API — Administration & platform

Everything that is not a business module: authentication, the control panel, user administration, shared lookups, error pages, file serving, and the public portals. This is the largest group — 225 actions — and AdminController alone accounts for 100 of them.

Ungated endpoints live here

PublicFilesController serves files from object storage with no authentication and no ownership check, and AppsController's 12 actions are unauthenticated by design. See R3-1 and R3-2 in Recommendations.

See Administration module, Authentication and Permissions.

227 actions across 12 controllers

Routing, the permission model, response kinds and error behaviour are described once in the API Overview. Unless a row says otherwise the route is /{Controller}/{Action}, id is a GUID string, and a Details page is a full View while Manage* / Create fragments are PartialViews loaded into a modal.

AccountController

Sign-in and sign-out, the profile, password change, e-signature upload and approval, notifications and contacts.

Source: NKO.Lib/NKO.Shared/Controllers/AccountController.cs · route prefix: /Account · 46 actions · 7 ungated

Route	Verb	Parameters	Permission	Returns
/Account/AddFamilyMember	GET	string id, bool? type	AccountConflict	PartialView
/Account/AddFamilyMember	POST	AppUserFamily model	AccountConflict	JSON
/Account/Attachments	GET	string errM, int? editId	AccountIndex	View
/Account/Conflict	GET	—	AccountIndex	View
/Account/Dashboard	GET	—	AccountIndex	View
/Account/DeleteAttachment	GET	string id	AccountAttachments	PartialView / Redirect
/Account/DeleteAttachment	POST	AppUserAttachment model	AccountAttachments	JSON
/Account/DeleteConflict	GET	int id	AccountConflict	PartialView / Redirect
/Account/DeleteConflict	POST	AppUserRelative model	AccountConflict	PartialView / JSON
/Account/DeleteFamilyMember	GET	int id	AccountConflict	PartialView / Redirect
/Account/DeleteFamilyMember	POST	AppUserFamily model	AccountConflict	PartialView / JSON
/Account/DeleteSign	GET	int id	AccountDeleteSign	PartialView
/Account/DeleteSign	POST	UserCreateSignVM model	AccountDeleteSign	PartialView / JSON
/Account/DeleteTemplate	POST	string id	AccountIndex	JSON
/Account/Details	POST	IFormFile avatar	AccountIndex	Redirect
/Account/DownloadAttachment	GET	string attachmentId	AccountAttachments	Redirect / NotFound
/Account/DownloadTemplate	POST	string id	AccountIndex	Redirect
/Account/Edit	GET	—	AccountEdit	View
/Account/Edit	POST	CustomUserEditModel Model, IFormFile file, List<string> Langauges	AccountEdit	View
/Account/EditFamilyMember	GET	int id	AccountConflict	PartialView
/Account/EditFamilyMember	POST	AppUserFamily model	AccountConflict	JSON
/Account/EmployeeInformation	GET	—	AccountIndex	View
/Account/IdentityConfirm	GET	bool usingPin	AccountIndex	PartialView / JSON
/Account/IdentityConfirm	POST	IdentityConfirmVM model	AccountIndex	JSON
/Account	GET	string id	AccountIndex	View
/Account/GetUserClaims	GET	string userId	— open	List<Claim> — internal helper, unintentionally routable
/Account/Login	GET	string returnUrl	— open	View
/Account/Login	POST	LoginModel login, string returnUrl	— open	View / Redirect
/Account/ManageAttachment	GET	int? t	AccountAttachments	Redirect
/Account/ManageAttachment	POST	AppUserAttachment Model	AccountAttachments	Redirect
/Account/ManageConflict	GET	string u, int? t	AccountConflict	PartialView
/Account/ManageConflict	POST	AppUserRelative Model	AccountConflict	PartialView / JSON
/Account/ManageEmails	POST	UpdatePasswordViewModel model	AccountChangePassword	Redirect
/Account/ManagePin	POST	UpdatePasswordViewModel model	AccountChangePassword	View / Redirect / BadRequest
/Account/ManageSign	GET	int? signId	AccountManageSign	Redirect
/Account/ManageSign	POST	UserCreateSignVM model	AccountManageSign	Redirect
/Account/LogOut	GET	—	— open	Signs the caller out, redirects to /
/Account/Notifications	GET	—	— open	View
/Account/Security	GET	string message, bool success	AccountChangePassword	View
/Account/Security	POST	UpdatePasswordViewModel model	AccountChangePassword	View
/Account/SignIn	GET	ApplicationUser user, string pass	— open	Task — internal helper that calls PasswordSignInAsync; unintentionally routable, see R3-7
/Account/SignOut	GET	—	— open	Task — internal helper, unintentionally routable
/Account/Signatures	GET	string id, int? signId, string msg, string success	AccountSignatures	View
/Account/UploadSign	POST	—	AccountIndex	JSON
/Account/UploadTemplate	POST	—	AccountIndex	JSON
/Account/ViewAccount	GET	—	AccountIndex	View

