admin

Overview ¶

Package admin mounts the god-mode admin surface (/v1/admin/*) the Hanzo Admin Console (admin.hanzo.ai, apps/operator) calls, per the api.ts contract.

It is an AGGREGATOR, not a new store: identity (orgs/users/roles/applications/ audit/me) is read from IAM, the money panels (spend/tokens/credits) from commerce, and System Health from o11y — every one a real upstream, none fused into this binary (see subsystems.go). The facade fans out over HTTP exactly like o11ysvc / productsvc: it holds no business logic, it shapes the reads into the /v1 envelope { status, msg, data, data2 } the operator's transport decodes (get<T> reads data; getList<T> reads data + data2 total).

SECURITY — every route is GLOBAL-ADMIN ONLY, fail-closed. The gate is the SAME predicate the rest of cloud uses: c.IsAdmin(), which after SanitizeIdentity (serve.go) is true ONLY for a JWT-validated principal whose org is the admin org (owner == AdminOrg — IAM's IsGlobalAdmin), matching the gateway's admin-guard. No principal → 403; a tenant-admin (owner != AdminOrg) → 403; a forged X-User-IsAdmin never survives ingress. admin adds no service credential to the IAM fan-out — it replays the caller's own cookie/bearer, so it can never read more than the caller already could, and IAM re-checks IsGlobalAdmin too.

Panels with no in-binary feed yet (the Usage & Costs timeseries + per-product breakdown live in insights/datastore; the product/workload registry + infra tiles live in platform.hanzo.ai / the operator inventory) return the real, honest empty state — never a fabricated number. The operator UI renders those as an em-dash / empty table by design.