il y a 1 mois · c5e15f76a4
--- a/cmd/admind/web-dist/assets/forms-CvyWnTna.js
+++ b/cmd/admind/web-dist/assets/forms-CvyWnTna.js
@@ -1 +0,0 @@
 
				-import"./react-B_u3rLcX.js";
			
--- a/cmd/admind/web-dist/assets/forms-DqymyfYA.js
+++ b/cmd/admind/web-dist/assets/forms-DqymyfYA.js
--- a/cmd/admind/web-dist/assets/index-BNPqDOA1.css
+++ b/cmd/admind/web-dist/assets/index-BNPqDOA1.css
--- a/cmd/admind/web-dist/assets/index-C61UFTGs.css
+++ b/cmd/admind/web-dist/assets/index-C61UFTGs.css
--- a/cmd/admind/web-dist/assets/index-DCyBxwIY.js
+++ b/cmd/admind/web-dist/assets/index-DCyBxwIY.js
--- a/cmd/admind/web-dist/assets/index-DJUmCqQa.js
+++ b/cmd/admind/web-dist/assets/index-DJUmCqQa.js
--- a/cmd/admind/web-dist/assets/query-CTmUNpMf.js
+++ b/cmd/admind/web-dist/assets/query-CTmUNpMf.js
--- a/cmd/admind/web-dist/assets/query-C_q0vuOo.js
+++ b/cmd/admind/web-dist/assets/query-C_q0vuOo.js
--- a/cmd/admind/web-dist/assets/react-B_u3rLcX.js
+++ b/cmd/admind/web-dist/assets/react-B_u3rLcX.js
--- a/cmd/admind/web-dist/assets/react-C4-CelXw.js
+++ b/cmd/admind/web-dist/assets/react-C4-CelXw.js
--- a/cmd/admind/web-dist/assets/ui-DsQixLUC.js
+++ b/cmd/admind/web-dist/assets/ui-DsQixLUC.js
--- a/cmd/admind/web-dist/index.html
+++ b/cmd/admind/web-dist/index.html
@@ -6,11 +6,12 @@
 
				     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
			
 
				     <meta name="color-scheme" content="light dark" />
			
 
				     <title>broad-announce admin</title>
			
 
				-    <script type="module" crossorigin src="/assets/index-DCyBxwIY.js"></script>
			
 
				-    <link rel="modulepreload" crossorigin href="/assets/react-B_u3rLcX.js">
			
 
				-    <link rel="modulepreload" crossorigin href="/assets/query-CTmUNpMf.js">
			
 
				-    <link rel="modulepreload" crossorigin href="/assets/ui-X1rpq_CV.js">
			
 
				-    <link rel="stylesheet" crossorigin href="/assets/index-BNPqDOA1.css">
			
 
				+    <script type="module" crossorigin src="/assets/index-DJUmCqQa.js"></script>
			
 
				+    <link rel="modulepreload" crossorigin href="/assets/react-C4-CelXw.js">
			
 
				+    <link rel="modulepreload" crossorigin href="/assets/query-C_q0vuOo.js">
			
 
				+    <link rel="modulepreload" crossorigin href="/assets/ui-DsQixLUC.js">
			
 
				+    <link rel="modulepreload" crossorigin href="/assets/forms-DqymyfYA.js">
			
 
				+    <link rel="stylesheet" crossorigin href="/assets/index-C61UFTGs.css">
			
 
				   </head>
			
 
				   <body class="h-full bg-background text-foreground">
			
 
				     <div id="root" class="h-full"></div>
			
--- a/cmd/authd/main.go
+++ b/cmd/authd/main.go
@@ -101,6 +101,18 @@ func run(logger *slog.Logger) error {
 
				 	mux.Handle("POST /v1/users/invite", ad.RequireRole("super_admin", "tenant_admin")(inviteHandler(ad, logger)))
			
 
				 	mux.Handle("GET /v1/users/me", ad.RequireAuth(meHandler(ad, logger)))
			
 
				 
			
 
				+	// M13b W1: Tenant (company) CRUD. See cmd/authd/tenants.go.
			