AdminController

The control panel — permission groups and keys, the org structure (branches, departments, positions, levels, teams), reference data, donors, the work calendar, general settings, announcements and the audit history. The largest controller in the solution.

Source: NKO.Main/NKO.Main/Controllers/AdminController.cs · route prefix: /Admin · 100 actions · 1 ungated

Route	Verb	Parameters	Permission	Returns
/Admin/AddAttachment	POST	AppUserPosition appuserposition, IFormFile file1	AdminAddUserPosition	View
/Admin/AddCalenderConfiguration	GET	—	AdminAnnouncement	PartialView
/Admin/AddCalenderConfiguration	POST	CalenderConfiguration model	AdminAnnouncement	PartialView / JSON
/Admin/AddCategory	GET	—	ProjectCategory	PartialView
/Admin/AddCategory	POST	BudgetLinesCategory Model	ProjectCategory	PartialView / JSON
/Admin/AddDepartment	GET	—	AdminAddUserTeam	View
/Admin/AddDepartment	POST	CommonDepartment appuserTeam	AdminAddUserTeam	View / JSON
/Admin/AddDonor	GET	—	AdminAddUserTeam	View
/Admin/AddDonor	POST	Donor appuserTeam	AdminAddUserTeam	JSON
/Admin/AddLevel	GET	—	AdminAddUserTeam	View
/Admin/AddLevel	GET	PositionLevel levelTeam	AdminAddUserTeam	JSON
/Admin/AddProgram	GET	—	AdminAnnouncement	View
/Admin/AddProgram	POST	CommonProgram model	AdminAnnouncement	View / JSON
/Admin/AddSpecialHoliday	GET	—	AdminAnnouncement	PartialView
/Admin/AddSpecialHoliday	POST	SpecialHoliday model, List<int> CalenderProfileIds	AdminAnnouncement	PartialView / JSON
/Admin/AddUserGroup	GET	string type	AdminAddUserGroup	PartialView
/Admin/AddUserGroup	GET	AppUserGroup appusergroup, string type	AdminAddUserGroup	JSON
/Admin/AddUserPosition	GET	—	AdminAddUserPosition	View
/Admin/AddUserPosition	POST	AppUserPosition appuserposition	AdminAddUserPosition	JSON
/Admin/Announcement	GET	string id, string editMessage	AdminAnnouncement	View
/Admin/Announcement	POST	Announcements Model, List<int> BranchList, List<int> SubBranchList, List<int> LevelList, bool isScheduled	AdminAnnouncement	View / Redirect
/Admin/CalenderConfigurations	GET	int id, string sortOrder, string currentFilter, string searchString, int? page	AdminAnnouncement	View
/Admin/Categories	GET	int? page	AdminCategories	View
/Admin/CopyProfile	GET	int id	— open	Redirect
/Admin/DeleteAnnouncement	GET	string id	AdminDeleteAnnouncement	Redirect
/Admin/DeleteAttachment	GET	string id	AdminAddUserPosition	Redirect
/Admin/DeleteBranch	GET	int id	AdminIndex	PartialView
/Admin/DeleteBranch	GET	BranchDeleteVM branchVM	AdminIndex	JSON
/Admin/DeleteCalenderConfiguration	GET	string id	AdminAnnouncement	View / Redirect
/Admin/DeleteCalenderConfiguration	POST	int? CalenderConfigId	AdminAnnouncement	PartialView / JSON
/Admin/DeleteCategory	GET	int id	ProjectCategory	PartialView
/Admin/DeleteCategory	POST	BudgetLinesCategory model	ProjectCategory	PartialView / JSON
/Admin/DeleteDepartment	GET	int id	AdminManageTeam	PartialView / Redirect
/Admin/DeleteDepartment	POST	CommonDepartment model	AdminManageTeam	PartialView / JSON
/Admin/DeleteDonor	GET	int id	AdminManageTeam	PartialView / Redirect
/Admin/DeleteDonor	POST	Donor model	AdminManageTeam	PartialView / JSON
/Admin/DeletePosition	GET	int id	AdminManageTeam	PartialView / Redirect
/Admin/DeletePosition	POST	AppUserPosition model	AdminManageTeam	PartialView / JSON
/Admin/DeletePositionQuestion	GET	int id	AdminManageTeam	PartialView / Redirect
/Admin/DeletePositionQuestion	POST	PositionQuestionsIndexVM model	AdminManageTeam	PartialView / JSON
/Admin/DeleteProfile	GET	int id	AdminAnnouncement	PartialView / JSON
/Admin/DeleteProfile	POST	CalendarProfile model	AdminAnnouncement	PartialView / JSON
/Admin/DeleteProgram	GET	int id	AdminManageTeam	PartialView / Redirect
/Admin/DeleteProgram	POST	CommonProgram model	AdminManageTeam	PartialView / JSON
/Admin/DeleteSpecialHoliday	GET	string id	AdminAnnouncement	PartialView / JSON
/Admin/DeleteSpecialHoliday	POST	SpecialHoliday specialHoliday	AdminAnnouncement	PartialView / JSON
/Admin/DeleteSubLocation	GET	int id	AdminManageTeam	PartialView
/Admin/DeleteSubLocation	POST	CommonSubBranch Model	AdminManageTeam	PartialView / JSON
/Admin/Departments	GET	string sortOrder, string currentFilter, string searchString, int? page	AdminDepartments	View
/Admin/Donors	GET	string sortOrder, string currentFilter, string searchString, int? page	AdminDonors	View
