Add back-office tenant overview with dashboard, accounts, users, billing events, and Stripe reconciliation

application/account/Api/Endpoints/BackOfficeEndpoints.cs → application/account/Api/BackOffice/BackOfficeEndpoints.cs

@@ -5,7 +5,7 @@
 using SharedKernel.Endpoints;
 using SharedKernel.OpenApi;
 
-namespace Account.Api.Endpoints;
+namespace Account.Api.BackOffice;
 
 public sealed class BackOfficeEndpoints : IEndpoints
 {
@@ -14,7 +14,7 @@ public sealed class BackOfficeEndpoints : IEndpoints
     public void MapEndpoints(IEndpointRouteBuilder routes)
     {
         // BackOffice:Host is required (validated at startup via ValidateOnStart in
-        // ApiDependencyConfiguration.AddBackOfficeHostOptions). PP-1149 must keep that validation in place
+        // ApiDependencyConfiguration.AddBackOfficeHostOptions). The startup validation must stay in place
         // so a missing/blank value fails loudly rather than silently 404-ing back-office endpoints.
         var backOfficeHost = routes.ServiceProvider.GetRequiredService<IOptions<BackOfficeHostOptions>>().Value.Host;
 

application/account/Api/BackOffice/BillingDriftEndpoints.cs

@@ -0,0 +1,37 @@
+using Account.Features.BackOffice.BillingDrift.Queries;
+using Microsoft.Extensions.Options;
+using SharedKernel.ApiResults;
+using SharedKernel.Authentication.BackOfficeIdentity;
+using SharedKernel.Endpoints;
+using SharedKernel.OpenApi;
+
+namespace Account.Api.BackOffice;
+
+public sealed class BillingDriftEndpoints : IEndpoints
+{
+    private const string RoutesPrefix = "/api/back-office/billing-drift";
+
+    public void MapEndpoints(IEndpointRouteBuilder routes)
+    {
+        var backOfficeHost = routes.ServiceProvider.GetRequiredService<IOptions<BackOfficeHostOptions>>().Value.Host;
+
+        var group = routes.MapGroup(RoutesPrefix)
+            .WithTags("BackOfficeBillingDrift")
+            .WithGroupName(OpenApiDocumentNames.BackOffice)
+            .RequireHost(backOfficeHost)
+            .RequireAuthorization(BackOfficeIdentityDefaults.PolicyName)
+            .ProducesValidationProblem();
+
+        group.MapGet("/summary", async Task<ApiResult<BillingDriftSummaryResponse>> ([AsParameters] GetBillingDriftSummaryQuery query, IMediator mediator)
+            => await mediator.Send(query)
+        ).Produces<BillingDriftSummaryResponse>();
+
+        group.MapGet("/unsynced-summary", async Task<ApiResult<UnsyncedSubscriptionsSummaryResponse>> ([AsParameters] GetUnsyncedSubscriptionsSummaryQuery query, IMediator mediator)
+            => await mediator.Send(query)
+        ).Produces<UnsyncedSubscriptionsSummaryResponse>();
+
+        group.MapGet("/mrr-consistency-summary", async Task<ApiResult<DashboardMrrConsistencySummaryResponse>> ([AsParameters] GetDashboardMrrConsistencySummaryQuery query, IMediator mediator)
+            => await mediator.Send(query)
+        ).Produces<DashboardMrrConsistencySummaryResponse>();
+    }
+}

application/account/Api/BackOffice/BillingEventsEndpoints.cs

@@ -0,0 +1,29 @@
+using Account.Features.BackOffice.BillingEvents.Queries;
+using Microsoft.Extensions.Options;
+using SharedKernel.ApiResults;
+using SharedKernel.Authentication.BackOfficeIdentity;
+using SharedKernel.Endpoints;
+using SharedKernel.OpenApi;
+
+namespace Account.Api.BackOffice;
+
+public sealed class BillingEventsEndpoints : IEndpoints
+{
+    private const string RoutesPrefix = "/api/back-office/billing-events";
+
+    public void MapEndpoints(IEndpointRouteBuilder routes)
+    {
+        var backOfficeHost = routes.ServiceProvider.GetRequiredService<IOptions<BackOfficeHostOptions>>().Value.Host;
+
+        var group = routes.MapGroup(RoutesPrefix)
+            .WithTags("BackOfficeBillingEvents")
+            .WithGroupName(OpenApiDocumentNames.BackOffice)
+            .RequireHost(backOfficeHost)
+            .RequireAuthorization(BackOfficeIdentityDefaults.PolicyName)
+            .ProducesValidationProblem();
+
+        group.MapGet("/", async Task<ApiResult<BillingEventsResponse>> ([AsParameters] GetBackOfficeBillingEventsQuery query, IMediator mediator)
+            => await mediator.Send(query)
+        ).Produces<BillingEventsResponse>();
+    }
+}