 
				+	//   GET    /v1/tenants              — any auth (scope: super_admin sees all, others see own)
			
 
				+	//   POST   /v1/tenants              — super_admin only
			
 
				+	//   GET    /v1/tenants/{id}         — any auth (per-id scope check in handler)
			
 
				+	//   PATCH  /v1/tenants/{id}         — any auth (per-id scope + field scope in handler)
			
 
				+	//   POST   /v1/tenants/{id}/status  — super_admin only
			
 
				+	mux.Handle("GET /v1/tenants", ad.RequireAuth(listTenantsHandler(ad, logger)))
			
 
				+	mux.Handle("POST /v1/tenants", ad.RequireRole("super_admin")(createTenantHandler(ad, logger)))
			
 
				+	mux.Handle("GET /v1/tenants/{id}", ad.RequireAuth(getTenantHandler(ad, logger)))
			
 
				+	mux.Handle("PATCH /v1/tenants/{id}", ad.RequireAuth(updateTenantHandler(ad, logger)))
			
 
				+	mux.Handle("POST /v1/tenants/{id}/status", ad.RequireRole("super_admin")(setTenantStatusHandler(ad, logger)))
			
 
				+
			
 
				 	// Start in background, wait for signal, then graceful shutdown.
			
 
				 	errCh := make(chan error, 1)
			
 
				 	go func() { errCh <- srv.Start() }()
			
--- a/cmd/authd/tenants.go
+++ b/cmd/authd/tenants.go
@@ -0,0 +1,305 @@
 
				+// tenants.go — HTTP handlers for the /v1/tenants/* routes (M13b W1).
			
 
				+//
			
 
				+// Routes (all require a valid Bearer access JWT):
			
 
				+//
			
 
				+//   GET    /v1/tenants              — list (super_admin: all, tenant_admin: own only)
			
 
				+//   POST   /v1/tenants              — create (super_admin only)
			
 
				+//   GET    /v1/tenants/{id}         — detail (super_admin any, tenant_admin own only)
			
 
				+//   PATCH  /v1/tenants/{id}         — update (super_admin: any field, tenant_admin: own + display_name/contact_email only)
			
 
				+//   POST   /v1/tenants/{id}/status  — set status (super_admin only)
			
 
				+//
			
 
				+// Errors:
			
 
				+//   400 — bad input (validation, JSON parse)
			
 
				+//   401 — handled by RequireAuth middleware (no body rewrite here)
			
 
				+//   403 — role not allowed, or tenant_admin trying to access another tenant
			
 
				+//   404 — tenant id not found
			
 
				+//   409 — duplicate slug on create
			
 
				+//   500 — unexpected DB error
			
 
				+package main
			
 
				+
			
 
				+import (
			
 
				+	"encoding/json"
			
 
				+	"errors"
			
 
				+	"log/slog"
			
 
				+	"net/http"
			
 
				+	"strconv"
			
 
				+	"strings"
			
 
				+
			
 
				+	"git3.techno-world.net/lrosales/broad-announce/internal/authd"
			
 
				+)
			
 
				+
			
 
				+// tenantsListResponse is the wire shape for GET /v1/tenants.
			
 
				+// `total` is included for pagination (we cap limit at 500 for
			
 
				+// now; the UI shows total so operators know how many pages there
			
 
				+// are even if it caps the per-page count).
			
 
				+type tenantsListResponse struct {
			
 
				+	Items []authd.Tenant `json:"items"`
			
 
				+	Total int            `json:"total"`
			
 
				+	Limit int            `json:"limit"`
			
 
				+	Offset int           `json:"offset"`
			
 
				+}
			
 
				+
			
 
				+// listTenantsHandler wires GET /v1/tenants.
			
 
				+func listTenantsHandler(ad *authd.Authd, logger *slog.Logger) http.HandlerFunc {
			
 
				+	return func(w http.ResponseWriter, r *http.Request) {
			
 
				+		claims := authd.ClaimsFromContext(r.Context())
			
 
				+		if claims == nil {
			
 
				+			writeErr(w, http.StatusUnauthorized, "unauthorized", "claims missing")
			
 
				+			return
			
 
				+		}
			
 
				+		q := strings.TrimSpace(r.URL.Query().Get("q"))
			
 
				+		status := strings.TrimSpace(r.URL.Query().Get("status"))
			
 
				+		limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
			
 
				+		offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
			
 
				+		filter := authd.TenantFilter{
			
 
				+			Q:              q,
			
 
				+			Status:         status,
			
 
				+			Limit:          limit,
			
 
				+			Offset:         offset,
			
 
				+			CallerRole:     claims.Role,
			
 
				+			CallerTenantID: claims.TenantID,
			
 
				+		}
			
 
				+		items, total, err := ad.Store().ListTenants(r.Context(), filter)
			
 
				+		if err != nil {
			
 
				+			logger.Error("list tenants", "err", err, "actor", claims.UserID)
			
 
				+			writeErr(w, http.StatusInternalServerError, "internal", "list failed")
			
 
				+			return
			
 
				+		}
			
 
				+		if filter.Limit <= 0 {
			
 
				+			filter.Limit = 100
			
 
				+		}
			
 
				+		if filter.Limit > 500 {
			
 
				+			filter.Limit = 500
			
 
				+		}
			
 
				+		writeJSON(w, http.StatusOK, tenantsListResponse{
			
 
				+			Items: items, Total: total, Limit: filter.Limit, Offset: filter.Offset,
			
 
				+		})
			
 
				+	}
			
 
				+}
			
 
				+
			
 
				+// createTenantRequest is the POST /v1/tenants body. Mirrors the
			
 
				+// store's CreateTenantInput but with snake_case JSON tags.
			
