Two account-management features today, plus bugs caught along the way that were worth fixing properly rather than working around.
Modify an Account fills a real gap — until now the only way to change an account after creation was remove-and-recreate. The new edit form covers owner name/email, package, and (admin only) reseller reassignment. The domain itself stays fixed on purpose, since letting it drift from everything keyed to it (DNS, mail, web config) would be a much bigger feature.
Suspend/Unsuspend switches an account’s site over to a shared “account suspended” page instead of touching the account’s real site configuration, so unsuspending just switches it back. Mail and DNS are left untouched, matching how hosting suspensions normally work. Suspended account owners are blocked at the login screen with a clear message; the existing “log in as user” feature still works, so staff can get in to fix things.
Two bugs surfaced during live verification on a development server. First, several recently added privileged actions had not been registered with the validation step that every action passes through, so they failed with “invalid action” when first used. Server Contacts was unaffected because it needs no privileged step. Second, the panel still used the browser’s native confirmation popup for destructive actions outside KNJ Webmail. The webmail’s in-app confirm modal was ported into the main layout and all 24 call sites converted.
Verified live: suspended a real test account, confirmed the suspended page was served, unsuspended it, and confirmed the site was back exactly as it was.
Follow-up: branded pages
The suspended page and the default “Website Coming Soon” page were both still generic placeholders. Both were replaced with branded, self-contained static pages, with the logo embedded so neither depends on the panel being reachable.
Testing them for real surfaced a script regression introduced by a comment-formatting error in an earlier commit, which affected every privileged action, not just the ones being worked on. A syntax check did not catch it, because the result was still valid, just wrong. The fix was confirmed by actually exercising the script rather than only checking syntax, and the file was searched for other occurrences of the same pattern.
Live-verified on a development server: a suspended test domain with a real certificate rendered the branded page over HTTPS, and unsuspending restored the site.