application/account/Api/BackOffice/DashboardEndpoints.cs

@@ -0,0 +1,49 @@
+using Account.Features.BackOffice.Dashboard.Queries;
+using Microsoft.Extensions.Options;
+using SharedKernel.ApiResults;
+using SharedKernel.Authentication.BackOfficeIdentity;
+using SharedKernel.Endpoints;
+using SharedKernel.OpenApi;
+
+namespace Account.Api.BackOffice;
+
+public sealed class DashboardEndpoints : IEndpoints
+{
+    private const string RoutesPrefix = "/api/back-office/dashboard";
+
+    public void MapEndpoints(IEndpointRouteBuilder routes)
+    {
+        var backOfficeHost = routes.ServiceProvider.GetRequiredService<IOptions<BackOfficeHostOptions>>().Value.Host;
+
+        var group = routes.MapGroup(RoutesPrefix)
+            .WithTags("BackOfficeDashboard")
+            .WithGroupName(OpenApiDocumentNames.BackOffice)
+            .RequireHost(backOfficeHost)
+            .RequireAuthorization(BackOfficeIdentityDefaults.PolicyName)
+            .ProducesValidationProblem();
+
+        group.MapGet("/kpis", async Task<ApiResult<BackOfficeDashboardKpisResponse>> ([AsParameters] GetDashboardKpisQuery query, IMediator mediator)
+            => await mediator.Send(query)
+        ).Produces<BackOfficeDashboardKpisResponse>();
+
+        group.MapGet("/trends", async Task<ApiResult<BackOfficeDashboardTrendsResponse>> ([AsParameters] GetDashboardTrendsQuery query, IMediator mediator)
+            => await mediator.Send(query)
+        ).Produces<BackOfficeDashboardTrendsResponse>();
+
+        group.MapGet("/mrr-trend", async Task<ApiResult<BackOfficeDashboardMrrTrendResponse>> ([AsParameters] GetDashboardMrrTrendQuery query, IMediator mediator)
+            => await mediator.Send(query)
+        ).Produces<BackOfficeDashboardMrrTrendResponse>();
+
+        group.MapGet("/plan-distribution", async Task<ApiResult<BackOfficeDashboardPlanDistributionResponse>> ([AsParameters] GetDashboardPlanDistributionQuery query, IMediator mediator)
+            => await mediator.Send(query)
+        ).Produces<BackOfficeDashboardPlanDistributionResponse>();
+
+        group.MapGet("/recent-signups", async Task<ApiResult<BackOfficeDashboardRecentSignupsResponse>> ([AsParameters] GetDashboardRecentSignupsQuery query, IMediator mediator)
+            => await mediator.Send(query)
+        ).Produces<BackOfficeDashboardRecentSignupsResponse>();
+
+        group.MapGet("/recent-stripe-events", async Task<ApiResult<BackOfficeDashboardRecentStripeEventsResponse>> ([AsParameters] GetDashboardRecentStripeEventsQuery query, IMediator mediator)
+            => await mediator.Send(query)
+        ).Produces<BackOfficeDashboardRecentStripeEventsResponse>();
+    }
+}

