// apps/api/src/common/guards/platform-admin.guard.ts
import { Injectable, CanActivate, ExecutionContext, ForbiddenException } from '@nestjs/common';
import { UseGuards } from '@nestjs/common';

@Injectable()
export class PlatformAdminGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const user = request.user;

    if (!user) {
      throw new ForbiddenException('Authentication required');
    }

    if (user.systemRole !== 'SYSTEM_ADMIN') {
      throw new ForbiddenException('Platform Admin access required');
    }

    return true;
  }
}

// Decorator for cleaner usage
export const PlatformAdminOnly = () => UseGuards(PlatformAdminGuard);

import { Controller, Get, Post, Patch, Param, Query, Body } from '@nestjs/common';
import { PlatformAdminOnly } from '@/common/guards/platform-admin.guard';
import { AdminTenantService } from './admin-tenant.service';
import { CreateTenantDto, UpdateTenantDto, PaginationDto } from './dto';

@Controller('api/v1/admin/tenants')
@PlatformAdminOnly()
export class AdminTenantController {
  constructor(private readonly tenantService: AdminTenantService) {}

  @Post()
  async createTenant(@Body() dto: CreateTenantDto) {
    return this.tenantService.create(dto);
  }

  @Get()
  async listTenants(@Query() query: PaginationDto) {
    return this.tenantService.findAll(query);
  }

  @Get(':id')
  async getTenant(@Param('id') id: string) {
    return this.tenantService.findById(id);
  }

  @Patch(':id')
  async updateTenant(
    @Param('id') id: string,
    @Body() dto: UpdateTenantDto
  ) {
    return this.tenantService.update(id, dto);
  }
}

@Post(':id/assign-admin')
async assignAdmin(
  @Param('id') tenantId: string,
  @Body() dto: AssignAdminDto
) {
  return this.tenantService.assignAdmin(tenantId, dto);
}

async assignAdmin(tenantId: string, dto: AssignAdminDto) {
  // Verify tenant exists
  const tenant = await this.prisma.tenant.findUnique({
    where: { id: tenantId },
  });

  if (!tenant) {
    throw new NotFoundException('Tenant not found');
  }

  // Check if email already exists
  const existingUser = await this.prisma.user.findUnique({
    where: { email: dto.email },
  });

  if (existingUser) {
    throw new ConflictException('User with this email already exists');
  }

  // Create user with HR_ADMIN role (no password - forces password reset)
  const user = await this.prisma.user.create({
    data: {
      email: dto.email,
      name: dto.name,
      tenantId: tenantId,
      systemRole: 'HR_ADMIN',
      // password is null - user must use forgot-password flow
    },
  });

  return {
    id: user.id,
    email: user.email,
    name: user.name,
    role: user.systemRole,
    tenantId: user.tenantId,
  };
}

// assign-admin.dto.ts
import { z } from 'zod';

export const assignAdminSchema = z.object({
  email: z.string().email(),
  name: z.string().min(1).max(100),
});

export type AssignAdminDto = z.infer<typeof assignAdminSchema>;

// apps/web/src/components/layout/Sidebar.tsx

// Add admin navigation items
const adminNavItems = [
  { href: '/admin/tenants', label: 'Tenants', icon: Building2 },
  // Future: { href: '/admin/analytics', label: 'Analytics', icon: BarChart },
  // Future: { href: '/admin/settings', label: 'Settings', icon: Settings },
];

// In sidebar component
{user?.systemRole === 'SYSTEM_ADMIN' && (
  <div className="mt-6 pt-6 border-t border-border">
    <p className="px-3 mb-2 text-xs font-semibold text-muted-foreground uppercase tracking-wider">
      Platform Admin
    </p>
    <nav className="space-y-1">
      {adminNavItems.map((item) => (
        <SidebarLink
          key={item.href}
          href={item.href}
          icon={item.icon}
        >
          {item.label}
        </SidebarLink>
      ))}
    </nav>
  </div>
)}

// apps/web/src/app/(dashboard)/admin/tenants/page.tsx
export default function TenantsPage() {
  const { data, isLoading } = useQuery({
    queryKey: ['admin', 'tenants'],
    queryFn: () => fetchAdminTenants(),
  });

  return (
    <div className="space-y-6">
      <div className="flex items-center justify-between">
        <h1 className="text-2xl font-bold">Tenants</h1>
        <Button asChild>
          <Link href="/admin/tenants/new">Create Tenant</Link>
        </Button>
      </div>