/Admin/EditBranch	GET	int id	AdminIndex	PartialView
/Admin/EditBranch	POST	CommonBranch Model	AdminIndex	PartialView / JSON
/Admin/EditCalenderConfiguration	GET	int id	AdminAnnouncement	PartialView / JSON
/Admin/EditCalenderConfiguration	POST	CalenderConfiguration model	AdminAnnouncement	PartialView / JSON
/Admin/EditCategory	GET	int? id	ProjectCategory	PartialView / Redirect
/Admin/EditCategory	POST	BudgetLinesCategory category	ProjectCategory	PartialView / JSON
/Admin/EditLevel	GET	int id	AdminAnnouncement	PartialView / JSON
/Admin/EditLevel	POST	PositionLevel model	AdminAnnouncement	JSON
/Admin/EditProgram	GET	int id, string editMessage	AdminAnnouncement	View
/Admin/EditProgram	POST	CommonProgram committee	AdminAnnouncement	View / JSON
/Admin/EditSpecialHoliday	GET	int id	AdminAnnouncement	PartialView / JSON
/Admin/EditSpecialHoliday	POST	SpecialHoliday model, List<int> CalenderProfileIds	AdminAnnouncement	PartialView / JSON
/Admin/EditUserPosition	GET	int id	AdminAddUserPosition	View
/Admin/EditUserPosition	POST	AppUserPosition appuserposition	AdminAddUserPosition	JSON
/Admin/GeneralSettings	GET	string id, string editMessage	AdminGeneralSettings	View
/Admin/GeneralSettings	POST	GeneralSettingVM Model	AdminGeneralSettings	View
/Admin/History	GET	List<int> exeptUserIds, int? userId, int? page, bool? isLogin, int? method, int? system, string content, string fromDate, string toDate, bool isExport	AdminAnnouncement	View / JSON
/Admin	GET	—	AdminIndex	View
/Admin/Levels	GET	string sortOrder, string currentFilter, string searchString, int? page	AdminLevels	View
/Admin/Locations	GET	string sortOrder, string currentFilter, string searchString, int? page	AdminLocations	View
/Admin/ManageDepartment	GET	int? id	AdminManageTeam	PartialView
/Admin/ManageDepartment	POST	CommonDepartment Model	AdminManageTeam	PartialView / JSON
/Admin/ManageDonor	GET	int? id	AdminManageTeam	PartialView
/Admin/ManageDonor	POST	Donor Model	AdminManageTeam	JSON
/Admin/ManageProfile	GET	int? id	AdminAnnouncement	PartialView
/Admin/ManageProfile	POST	CalendarProfile Model	AdminAnnouncement	PartialView / JSON
/Admin/ManageSubLocation	GET	int branchId, int? id	AdminManageTeam	PartialView
/Admin/ManageSubLocation	POST	CommonSubBranch Model	AdminManageTeam	JSON
/Admin/ManagerPositionQuestion	GET	int positionId, int? id	AdminAddUserPosition	View
/Admin/ManagerPositionQuestion	POST	PositionQuestionsIndexVM model	AdminAddUserPosition	View / JSON
/Admin/PendingRequests	GET	int id, int? page	AdminIndex	View
/Admin/PendingRequests	POST	int id, int to, int? page	AdminIndex	View
/Admin/PositionAttachments	GET	int id	AdminUserPositions	View
/Admin/PositionQuestions	GET	int positionId	AdminAddUserPosition	View
/Admin/Profiles	GET	int id	AdminIndex	View
/Admin/Programs	GET	int? page	AdminPrograms	View
/Admin/RunNextUserService	GET	RequestTypes? type	AdminIndex	JSON
/Admin/SpecialHolidays	GET	List<int> years, List<int> profiles, string sortOrder, int? page	AdminAnnouncement	View
/Admin/Steps	GET	int id, int profile, string sortOrder, string currentFilter, string searchString, int? page	AdminUserTeams	View
/Admin/SubLocations	GET	int id, string sortOrder, string currentFilter, string searchString, int? page	AdminLocations	View
/Admin/TriggerNextUser	GET	—	AdminIndex	View
/Admin/UploadFiles	POST	int id	AdminAddUserPosition	JSON
/Admin/UserGroupEdit	GET	int id	AdminUserGroupEdit	View / Redirect
/Admin/UserGroupEdit	POST	List<UserPermisions> Model, List<int> selectedPermissions, int id	AdminUserGroupEdit	Redirect
/Admin/UserGroupUsers	GET	int? page, List<int> isInGroup, string AllFalseHidden, string sortOrder, string currentFilter, string searchString, string search_param, int id	UserUserGroupUsers	View
/Admin/UserGroups	GET	string sortOrder, string currentFilter, string searchString, int? page	AdminUserGroups	View
/Admin/UserPermissionsEdit	GET	int id, int? page, int? userId, int? selectedPermission	AdminUserGroupEdit	View / Redirect
/Admin/UserPermissionsEdit	POST	List<SharedPermissionVM> Model, int id	AdminUserGroupEdit	Redirect
/Admin/UserPositions	GET	string sortOrder, string currentFilter, string searchString	AdminUserPositions	View
/Admin/UserSharedPermissions	GET	string sortOrder, string currentFilter, string searchString, int? page	AdminUserGroups	View