application/account/Api/BackOffice/TenantsEndpoints.cs

@@ -0,0 +1,59 @@
+using Account.Features.Tenants.BackOffice.Commands;
+using Account.Features.Tenants.BackOffice.Queries;
+using Microsoft.Extensions.Options;
+using SharedKernel.ApiResults;
+using SharedKernel.Authentication.BackOfficeIdentity;
+using SharedKernel.Domain;
+using SharedKernel.Endpoints;
+using SharedKernel.OpenApi;
+
+namespace Account.Api.BackOffice;
+
+public sealed class TenantsEndpoints : IEndpoints
+{
+    private const string RoutesPrefix = "/api/back-office/tenants";
+
+    public void MapEndpoints(IEndpointRouteBuilder routes)
+    {
+        var backOfficeHost = routes.ServiceProvider.GetRequiredService<IOptions<BackOfficeHostOptions>>().Value.Host;
+
+        var group = routes.MapGroup(RoutesPrefix)
+            .WithTags("BackOfficeTenants")
+            .WithGroupName(OpenApiDocumentNames.BackOffice)
+            .RequireHost(backOfficeHost)
+            .RequireAuthorization(BackOfficeIdentityDefaults.PolicyName)
+            .ProducesValidationProblem();
+
+        group.MapGet("/", async Task<ApiResult<TenantsResponse>> ([AsParameters] GetTenantsQuery query, IMediator mediator)
+            => await mediator.Send(query)
+        ).Produces<TenantsResponse>();
+
+        group.MapGet("/{id}", async Task<ApiResult<TenantDetailResponse>> (TenantId id, IMediator mediator)
+            => await mediator.Send(new GetTenantDetailQuery(id))
+        ).Produces<TenantDetailResponse>();
+
+        group.MapGet("/{id}/user-counts", async Task<ApiResult<TenantUserCountsResponse>> (TenantId id, IMediator mediator)
+            => await mediator.Send(new GetTenantUserCountsQuery(id))
+        ).Produces<TenantUserCountsResponse>();
+
+        group.MapGet("/{id}/users", async Task<ApiResult<TenantUsersResponse>> (TenantId id, [AsParameters] GetTenantUsersQuery query, IMediator mediator)
+            => await mediator.Send(query with { Id = id })
+        ).Produces<TenantUsersResponse>();
+
+        group.MapGet("/{id}/activity", async Task<ApiResult<TenantActivityResponse>> (TenantId id, IMediator mediator)
+            => await mediator.Send(new GetTenantActivityQuery(id))
+        ).Produces<TenantActivityResponse>();
+
+        group.MapGet("/{id}/payment-history", async Task<ApiResult<TenantPaymentHistoryResponse>> (TenantId id, [AsParameters] GetTenantPaymentHistoryQuery query, IMediator mediator)
+            => await mediator.Send(query with { Id = id })
+        ).Produces<TenantPaymentHistoryResponse>();
+
+        group.MapPost("/{id}/sync-with-stripe", async Task<ApiResult<SyncTenantWithStripeResponse>> (TenantId id, IMediator mediator)
+            => await mediator.Send(new SyncTenantWithStripeCommand { TenantId = id })
+        ).Produces<SyncTenantWithStripeResponse>().RequireAuthorization(BackOfficeIdentityDefaults.AdminPolicyName);
+
+        group.MapPost("/{id}/drift/acknowledge", async Task<ApiResult> (TenantId id, IMediator mediator)
+            => await mediator.Send(new AcknowledgeBillingDriftCommand { TenantId = id })
+        );
+    }
+}

application/account/Api/BackOffice/UsersEndpoints.cs

@@ -0,0 +1,42 @@
+using Account.Features.Users.BackOffice.Queries;
+using Microsoft.Extensions.Options;
+using SharedKernel.ApiResults;
+using SharedKernel.Authentication.BackOfficeIdentity;
+using SharedKernel.Domain;
+using SharedKernel.Endpoints;
+using SharedKernel.OpenApi;
+
+namespace Account.Api.BackOffice;
+
+public sealed class UsersEndpoints : IEndpoints
+{
+    private const string RoutesPrefix = "/api/back-office/users";
+
+    public void MapEndpoints(IEndpointRouteBuilder routes)
+    {
+        var backOfficeHost = routes.ServiceProvider.GetRequiredService<IOptions<BackOfficeHostOptions>>().Value.Host;
+
+        var group = routes.MapGroup(RoutesPrefix)
+            .WithTags("BackOfficeUsers")
+            .WithGroupName(OpenApiDocumentNames.BackOffice)
+            .RequireHost(backOfficeHost)
+            .RequireAuthorization(BackOfficeIdentityDefaults.PolicyName)
+            .ProducesValidationProblem();
+
+        group.MapGet("/", async Task<ApiResult<BackOfficeUsersResponse>> ([AsParameters] GetBackOfficeUsersQuery query, IMediator mediator)
+            => await mediator.Send(query)
+        ).Produces<BackOfficeUsersResponse>();
+
+        group.MapGet("/{id}", async Task<ApiResult<BackOfficeUserDetailResponse>> (UserId id, IMediator mediator)
+            => await mediator.Send(new GetBackOfficeUserDetailQuery(id))
+        ).Produces<BackOfficeUserDetailResponse>();
+
+        group.MapGet("/{id}/sessions", async Task<ApiResult<BackOfficeUserSessionsResponse>> (UserId id, [AsParameters] GetBackOfficeUserSessionsQuery query, IMediator mediator)
+            => await mediator.Send(query with { Id = id })
+        ).Produces<BackOfficeUserSessionsResponse>();
+
+        group.MapGet("/{id}/login-history", async Task<ApiResult<BackOfficeUserLoginHistoryResponse>> (UserId id, [AsParameters] GetBackOfficeUserLoginHistoryQuery query, IMediator mediator)
+            => await mediator.Send(query with { Id = id })
+        ).Produces<BackOfficeUserLoginHistoryResponse>();
+    }
+}