      <ContentCard>
        <Table>
          <TableHeader>
            <TableRow>
              <TableHead>Name</TableHead>
              <TableHead>Status</TableHead>
              <TableHead>Users</TableHead>
              <TableHead>Created</TableHead>
              <TableHead></TableHead>
            </TableRow>
          </TableHeader>
          <TableBody>
            {data?.data.map((tenant) => (
              <TableRow key={tenant.id}>
                <TableCell>{tenant.name}</TableCell>
                <TableCell>
                  <Badge variant={statusVariant(tenant.status)}>
                    {tenant.status}
                  </Badge>
                </TableCell>
                <TableCell>{tenant.userCount}</TableCell>
                <TableCell>{formatDate(tenant.createdAt)}</TableCell>
                <TableCell>
                  <Button variant="ghost" size="sm" asChild>
                    <Link href={`/admin/tenants/${tenant.id}`}>View</Link>
                  </Button>
                </TableCell>
              </TableRow>
            ))}
          </TableBody>
        </Table>
      </ContentCard>
    </div>
  );
}

// apps/web/src/app/(dashboard)/admin/tenants/new/page.tsx
export default function CreateTenantPage() {
  const router = useRouter();
  const mutation = useMutation({
    mutationFn: createTenant,
    onSuccess: (data) => {
      toast.success('Tenant created successfully');
      router.push(`/admin/tenants/${data.id}`);
    },
  });

  return (
    <div className="max-w-2xl space-y-6">
      <h1 className="text-2xl font-bold">Create Tenant</h1>

      <ContentCard>
        <form onSubmit={handleSubmit}>
          <div className="space-y-4">
            <div>
              <Label htmlFor="name">Organization Name</Label>
              <Input id="name" {...register('name')} />
            </div>
            <div>
              <Label htmlFor="status">Status</Label>
              <Select {...register('status')}>
                <SelectItem value="TRIAL">Trial</SelectItem>
                <SelectItem value="ACTIVE">Active</SelectItem>
              </Select>
            </div>
          </div>
          <div className="mt-6 flex justify-end gap-3">
            <Button variant="outline" type="button" onClick={() => router.back()}>
              Cancel
            </Button>
            <Button type="submit" disabled={mutation.isPending}>
              Create Tenant
            </Button>
          </div>
        </form>
      </ContentCard>
    </div>
  );
}

// apps/web/src/app/(dashboard)/admin/tenants/[id]/page.tsx
'use client';

import { use } from 'react';

export default function TenantDetailPage({
  params,
}: {
  params: Promise<{ id: string }>;
}) {
  // Next.js 15: params is a Promise, use React.use() to unwrap
  const { id } = use(params);

  const { data: tenant } = useQuery({
    queryKey: ['admin', 'tenants', id],
    queryFn: () => fetchAdminTenant(id),
  });

  return (
    <div className="space-y-6">
      <div className="flex items-center justify-between">
        <h1 className="text-2xl font-bold">{tenant?.name}</h1>
        <AssignAdminDialog tenantId={id} />
      </div>

      {/* Tenant info card */}
      <ContentCard>
        <dl className="grid grid-cols-2 gap-4">
          <div>
            <dt className="text-sm text-muted-foreground">Status</dt>
            <dd><Badge>{tenant?.status}</Badge></dd>
          </div>
          <div>
            <dt className="text-sm text-muted-foreground">Created</dt>
            <dd>{formatDate(tenant?.createdAt)}</dd>
          </div>
          <div>
            <dt className="text-sm text-muted-foreground">Users</dt>
            <dd>{tenant?.userCount}</dd>
          </div>
        </dl>
      </ContentCard>

      {/* Users in tenant */}
      <ContentCard>
        <h2 className="text-lg font-semibold mb-4">Users</h2>
        <TenantUsersList tenantId={id} />
      </ContentCard>
    </div>
  );
}

