neo/backend/src/tenant/central-admin.controller.ts

import {
  Controller,
  Get,
  Post,
  Put,
  Delete,
  Body,
  Param,
  UseGuards,
  UnauthorizedException,
  Req,
} from '@nestjs/common';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';
import { CentralTenant, CentralDomain, CentralUser } from '../models/central.model';
import { getCentralKnex, initCentralModels } from './central-database.service';
import { TenantProvisioningService } from './tenant-provisioning.service';
import * as bcrypt from 'bcrypt';

/**
 * Controller for managing central database entities (tenants, domains, users)
 * Only accessible when logged in as central admin
 */
@Controller('central')
@UseGuards(JwtAuthGuard)
export class CentralAdminController {
  constructor(
    private readonly provisioningService: TenantProvisioningService,
  ) {
    // Initialize central models on controller creation
    initCentralModels();
  }
  
  private checkCentralAdmin(req: any) {
    const subdomain = req.raw?.subdomain;
    const centralSubdomains = (process.env.CENTRAL_SUBDOMAINS || 'central,admin').split(',');
    
    if (!subdomain || !centralSubdomains.includes(subdomain)) {
      throw new UnauthorizedException('This endpoint is only accessible to central administrators');
    }
  }

  // ==================== TENANTS ====================
  
  @Get('tenants')
  async getTenants(@Req() req: any) {
    this.checkCentralAdmin(req);
    return CentralTenant.query().withGraphFetched('domains');
  }

  @Get('tenants/:id')
  async getTenant(@Req() req: any, @Param('id') id: string) {
    this.checkCentralAdmin(req);
    return CentralTenant.query()
      .findById(id)
      .withGraphFetched('domains');
  }

  @Post('tenants')
  async createTenant(
    @Req() req: any,
    @Body() data: {
      name: string;
      slug?: string;
      primaryDomain: string;
      dbHost?: string;
      dbPort?: number;
    },
  ) {
    this.checkCentralAdmin(req);
    
    // Use the provisioning service to create tenant with database and migrations
    const result = await this.provisioningService.provisionTenant({
      name: data.name,
      slug: data.slug || data.name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, ''),
      primaryDomain: data.primaryDomain,
      dbHost: data.dbHost,
      dbPort: data.dbPort,
    });
    
    // Return the created tenant
    return CentralTenant.query()
      .findById(result.tenantId)
      .withGraphFetched('domains');
  }

  @Put('tenants/:id')
  async updateTenant(
    @Req() req: any,
    @Param('id') id: string,
    @Body() data: {
      name?: string;
      slug?: string;
      dbHost?: string;
      dbPort?: number;
      dbName?: string;
      dbUsername?: string;
      status?: string;
    },
  ) {
    this.checkCentralAdmin(req);
    return CentralTenant.query()
      .patchAndFetchById(id, data);
  }

  @Delete('tenants/:id')
  async deleteTenant(@Req() req: any, @Param('id') id: string) {
    this.checkCentralAdmin(req);
    await CentralTenant.query().deleteById(id);
    return { success: true };
  }

  // ==================== DOMAINS ====================
  
  @Get('domains')
  async getDomains(@Req() req: any) {
    this.checkCentralAdmin(req);
    return CentralDomain.query().withGraphFetched('tenant');
  }

  @Get('domains/:id')
  async getDomain(@Req() req: any, @Param('id') id: string) {
    this.checkCentralAdmin(req);
    return CentralDomain.query()
      .findById(id)
      .withGraphFetched('tenant');
  }

  @Post('domains')
  async createDomain(
    @Req() req: any,
    @Body() data: {
      domain: string;
      tenantId: string;
      isPrimary?: boolean;
    },
  ) {
    this.checkCentralAdmin(req);
    return CentralDomain.query().insert({
      domain: data.domain,
      tenantId: data.tenantId,
      isPrimary: data.isPrimary || false,
    });
  }

  @Put('domains/:id')
  async updateDomain(
    @Req() req: any,
    @Param('id') id: string,
    @Body() data: {
      domain?: string;
      tenantId?: string;
      isPrimary?: boolean;
    },
  ) {
    this.checkCentralAdmin(req);
    return CentralDomain.query()
      .patchAndFetchById(id, data);
  }

  @Delete('domains/:id')
  async deleteDomain(@Req() req: any, @Param('id') id: string) {
    this.checkCentralAdmin(req);
    await CentralDomain.query().deleteById(id);
    return { success: true };
  }

  // ==================== USERS (Central Admin Users) ====================
  
  @Get('users')
  async getUsers(@Req() req: any) {
    this.checkCentralAdmin(req);
    const users = await CentralUser.query();
    // Remove password from response
    return users.map(({ password, ...user }) => user);
  }

  @Get('users/:id')
  async getUser(@Req() req: any, @Param('id') id: string) {
    this.checkCentralAdmin(req);
    const user = await CentralUser.query().findById(id);
    
    if (!user) {
      throw new UnauthorizedException('User not found');
    }
    
    const { password, ...userWithoutPassword } = user;
    return userWithoutPassword;
  }

  @Post('users')
  async createUser(
    @Req() req: any,
    @Body() data: {
      email: string;
      password: string;
      firstName?: string;
      lastName?: string;
      role?: string;
      isActive?: boolean;
    },
  ) {
    this.checkCentralAdmin(req);
    
    const hashedPassword = await bcrypt.hash(data.password, 10);
    
    const user = await CentralUser.query().insert({
      email: data.email,
      password: hashedPassword,
      firstName: data.firstName || null,
      lastName: data.lastName || null,
      role: data.role || 'admin',
      isActive: data.isActive !== undefined ? data.isActive : true,
    });
    
    const { password, ...userWithoutPassword } = user;
    return userWithoutPassword;
  }

  @Put('users/:id')
  async updateUser(
    @Req() req: any,
    @Param('id') id: string,
    @Body() data: {
      email?: string;
      password?: string;
      firstName?: string;
      lastName?: string;
      role?: string;
      isActive?: boolean;
    },
  ) {
    this.checkCentralAdmin(req);
    
    const updateData: any = { ...data };
    
    // Hash password if provided
    if (data.password) {
      updateData.password = await bcrypt.hash(data.password, 10);
    } else {
      // Remove password from update if not provided
      delete updateData.password;
    }
    
    const user = await CentralUser.query()
      .patchAndFetchById(id, updateData);
    
    const { password, ...userWithoutPassword } = user;
    return userWithoutPassword;
  }

  @Delete('users/:id')
  async deleteUser(@Req() req: any, @Param('id') id: string) {
    this.checkCentralAdmin(req);
    await CentralUser.query().deleteById(id);
    return { success: true };
  }
}