UserController

User administration: linking an employee to a login, group membership and per-user permission and data-scope assignment.

Source: NKO.Main/NKO.Main/Controllers/UserController.cs · route prefix: /User · 19 actions · 0 ungated

Route	Verb	Parameters	Permission	Returns
/User/Dashboard	GET	string id	UserDashboard	View
/User/DisablePinCode	GET	string userId	UserManageGroupMember	Redirect
/User/Edit	GET	string id, string newPassword, string msg	UserEdit	View
/User/Edit	POST	EditUserViewModel model, string id	UserEdit	View
/User/GeneratePassword	GET	string UserGuid, int type	UserManageGroupMember	Redirect
/User/History	GET	string id, int? page	UserIndex	View
/User	GET	string sortOrder, string currentFilter, int? filterBranch, string searchString, int? page, int loginStatus, string currentType, int? currentEnabledFilter, int? enabledFilter, int? userFilter, int activeStatus, int? filterSubBranch, bool? signFilter, int? memberShip, int? managerId	UserIndex	View
/User/ManageGroupMember	GET	string u, int? g	UserManageGroupMember	PartialView
/User/ManageGroupMember	POST	AppUserGroupMember Model	UserManageGroupMember	PartialView / JSON
/User/ManagePermission	GET	string u, int? t	UserManagePermission	PartialView
/User/ManagePermission	POST	AppUserProjectPermission Model	UserManagePermission	PartialView / JSON
/User/Membership	GET	string id	UserMembership	View / Redirect
/User/Membership	POST	UserGeneralPermisions Model, List<int> selectedPermissions, List<int> selectedLeavePermissions, string id	UserMembership	View
/User/Navigation	GET	string id, string side, string currentPage	UserIndex	View / Redirect
/User/Permission	GET	string id	UserPermission	View
/User/Security	GET	string id	UserChangePassword	View
/User/Security	POST	ResetPasswordViewModel model	UserChangePassword	View
/User/UpdateUser	GET	int? page	UserUpdatedUser	View
/User/ViewUser	GET	string id	UserViewUser	View

HomeController

The dashboard and announcements landing page.