// apps/web/src/components/admin/AssignAdminDialog.tsx
export function AssignAdminDialog({ tenantId }: { tenantId: string }) {
  const [open, setOpen] = useState(false);

  const mutation = useMutation({
    mutationFn: (data: AssignAdminDto) => assignAdmin(tenantId, data),
    onSuccess: () => {
      toast.success(
        'Admin created successfully',
        { description: 'They should use "Forgot Password" to set their password.' }
      );
      setOpen(false);
    },
    onError: (error) => {
      toast.error('Failed to assign admin', { description: error.message });
    },
  });

  return (
    <Dialog open={open} onOpenChange={setOpen}>
      <DialogTrigger asChild>
        <Button>Assign Admin</Button>
      </DialogTrigger>
      <DialogContent>
        <DialogHeader>
          <DialogTitle>Assign Tenant Admin</DialogTitle>
          <DialogDescription>
            Create a new admin user for this tenant. They will need to use
            "Forgot Password" to set their password on first login.
          </DialogDescription>
        </DialogHeader>

        <form onSubmit={handleSubmit}>
          <div className="space-y-4">
            <div>
              <Label htmlFor="email">Email</Label>
              <Input
                id="email"
                type="email"
                placeholder="admin@company.com"
                {...register('email')}
              />
            </div>
            <div>
              <Label htmlFor="name">Full Name</Label>
              <Input
                id="name"
                placeholder="John Doe"
                {...register('name')}
              />
            </div>
          </div>

          <DialogFooter className="mt-6">
            <Button variant="outline" type="button" onClick={() => setOpen(false)}>
              Cancel
            </Button>
            <Button type="submit" disabled={mutation.isPending}>
              {mutation.isPending ? 'Creating...' : 'Create Admin'}
            </Button>
          </DialogFooter>
        </form>
      </DialogContent>
    </Dialog>
  );
}

model TenantDomain {
  id        String   @id @default(cuid())
  tenantId  String
  domain    String   @unique  // e.g., "capptoo.com"
  verified  Boolean  @default(false)
  isPrimary Boolean  @default(false)
  createdAt DateTime @default(now())

  tenant    Tenant   @relation(fields: [tenantId], references: [id], onDelete: Cascade)

  @@index([tenantId])
  @@map("tenant_domains")
}

model Tenant {
  // ... existing fields
  domains   TenantDomain[]
}

// GET /api/v1/admin/tenants/:id/domains
@Get(':id/domains')
async listDomains(@Param('id') tenantId: string) {
  return this.tenantService.listDomains(tenantId);
}

// POST /api/v1/admin/tenants/:id/domains
@Post(':id/domains')
async addDomain(
  @Param('id') tenantId: string,
  @Body() dto: AddDomainDto
) {
  return this.tenantService.addDomain(tenantId, dto);
}

// DELETE /api/v1/admin/tenants/:id/domains/:domainId
@Delete(':id/domains/:domainId')
async removeDomain(
  @Param('id') tenantId: string,
  @Param('domainId') domainId: string
) {
  return this.tenantService.removeDomain(tenantId, domainId);
}

// PATCH /api/v1/admin/tenants/:id/domains/:domainId
@Patch(':id/domains/:domainId')
async updateDomain(
  @Param('id') tenantId: string,
  @Param('domainId') domainId: string,
  @Body() dto: UpdateDomainDto
) {
  return this.tenantService.updateDomain(tenantId, domainId, dto);
}

// add-domain.dto.ts
export class AddDomainDto {
  @IsString()
  @Matches(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/)
  domain: string;

  @IsOptional()
  @IsBoolean()
  isPrimary?: boolean;
}

// update-domain.dto.ts
export class UpdateDomainDto {
  @IsOptional()
  @IsBoolean()
  isPrimary?: boolean;
}

async addDomain(tenantId: string, dto: AddDomainDto) {
  // Verify tenant exists
  await this.findById(tenantId);

  // Normalize domain (lowercase)
  const normalizedDomain = dto.domain.toLowerCase();

  // Check if domain already claimed
  const existing = await this.prisma.tenantDomain.findUnique({
    where: { domain: normalizedDomain },
  });

  if (existing) {
    throw new ConflictException(`Domain ${normalizedDomain} is already registered`);
  }

