admin

Overview ¶

Package admin mounts the god-mode admin surface (/v1/admin/*) the Hanzo Admin Console (admin.hanzo.ai, apps/operator) calls, per the api.ts contract.

It is an AGGREGATOR, not a new store: identity (orgs/users/roles/applications/ audit/me) is read from IAM, the money panels (spend/tokens/credits) from commerce, and System Health from o11y — every one a real upstream, none fused into this binary (see subsystems.go). The facade fans out over HTTP exactly like o11ysvc / productsvc: it holds no business logic, it shapes the reads into the /v1 envelope { status, msg, data, data2 } the operator's transport decodes (get<T> reads data; getList<T> reads data + data2 total).

SECURITY — TWO tiers off ONE identity predicate, both fail-closed. The cockpit is a single pane for a SuperAdmin (owner == AdminOrg — c.IsAdmin(), the SANITIZED X-User-IsAdmin, true ONLY for a JWT-validated principal whose org IS the admin org, matching the gateway's admin-guard) AND for an org admin (any other validated admin caller). The predicate is enforced in ONE place — resolveScope/scopedOrgs (scope.go):

• PLATFORM routes (roles/applications/audit/products/finance/compute/o11y/revenue + the launch/release/flags/access control plane) are SuperAdmin ONLY (s.guard). No principal → 403; an org admin → 403; a forged X-User-IsAdmin never survives ingress (SanitizeIdentity strips it).
• ORG-SCOPED routes (me/overview/orgs/users/usage/analytics/bases) are s.guardScoped: a SuperAdmin sees EVERY tenant; any other validated admin caller is HARD-limited to their OWN org subtree. The cross-tenant boundary — the escalation line — cannot be crossed by a non-super caller for ANY input, because their org is the sanitized, un-forgeable c.Org() and every read folds over scopedOrgs.

admin adds no service credential to the IAM fan-out — it replays the caller's own cookie/bearer, so it can never read more than the caller already could, and IAM re-checks authority on every call (a non-super caller replaying to a cross-tenant IAM read is refused by IAM too — defense in depth).

Panels with no in-binary feed yet (the Usage & Costs timeseries + per-product breakdown live in insights/datastore; the product/workload registry + infra tiles live in platform.hanzo.ai / the operator inventory) return the real, honest empty state — never a fabricated number. The operator UI renders those as an em-dash / empty table by design.