Admin Panel

export const user = pgTable("user", {
  id: text("id").primaryKey(),
  email: text("email").notNull().unique(),
  
  // System admin flag (for super admin access across all workspaces)
  isSystemAdmin: boolean("is_system_admin").notNull().default(false),
  
  // User can also be banned
  banned: boolean("banned").notNull().default(false),
  banReason: text("ban_reason"),
  banExpires: timestamp("ban_expires"),
});

export async function requireSystemAdmin() {
  const session = await auth.api.getSession({ headers: await headers() });
  
  if (!session) {
    redirect("/sign-in?callbackUrl=/admin");
  }
  
  const [currentUser] = await db
    .select({ isSystemAdmin: user.isSystemAdmin })
    .from(user)
    .where(eq(user.id, session.user.id))
    .limit(1);
  
  if (!currentUser?.isSystemAdmin) {
    redirect("/dashboard"); // Non-admins get redirected
  }
  
  return { session, userId: currentUser.id };
}

UPDATE "user" 
SET is_system_admin = true 
WHERE email = '[email protected]';

export default async function AdminLayout({ children }: { children: React.ReactNode }) {
  // Verify system admin access - redirects if not authorized
  await requireSystemAdmin();
  
  return (
    <div className="min-h-screen bg-background">
      <ImpersonationBanner />
      <AdminHeader />
      <main className="w-full py-6">{children}</main>
      <Toaster />
    </div>
  );
}

export default async function AdminWorkspaceDetailPage({ params }: PageProps) {
  await requireSystemAdmin();
  const { id } = await params;
  
  const data = await getAdminWorkspaceDetail(id);
  
  return <WorkspaceDetailContent workspace={data} />;
}

export type UserRole = "owner" | "admin" | "member";

const formattedStats = {
  uninvoicedCount: stats.uninvoicedCount,
  uninvoicedAmount: stats.uninvoicedAmountOre / 100,
  pendingPayment: stats.pendingPaymentCount,
  pendingPaymentAmount: stats.pendingPaymentAmountOre / 100,
  invoicedThisMonth: stats.invoicedThisMonthCount,
  invoicedAmountThisMonth: stats.invoicedThisMonthAmountOre / 100,
};

export const affiliateRelationship = pgTable("affiliate_relationship", {
  id: text("id").primaryKey(),
  affiliateWorkspaceId: text("affiliate_workspace_id").notNull(),
  referredWorkspaceId: text("referred_workspace_id").notNull(),
  commissionPercent: integer("commission_percent").notNull().default(20),
  isActive: boolean("is_active").notNull().default(true),
});

export const affiliateEarning = pgTable("affiliate_earning", {
  id: text("id").primaryKey(),
  affiliateWorkspaceId: text("affiliate_workspace_id").notNull(),
  invoiceId: text("invoice_id").notNull(),
  invoiceAmountOre: integer("invoice_amount_ore").notNull(),
  commissionPercent: integer("commission_percent").notNull(),
  earningAmountOre: integer("earning_amount_ore").notNull(),
  status: text("status").notNull().default("pending"), // 'pending' | 'paid_out'
});

await db.update(workspace)
  .set({ 
    plan: "enterprise",
    updatedAt: new Date(),
  })
  .where(eq(workspace.id, workspaceId));

await db.update(workspace)
  .set({ 
    status: "suspended",
    suspendedAt: new Date(),
    suspendedReason: "Payment overdue",
  })
  .where(eq(workspace.id, workspaceId));

export async function setWorkspaceInvoiceEligibility(
  workspaceId: string,
  eligible: boolean
): Promise<ActionResult<{ success: boolean }>> {
  const adminCheck = await verifySystemAdmin();
  if (adminCheck.error) {
    return { success: false, error: adminCheck.error };
  }
  
  await db.update(workspace)
    .set({
      invoiceEligible: eligible,
      invoiceEligibleAt: eligible ? new Date() : null,
    })
    .where(eq(workspace.id, workspaceId));
}

await db.update(user)
  .set({ 
    banned: true,
    banReason: "Terms of service violation",
    banExpires: null, // Permanent ban
  })
  .where(eq(user.id, userId));

await db.update(user)
  .set({ 
    banned: true,
    banReason: "Suspicious activity",
    banExpires: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), // 7 days
  })
  .where(eq(user.id, userId));

export const session = pgTable("session", {
  id: text("id").primaryKey(),
  userId: text("user_id").notNull(),
  
  // Admin impersonation tracking (better-auth admin plugin)
  impersonatedBy: text("impersonated_by").references(() => user.id),
});

<ImpersonationBanner />

export const workspace = pgTable("workspace", {
  // Admin can manually invite workspaces (for beta, referrals, etc.)
  invitedByAdmin: boolean("invited_by_admin").notNull().default(false),
});

export async function getAdminWorkspaceDetail(workspaceId: string) {
  const workspace = await db.query.workspace.findFirst({
    where: eq(schema.workspace.id, workspaceId),
    with: {
      members: true,
      projects: {
        limit: 10,
        orderBy: (projects, { desc }) => [desc(projects.createdAt)],
      },
    },
  });
  
  return workspace;
}

export async function getBillingStats() {
  const [uninvoiced, pending, thisMonth, total] = await Promise.all([
    // Uninvoiced line items
    db.select({ count: count() })
      .from(invoiceLineItem)
      .where(eq(invoiceLineItem.status, "pending")),
    
    // Pending Stripe payments
    db.select({ count: count() })
      .from(projectPayment)
      .where(eq(projectPayment.status, "pending")),
    
    // Invoices this month
    db.select({ count: count() })
      .from(invoice)
      .where(sql`EXTRACT(MONTH FROM issue_date) = EXTRACT(MONTH FROM NOW())`),
    
    // Total invoiced
    db.select({ sum: sum(invoice.totalAmountOre) })
      .from(invoice),
  ]);
}

const navItems = [
  { href: "/admin", label: "Dashboard", icon: IconHome },
  { href: "/admin/workspaces", label: "Workspaces", icon: IconBuilding },
  { href: "/admin/users", label: "Users", icon: IconUsers },
  { href: "/admin/billing", label: "Billing", icon: IconFileInvoice },
  { href: "/admin/revenue", label: "Revenue", icon: IconChartBar },
  { href: "/admin/affiliates", label: "Affiliates", icon: IconUsersGroup },
];