  // If setting as primary, unset other primary domains
  if (dto.isPrimary) {
    await this.prisma.tenantDomain.updateMany({
      where: { tenantId, isPrimary: true },
      data: { isPrimary: false },
    });
  }

  return this.prisma.tenantDomain.create({
    data: {
      tenantId,
      domain: normalizedDomain,
      isPrimary: dto.isPrimary ?? false,
    },
  });
}

async removeDomain(tenantId: string, domainId: string) {
  const domain = await this.prisma.tenantDomain.findFirst({
    where: { id: domainId, tenantId },
  });

  if (!domain) {
    throw new NotFoundException('Domain not found');
  }

  // Check if this is the last domain and tenant has users
  const [domainCount, userCount] = await Promise.all([
    this.prisma.tenantDomain.count({ where: { tenantId } }),
    this.prisma.user.count({ where: { tenantId } }),
  ]);

  if (domainCount === 1 && userCount > 0) {
    throw new BadRequestException('Cannot remove the last domain when tenant has users');
  }

  return this.prisma.tenantDomain.delete({
    where: { id: domainId },
  });
}

events: {
  async createUser({ user }) {
    const emailDomain = user.email?.split('@')[1]?.toLowerCase();

    if (!emailDomain) {
      // Delete the user record that was just created
      await prisma.user.delete({ where: { id: user.id } });
      throw new Error('Invalid email address');
    }

    // Check if domain is linked to an existing tenant
    const tenantDomain = await prisma.tenantDomain.findUnique({
      where: { domain: emailDomain },
      include: { tenant: true },
    });

    if (!tenantDomain) {
      // REJECT - Enterprise only mode
      // Delete the user record that was just created
      await prisma.user.delete({ where: { id: user.id } });
      throw new Error(
        'Registration not allowed. Your email domain is not registered with any organization. ' +
        'Please contact your administrator.'
      );
    }

    // Join existing tenant as EMPLOYEE
    await prisma.user.update({
      where: { id: user.id },
      data: {
        tenantId: tenantDomain.tenantId,
        systemRole: 'EMPLOYEE',
      },
    });
  },
}

// apps/web/src/app/auth/signin/page.tsx
// Handle the error message from registration rejection
const searchParams = useSearchParams();
const error = searchParams.get('error');

{error === 'Registration not allowed' && (
  <Alert variant="destructive">
    <AlertTitle>Registration Not Allowed</AlertTitle>
    <AlertDescription>
      Your email domain is not registered with any organization.
      Please contact your administrator.
    </AlertDescription>
  </Alert>
)}

// Add to TenantDetailPage (id comes from use(params) - see Step 03)
<ContentCard>
  <div className="flex items-center justify-between mb-4">
    <h2 className="text-lg font-semibold">Domains</h2>
    <AddDomainDialog tenantId={id} />
  </div>

  <DomainsList tenantId={id} />
</ContentCard>

// apps/web/src/components/admin/DomainsList.tsx
export function DomainsList({ tenantId }: { tenantId: string }) {
  const { data: domains } = useQuery({
    queryKey: ['admin', 'tenants', tenantId, 'domains'],
    queryFn: () => fetchTenantDomains(tenantId),
  });

  return (
    <div className="space-y-2">
      {domains?.map((domain) => (
        <div
          key={domain.id}
          className="flex items-center justify-between p-3 bg-muted/50 rounded-lg"
        >
          <div className="flex items-center gap-2">
            <Globe className="h-4 w-4 text-muted-foreground" />
            <span className="font-mono text-sm">{domain.domain}</span>
            {domain.isPrimary && (
              <Badge variant="secondary">Primary</Badge>
            )}
          </div>
          <DomainActions domain={domain} tenantId={tenantId} />
        </div>
      ))}

      {domains?.length === 0 && (
        <p className="text-sm text-muted-foreground text-center py-4">
          No domains configured. Add a domain to enable registration.
        </p>
      )}
    </div>
  );
}

