# Super Admin (Operator) Access in ChatSell OS

Super admin (platform operator) access lets you manage **all tenants**, **plans**, and **platform billing** from the `/admin` area. It is **not** a role in the database; it is controlled by an **email allowlist** and only works in `local` or `testing` environment.

---

## How super admin login works

1. **You must have a normal user account** (email + password) in the system. That user can be the Owner of any tenant (e.g. a workspace you registered) or a dedicated “operator” user created by the seeder.
2. **Your email must be listed in `OPERATOR_EMAILS`** in `.env`. Then, when you are logged in, the app treats you as an operator and lets you open `/admin` routes.
3. **Environment must be `local` or `testing`**. In production, operator access is disabled for security.

So: **log in with your normal credentials** at `/login`, then either go directly to `/admin` or use the **Operator** section in the sidebar (Admin Dashboard, Tenants, Plans, Billing).

---

## Create a dedicated super admin user (recommended for local)

If you don’t have a user yet, or want a dedicated operator account:

### 1. Seed plans and permissions (if not already done)

```bash
php artisan db:seed --class=PlanSeeder
php artisan db:seed --class=PermissionSeeder
```

### 2. Seed the operator user

```bash
php artisan db:seed --class=OperatorUserSeeder
```

This creates:

- A tenant **“Platform Operator”** (used only so the user has a valid tenant and can log in).
- A user with:
  - **Email:** `superadmin@chatsell.local` (or the value of `SUPERADMIN_EMAIL` in `.env`)
  - **Password:** `SuperAdmin123!` (or the value of `SUPERADMIN_PASSWORD` in `.env`)

If a user with that email already exists, the seeder skips creation and only reminds you to set `OPERATOR_EMAILS`.

### 3. Allow that user to access admin

In `.env` add (use the same email as the operator user):

```env
OPERATOR_EMAILS=superadmin@chatsell.local
```

For multiple operators, use a comma-separated list:

```env
OPERATOR_EMAILS=superadmin@chatsell.local,admin@example.com
```

### 4. Log in and open admin

1. Open **Login**: `http://localhost:8080/login` (or your app URL).
2. Log in with:
   - **Email:** `superadmin@chatsell.local`
   - **Password:** `SuperAdmin123!`
3. After login you’ll see the normal workspace (e.g. Dashboard). In the sidebar, an **Operator** section appears with:
   - **Admin Dashboard** → `/admin`
   - **Tenants** → `/admin/tenants`
   - **Plans** → `/admin/plans`
   - **Billing** → `/admin/billing`
4. You can also go directly to: `http://localhost:8080/admin`.

---

## Super admin pages (what you can do)

| Page | URL | Description |
|------|-----|-------------|
| Admin Dashboard | `/admin` | Overview of tenants and platform metrics. |
| Tenants | `/admin/tenants` | List all tenants; open a tenant to view/edit details. |
| Tenant detail | `/admin/tenants/{tenant}` | View and edit a single tenant (e.g. plan, status). |
| Plans | `/admin/plans` | Manage subscription plans. |
| Billing | `/admin/billing` | Platform-level billing (e.g. tenant invoices). |

Access to these routes is protected by the `operator` middleware: only users whose email is in `OPERATOR_EMAILS` (and in `local`/`testing`) can open them. Others get **403 Forbidden**.

---

## Using an existing user as super admin

If you already have a user (e.g. you signed up and are the Owner of a workspace):

1. Add that user’s **email** to `OPERATOR_EMAILS` in `.env`.
2. Ensure `APP_ENV=local` (or `testing`).
3. Log in as that user and go to `/admin` or use the Operator links in the sidebar.

No need to run `OperatorUserSeeder` unless you want a separate operator-only account.

---

## Summary

| Step | Action |
|------|--------|
| 1 | Run `php artisan db:seed --class=OperatorUserSeeder` (optional; creates `superadmin@chatsell.local` / `SuperAdmin123!`). |
| 2 | Set in `.env`: `OPERATOR_EMAILS=superadmin@chatsell.local` (or your chosen operator email). |
| 3 | Log in at `/login` with that user’s email and password. |
| 4 | Open `/admin` or use the **Operator** block in the sidebar to access Admin Dashboard, Tenants, Plans, and Billing. |

Operator access is **disabled in production**; only `APP_ENV=local` and `APP_ENV=testing` are allowed.
