by a path prefix: go to a deep page (such as a user’s conversation record) /admin/users/:id/conversations or a model page. /admin/models/:id At the same time, the class and label remains high.
• Management page of the model label (/admin/model-tags From the model list or model editing page, enter the "model > model" tag.
• Switching tags only refreshes the content area, while the sidebar and label bar remain unmoving.

Initial configuration line

The shortest configuration path for a new site:

1. Completed /setup first-run setup to get an administrator account.
2. Go to model > channel and add upstream channel (type + Base URL + API Key).
3. Go to model > model, create a model (upstream model ID, name, pricing, power point) under the channel, and appear in the model picker for all users when enabled.
4. Go to System > Global Settings to specify the default conversation model and task model; to use the knowledge base, go to Ability > Document to specify the embedding model.

Detailed steps Channel and Model与Operation for the first time When migrating from an older instance, import the full backup directly from System > Backup & Migration, see Backup and Migration。

Authority model

Role is

Aivory has only two roles stored in the user record. role The field:

Role is	authority
user	Common user: all front-end features such as chat, knowledge base, projects, subscription pages
admin	在 user Add the entire admin console. /api/admin/* Connected

Unlimited number of administrators: You can change the role of any account to an administrator on the User > User page, and you can also specify the role directly when a new user is created. admin The role examination, the front end routing guard is just the first door.

Sex and Self-Protection

• First run setup /setup Available only when the number of users is 0 and the account created automatically becomes the first administrator. /setup Permanently returns 409, and no longer generates an account through it.
• Administrator ** You cannot change your role. ** Role Drawing is disabled when editing your own account, which ensures that the system always has at least one administrator and will not be locked to death by misoperation.
• Administrator ** You cannot block or remove yourself. ** The block and delete button is not available for the user's own line in the user list.

Prohibited real time.

Blocking a user is instantaneously global and does not depend on the token’s expiration:

1. User status is written banned At the same time, the token version number of the user increases;
2. After each request in the middle of the token version number, the old token immediately expires;
3. The user's ongoing generation will be cancelled by the broadcast message, and the streaming response will be discontinued immediately;
4. The refresh token is deleted and no new access token can be exchanged.

The same mechanism is also used in scenarios such as "all sessions are invalid after encryption". Users, quota and credits。

Administrators only read user data.

Administrators can drill from the user list to view any user’s conversation records, projects, knowledge base, and generate libraries (for abuse of screening and workbook support), but these pages ** Do not render any editing, reproducing, or deleting message entries ** View and action are strictly separate in the interface layer, the administrator to send messages can only use their own sessions.

Installation comes into effect immediately.

The content that can be configured in the background (channel API key, model, tool, RAG, storage, etc.) is heat-updated: the next request after saving is newly configured, without the need to restart the container. JWT_SECRET For environmental variables, see Core environmental variables。