// apps/web/src/components/admin/AddDomainDialog.tsx
export function AddDomainDialog({ tenantId }: { tenantId: string }) {
  const [open, setOpen] = useState(false);
  const queryClient = useQueryClient();

  const mutation = useMutation({
    mutationFn: (data: AddDomainDto) => addTenantDomain(tenantId, data),
    onSuccess: () => {
      toast.success('Domain added successfully');
      queryClient.invalidateQueries(['admin', 'tenants', tenantId, 'domains']);
      setOpen(false);
    },
    onError: (error) => {
      toast.error('Failed to add domain', { description: error.message });
    },
  });

  return (
    <Dialog open={open} onOpenChange={setOpen}>
      <DialogTrigger asChild>
        <Button size="sm">Add Domain</Button>
      </DialogTrigger>
      <DialogContent>
        <DialogHeader>
          <DialogTitle>Add Domain</DialogTitle>
          <DialogDescription>
            Add a domain to allow users with this email domain to register
            and automatically join this tenant.
          </DialogDescription>
        </DialogHeader>

        <form onSubmit={handleSubmit}>
          <div className="space-y-4">
            <div>
              <Label htmlFor="domain">Domain</Label>
              <Input
                id="domain"
                placeholder="company.com"
                {...register('domain')}
              />
              <p className="text-xs text-muted-foreground mt-1">
                Enter the email domain without @ (e.g., capptoo.com)
              </p>
            </div>
            <div className="flex items-center gap-2">
              <Checkbox id="isPrimary" {...register('isPrimary')} />
              <Label htmlFor="isPrimary" className="text-sm">
                Set as primary domain
              </Label>
            </div>
          </div>

          <DialogFooter className="mt-6">
            <Button variant="outline" type="button" onClick={() => setOpen(false)}>
              Cancel
            </Button>
            <Button type="submit" disabled={mutation.isPending}>
              {mutation.isPending ? 'Adding...' : 'Add Domain'}
            </Button>
          </DialogFooter>
        </form>
      </DialogContent>
    </Dialog>
  );
}

// apps/web/src/components/admin/DomainActions.tsx
export function DomainActions({ domain, tenantId }) {
  const queryClient = useQueryClient();

  const deleteMutation = useMutation({
    mutationFn: () => removeTenantDomain(tenantId, domain.id),
    onSuccess: () => {
      toast.success('Domain removed');
      queryClient.invalidateQueries(['admin', 'tenants', tenantId, 'domains']);
    },
  });

  const setPrimaryMutation = useMutation({
    mutationFn: () => updateTenantDomain(tenantId, domain.id, { isPrimary: true }),
    onSuccess: () => {
      toast.success('Primary domain updated');
      queryClient.invalidateQueries(['admin', 'tenants', tenantId, 'domains']);
    },
  });

  return (
    <DropdownMenu>
      <DropdownMenuTrigger asChild>
        <Button variant="ghost" size="icon">
          <MoreVertical className="h-4 w-4" />
        </Button>
      </DropdownMenuTrigger>
      <DropdownMenuContent>
        {!domain.isPrimary && (
          <DropdownMenuItem onClick={() => setPrimaryMutation.mutate()}>
            Set as Primary
          </DropdownMenuItem>
        )}
        <DropdownMenuItem
          className="text-destructive"
          onClick={() => {
            if (confirm('Remove this domain?')) {
              deleteMutation.mutate();
            }
          }}
        >
          Remove Domain
        </DropdownMenuItem>
      </DropdownMenuContent>
    </DropdownMenu>
  );
}

apps/
├── api/src/
│   ├── common/guards/
│   │   └── platform-admin.guard.ts    # New
│   └── modules/admin/
│       ├── admin.module.ts            # New
│       ├── admin-tenant.controller.ts # New
│       ├── admin-tenant.service.ts    # New
│       └── dto/
│           ├── create-tenant.dto.ts   # New
│           ├── update-tenant.dto.ts   # New
│           └── assign-admin.dto.ts    # New
└── web/src/
    ├── app/(dashboard)/admin/
    │   └── tenants/
    │       ├── page.tsx               # New
    │       ├── new/page.tsx           # New
    │       └── [id]/page.tsx          # New
    └── components/admin/
        └── AssignAdminDialog.tsx      # New

- Mark Phase 10 as COMPLETED with timestamp
- Update "Current Phase" to Phase 10.5
- Add session log entry

## API Endpoints
- /api/v1/admin/tenants/*
- /api/v1/admin/domains/*

## Frontend Routes
- /admin/*

## Established Patterns
- PlatformAdminOnly guard
- Admin service pattern

git add PROJECT_STATE.md WHAT_EXISTS.md
git commit -m "chore: complete Phase 10 - Platform Admin"
git tag phase-10-platform-admin