application/account/Api/BackOfficeBlobProxy.cs

@@ -0,0 +1,34 @@
+using Microsoft.AspNetCore.Mvc;
+using SharedKernel.Integrations.BlobStorage;
+
+namespace Account.Api;
+
+// Back-office Kestrel listens on its own port (BACK_OFFICE_KESTREL_PORT) and bypasses AppGateway, so
+// the avatar/logo routes that AppGateway forwards on the user-facing host are not available here.
+// Map equivalent endpoints scoped to the back-office host that stream blobs directly from the
+// keyed account-storage IBlobStorageClient. This keeps account list/side-pane logos and owner
+// avatars working when the back-office SPA is loaded over the dedicated Kestrel port.
+public static class BackOfficeBlobProxy
+{
+    public static IEndpointRouteBuilder MapBackOfficeBlobProxy(this IEndpointRouteBuilder routes, string backOfficeHostname)
+    {
+        routes.MapGet("/avatars/{**path}", async ([FromRoute] string path, [FromKeyedServices("account-storage")] IBlobStorageClient blobStorageClient, HttpContext httpContext, CancellationToken cancellationToken)
+            => await StreamBlobAsync(blobStorageClient, "avatars", path, httpContext, cancellationToken)
+        ).RequireHost(backOfficeHostname).AllowAnonymous();
+
+        routes.MapGet("/logos/{**path}", async ([FromRoute] string path, [FromKeyedServices("account-storage")] IBlobStorageClient blobStorageClient, HttpContext httpContext, CancellationToken cancellationToken)
+            => await StreamBlobAsync(blobStorageClient, "logos", path, httpContext, cancellationToken)
+        ).RequireHost(backOfficeHostname).AllowAnonymous();
+
+        return routes;
+    }
+
+    private static async Task<IResult> StreamBlobAsync(IBlobStorageClient blobStorageClient, string containerName, string blobName, HttpContext httpContext, CancellationToken cancellationToken)
+    {
+        var blob = await blobStorageClient.DownloadAsync(containerName, blobName, cancellationToken);
+        if (blob is null) return Results.NotFound();
+
+        httpContext.Response.Headers.CacheControl = "public, max-age=2592000, immutable";
+        return Results.Stream(blob.Value.Stream, blob.Value.ContentType);
+    }
+}

application/account/Api/Program.cs

@@ -62,6 +62,10 @@
 
 app.UseApiServices(); // Add common configuration for all APIs like Swagger, HSTS, and DeveloperExceptionPage.
 
+// Back-office Kestrel listens on its own port and bypasses AppGateway, so the avatar/logo routes
+// that AppGateway proxies on the user-facing host must be served here directly from blob storage.
+app.MapBackOfficeBlobProxy(backOfficeHostname);
+
 app.UseEmailStaticFiles("WebApp");
 
 if (SharedInfrastructureConfiguration.IsRunningInAzure)