Source: NKO.Main/NKO.Main/Controllers/HomeController.cs · route prefix: /Home · 4 actions

Route	Verb	Parameters	Permission	Returns
/Home/Announcement	GET	string id	HomeAnnouncement	View / Redirect
/Home/Edit	POST	int type	HomeAnnouncement	Redirect
/Home	GET	int? SubBranchId, string msg	HomeIndex	View
/Home/IndexTest	GET	string msg	HomeIndex	View

GeneralController

Cross-cutting lookups used by many screens (contacts, org chart data, file helpers).

Source: NKO.Main/NKO.Main/Controllers/GeneralController.cs · route prefix: /General · 7 actions · 2 ungated

Route	Verb	Parameters	Permission	Returns
/General/Contact	GET	int? page, string search, string sortOrder	HomeIndex	View
/General/Departments	GET	—	HomeIndex	View
/General/DepartmentsOrg	GET	—	HomeIndex	View
/General/DepartmentsOrgData	GET	—	HomeIndex	JSON
/General/FileToBase64	GET	IFormFile image	— open	string
/General/FillDepartmentsOrg	GET	List<CommonDepartment> deps	— open	List<DepartmentOrg> — internal helper, unintentionally routable
/General/Media	GET	int? page, string search, string sortOrder	HomeIndex	View

CommonController

Shared endpoints — the notification list and the notification redirect that resolves a record to its detail screen.

Source: NKO.Lib/NKO.Shared/Controllers/CommonController.cs · route prefix: /Common · 5 actions · 1 ungated

Route	Verb	Parameters	Permission	Returns
/Common/Notification	GET	bool? isRead	HomeIndex	View
/Common/PendingRequest	GET	—	HomeIndex	View
/Common/ReadAllNotifications	GET	—	HomeIndex	JSON
/Common/ReadNotification	GET	string id	HomeIndex	Redirect
/Common/Redirect	GET	string id, int? t	— open	Redirect

CultureController

Language switching (ar / en).

Source: NKO.Lib/NKO.Shared/Controllers/CultureController.cs · route prefix: /Culture · 1 actions · 1 ungated

Route	Verb	Parameters	Permission	Returns
/Culture/SetLanguage	GET	string culture, string returnUrl	— open	IActionResult

ErrorController

The generic error page and the UnAuthorised page that a failed permission check redirects to.

Source: NKO.Main/NKO.Main/Controllers/ErrorController.cs · route prefix: /Error · 3 actions

Route	Verb	Parameters	Permission	Returns
/Error/HttpError404	GET	—	General	View
/Error	GET	—	General	View
/Error/UnAuthorised	GET	—	[Authorize]	View

BaseController

Shared lookups and helpers reachable as /Base/* — cascading dropdowns, comments, notes and attachment helpers used across modules.

Source: NKO.Main/NKO.Main/Controllers/BaseController.cs · route prefix: /Base · 24 actions

Route	Verb	Parameters	Permission	Returns
/Base/AllEmployees	GET	string search	General	JSON
/Base/AllEmployeesWithIntId	GET	string search	General	JSON
/Base/Banks	GET	string search	[Authorize]	JSON
/Base/Countries	GET	string search	General	JSON
/Base/Departments	GET	string search	General	JSON
/Base/Download	GET	string filePath, AttachFileTypes type, int? subType, int? user	General	Redirect
/Base/DownloadAttachment	GET	string filePath	[Authorize]	Redirect
/Base/DraftEmployees	GET	string search	General	JSON
/Base/Employees	GET	string search	General	JSON
/Base/EmployeesWithIntGenId	GET	string search	General	JSON
/Base/EmployeesWithIntId	GET	string search	General	JSON
/Base/Error404	GET	—	General	View
/Base/GetGoverList	GET	int id	[Authorize]	JSON
/Base/GetImage	GET	int id	[Authorize]	File
/Base/GetSteps	GET	int id, int profile	General	JSON
/Base/GetSubBranches	GET	string branchId	General	JSON
/Base/GetSubBranchesByBranchIds	GET	string branchIds	[Authorize]	JSON
/Base/GetTowns	GET	int id	[Authorize]	JSON
/Base/InactiveEmployees	GET	string search	General	JSON
/Base/Nationalities	GET	string search	General	JSON
/Base/Positions	GET	string search	General	JSON
/Base/SearchHRStaff	GET	string search	General	JSON
/Base/Thumbnail	GET	int width, int height, int id	General	File
/Base/Upload	POST	List<IFormFile> files	AccountIndex	JSON

FilesController

File download and inline viewing from object storage, plus the e-signature template. [Authorize] at class level.

