Module handlers 

One module per admin resource, re-exported flat — mirroring acme_proxy_protocol::handlers, which does the same for the ACME resources.

Every handler here is a few lines over crate::admin::ops and crate::admin::render: this layer decides status codes and shapes, nothing more.

One write, one function, both front ends

Every mutating action lives once, as a pub(crate) async fn apply_* beside its /api handler, and the /ui page calls the same function. It owns everything the action owes: the validation, the write, every audit row and the admin_* log line. The two front ends keep only what really differs: extracting a JSON body or a form, and answering with a status and JSON or a fragment and a banner. [Caller] carries who acted and through which surface.

Spelled out twice, the two copies drifted: one surface logged an action the other did not, or logged it without its surface field. No #[instrument] anywhere in it — the access middleware already opens the request span, and the attribute moves a handler body into a generated async block that reports almost no coverage (see the book’s Testing & Coverage page).

Re-exports

pub use account::*;

pub use accounts::*;

pub use audit::*;

pub use eab::*;

pub use expiring::*;

pub use filter::*;

pub use jobs::*;

pub use mfa::*;

pub use misc::*;

pub use operators::*;

pub use orders::*;

pub use session::*;

pub use upstream_orders::*;

Modules

account

/api/account — the operator’s own account, distinct from /api/mfa’s second factor: the password, and (see sessions) the caller’s own live sessions.

accounts

/api/accounts — the ACME accounts across every mounted endpoint.

audit

/api/audit — the CA’s audit trail, read-only.

eab

/api/eab — External Account Binding credentials.

expiring

/api/expiring — what lapses soon, and whether anything has replaced it.

filter

GET /api/profiles/{name}/filter — one endpoint’s resolved access policy.

jobs

/api/jobs — the background queue across every kind, plus the two operator mutations.

mfa

/api/mfa — enrol, confirm, disable, and reissue recovery codes.

misc

/api/nonces and /api/profiles — the two small read surfaces.

operators

/api/operators — every operator this process has, and acting on one other than the caller: disable, enable, reset their second factor, list and revoke their sessions.

orders

/api/orders — the orders across every mounted endpoint, and revocation.

paging

The shared ?limit=&offset= window and the envelope every list returns.

params

The rule every list filter on this listener shares: a control left at its “any” option is not a filter for the empty string.

session

POST/GET/DELETE /api/session — sign in, whoami, sign out.

upstream_orders

/api/upstream-orders — the relay signer’s per-order upstream state, read-only.