application/account/BackOffice/routes/-components/DashboardCardShell.tsx

@@ -0,0 +1,23 @@
+import type { ReactNode } from "react";
+
+import { Card, CardAction, CardContent, CardDescription, CardHeader, CardTitle } from "@repo/ui/components/Card";
+
+interface DashboardCardShellProps {
+  title: ReactNode;
+  subtitle?: ReactNode;
+  action?: ReactNode;
+  children: ReactNode;
+}
+
+export function DashboardCardShell({ title, subtitle, action, children }: Readonly<DashboardCardShellProps>) {
+  return (
+    <Card className="h-full pb-4">
+      <CardHeader>
+        <CardTitle>{title}</CardTitle>
+        {subtitle && <CardDescription>{subtitle}</CardDescription>}
+        {action && <CardAction>{action}</CardAction>}
+      </CardHeader>
+      <CardContent>{children}</CardContent>
+    </Card>
+  );
+}

application/account/BackOffice/routes/-components/DashboardHeader.tsx

@@ -0,0 +1,87 @@
+import { t } from "@lingui/core/macro";
+import { useLingui } from "@lingui/react";
+import { Trans } from "@lingui/react/macro";
+import { Button } from "@repo/ui/components/Button";
+import { ToggleGroup, ToggleGroupItem } from "@repo/ui/components/ToggleGroup";
+import { Tooltip, TooltipContent, TooltipTrigger } from "@repo/ui/components/Tooltip";
+import { MaximizeIcon, MinimizeIcon } from "lucide-react";
+import { useEffect, useState } from "react";
+
+import { DashboardTrendPeriod } from "@/shared/lib/api/client";
+
+interface DashboardHeaderProps {
+  period: DashboardTrendPeriod;
+  onPeriodChange: (period: DashboardTrendPeriod) => void;
+}
+
+export function DashboardHeader({ period, onPeriodChange }: Readonly<DashboardHeaderProps>) {
+  const { i18n } = useLingui();
+  const dateFormatter = new Intl.DateTimeFormat(i18n.locale, { weekday: "long", month: "long", day: "numeric" });
+  const today = dateFormatter.format(new Date());
+
+  // Browser fullscreen for kiosk mode — chrome (sidebar, tabs) hides until the user exits.
+  const [isFullscreen, setIsFullscreen] = useState(false);
+
+  useEffect(() => {
+    const updateState = () => setIsFullscreen(document.fullscreenElement !== null);
+    updateState();
+    document.addEventListener("fullscreenchange", updateState);
+    return () => document.removeEventListener("fullscreenchange", updateState);
+  }, []);
+
+  const toggleFullscreen = () => {
+    if (document.fullscreenElement === null) {
+      void document.documentElement.requestFullscreen();
+    } else {
+      void document.exitFullscreen();
+    }
+  };
+
+  const fullscreenLabel = isFullscreen ? t`Exit kiosk mode` : t`Enter kiosk mode`;
+
+  return (
+    <div className="flex flex-wrap items-center justify-between gap-3">
+      <div>
+        <h1>
+          <Trans>Dashboard</Trans>
+        </h1>
+        <p className="mt-1 text-muted-foreground">
+          <Trans>BackOffice overview · {today}</Trans>
+        </p>
+      </div>
+      <div className="flex items-center gap-2">
+        <ToggleGroup
+          variant="outline"
+          aria-label={t`Period`}
+          value={[period]}
+          onValueChange={(values) => {
+            const next = values[0];
+            if (next) {
+              onPeriodChange(next as DashboardTrendPeriod);
+            }
+          }}
+        >
+          <ToggleGroupItem value={DashboardTrendPeriod.Last7Days} className="min-w-[3.5rem] justify-center">
+            <Trans>7d</Trans>
+          </ToggleGroupItem>
+          <ToggleGroupItem value={DashboardTrendPeriod.Last30Days} className="min-w-[3.5rem] justify-center">
+            <Trans>30d</Trans>
+          </ToggleGroupItem>
+          <ToggleGroupItem value={DashboardTrendPeriod.Last90Days} className="min-w-[3.5rem] justify-center">
+            <Trans>90d</Trans>
+          </ToggleGroupItem>
+        </ToggleGroup>
+        <Tooltip>
+          <TooltipTrigger
+            render={
+              <Button variant="outline" size="icon-sm" onClick={toggleFullscreen} aria-label={fullscreenLabel}>
+                {isFullscreen ? <MinimizeIcon className="size-4" /> : <MaximizeIcon className="size-4" />}
+              </Button>
+            }
+          />
+          <TooltipContent>{fullscreenLabel}</TooltipContent>
+        </Tooltip>
+      </div>
+    </div>
+  );
+}