Source: NKO.Lib/NKO.Shared/Controllers/FilesController.cs · route prefix: /Files · 4 actions

Route	Verb	Parameters	Permission	Returns
/api/attachments/{id}	GET	string id, string name	[Authorize] (class)	File / NotFound
/Files/DownloadTemplate	GET	—	[Authorize] (class)	File
/Files/GetFileByFilePath	GET	string id	General	File
/api/viewattachments/{id}	GET	string id	[Authorize] (class)	File / NotFound

PublicFilesController

A second, ungated file controller in the same source file. See R3-1 in Recommendations.

Source: NKO.Lib/NKO.Shared/Controllers/FilesController.cs · route prefix: /PublicFiles · 2 actions · 2 ungated

Route	Verb	Parameters	Permission	Returns
/api/pubattachments/{id}	GET	string id, string name	— open	File / NotFound
/api/viewpubattachments/{id}	GET	string id	— open	File / NotFound

AppsController

The public, unauthenticated portals: job application, applicant reference forms and supplier quotation submission. These write Applicants and RFQProvider* rows without a session.

Source: NKO.Main/NKO.Main/Controllers/AppsController.cs · route prefix: /Apps · 12 actions · 12 ungated

Route	Verb	Parameters	Permission	Returns
/Apps/Apply	GET	string id	— open	View / Redirect
/Apps/Apply	POST	ProviderModel2 model, CancellationToken cancellationToken, int? exportType	— open	View / Redirect
/Apps/ApplyJob	GET	string id	— open	View / Redirect
/Apps/ApplyJob	POST	ApplicantModel model, CancellationToken cancellationToken, IFormFile cv, IFormFile coverLetter, IFormFile portfolio	— open	View / Redirect
/Apps/ApplyReference	GET	string id	— open	View / Redirect
/Apps/ApplyReference	POST	ReferenceModel model, CancellationToken cancellationToken, IFormFile cv, IFormFile coverLetter, IFormFile portfolio	— open	View
/Apps/Complete	GET	—	— open	View
/Apps/CompleteJob	GET	ApplicantModel model	— open	View
/Apps/Download	GET	string filePath, Enums.AttachFileTypes type, int? subType, int? user	— open	Redirect
/Apps/Export	POST	ProviderModel model	— open	Task<ActionResult>
/Apps/Unfound	GET	—	— open	View
/Apps/ValidateDateEqualOrGreater	POST	DateTime Date	— open	JSON

View components — not endpoints

SidebarViewComponent and TopbarViewComponent live alongside the controllers in NKO.Lib/NKO.Shared/Controllers/, but both derive from ViewComponent, not Controller. Their InvokeAsync() methods are invoked from a Razor layout (@await Component.InvokeAsync("Sidebar")), not over HTTP — there is no /SidebarViewComponent/InvokeAsync route, and an earlier revision of this page listed one in error. They are excluded from the action counts above.

Component	Source	Renders
SidebarViewComponent	NKO.Lib/NKO.Shared/Controllers/SidebarViewComponent.cs	Never invoked — no layout or view calls it, so it renders nothing. Dead code, like Views/Base/SidebarUserPanel.cshtml.
TopbarViewComponent	NKO.Lib/NKO.Shared/Controllers/TopbarViewComponent.cs	The top bar — notifications, language and the profile menu.

Their [ClaimRequirement("General")] attribute does nothing

Both InvokeAsync methods carry [ClaimRequirement("General")]. ClaimRequirementFilter is an IAsyncAuthorizationFilter, and MVC does not run the authorization filter pipeline for view component invocation — the attribute is inert. It is harmless here (the components only render inside an already-authorized page) but should not be read as a security control.

Related

• Administration module
• Authentication
• Permissions
• Administration database
• API Overview — routing, auth, responses and error behaviour.