 
				+type createTenantRequest struct {
			
 
				+	Slug            string `json:"slug"`
			
 
				+	DisplayName     string `json:"display_name"`
			
 
				+	ContactEmail    string `json:"contact_email"`
			
 
				+	RateLimitPerSec *int   `json:"rate_limit_per_sec"`
			
 
				+	FCMShared       *bool  `json:"fcm_shared"`
			
 
				+}
			
 
				+
			
 
				+// createTenantHandler wires POST /v1/tenants. Super_admin only —
			
 
				+// RequireRole is applied in main()'s mux.Handle call.
			
 
				+func createTenantHandler(ad *authd.Authd, logger *slog.Logger) http.HandlerFunc {
			
 
				+	return func(w http.ResponseWriter, r *http.Request) {
			
 
				+		claims := authd.ClaimsFromContext(r.Context())
			
 
				+		if claims == nil {
			
 
				+			writeErr(w, http.StatusUnauthorized, "unauthorized", "claims missing")
			
 
				+			return
			
 
				+		}
			
 
				+		var req createTenantRequest
			
 
				+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			
 
				+			writeErr(w, http.StatusBadRequest, "bad_request", "invalid JSON body")
			
 
				+			return
			
 
				+		}
			
 
				+		in := authd.CreateTenantInput{
			
 
				+			Slug:         strings.TrimSpace(req.Slug),
			
 
				+			DisplayName:  strings.TrimSpace(req.DisplayName),
			
 
				+			ContactEmail: strings.TrimSpace(req.ContactEmail),
			
 
				+			FCMShared:    req.FCMShared,
			
 
				+		}
			
 
				+		if req.RateLimitPerSec != nil {
			
 
				+			in.RateLimitPerSec = *req.RateLimitPerSec
			
 
				+		}
			
 
				+		ip := clientIP(r)
			
 
				+		ua := r.UserAgent()
			
 
				+		t, err := ad.Store().CreateTenant(r.Context(), in, claims.UserID, ip, ua)
			
 
				+		if err != nil {
			
 
				+			switch {
			
 
				+			case errors.Is(err, authd.ErrTenantSlugTaken):
			
 
				+				writeErr(w, http.StatusConflict, "slug_taken", "tenant slug already in use")
			
 
				+			case errors.Is(err, authd.ErrTenantInvalid):
			
 
				+				writeErr(w, http.StatusBadRequest, "invalid", err.Error())
			
 
				+			default:
			
 
				+				logger.Error("create tenant", "err", err, "actor", claims.UserID)
			
 
				+				writeErr(w, http.StatusInternalServerError, "internal", "create failed")
			
 
				+			}
			
 
				+			return
			
 
				+		}
			
 
				+		logger.Info("tenant created",
			
 
				+			"tenant_id", t.ID, "slug", t.Slug, "actor", claims.UserID)
			
 
				+		writeJSON(w, http.StatusCreated, t)
			
 
				+	}
			
 
				+}
			
 
				+
			
 
				+// getTenantHandler wires GET /v1/tenants/{id}. tenant_admin may
			
 
				+// only fetch their own tenant.
			
 
				+func getTenantHandler(ad *authd.Authd, logger *slog.Logger) http.HandlerFunc {
			
 
				+	return func(w http.ResponseWriter, r *http.Request) {
			
 
				+		claims := authd.ClaimsFromContext(r.Context())
			
 
				+		if claims == nil {
			
 
				+			writeErr(w, http.StatusUnauthorized, "unauthorized", "claims missing")
			
 
				+			return
			
 
				+		}
			
 
				+		id := r.PathValue("id")
			
 
				+		if !isUUID(id) {
			
 
				+			writeErr(w, http.StatusBadRequest, "bad_request", "tenant id must be a UUID")
			
 
				+			return
			
 
				+		}
			
 
				+		if !canAccessTenant(claims, id) {
			
 
				+			writeErr(w, http.StatusForbidden, "forbidden", "not your tenant")
			
 
				+			return
			
 
				+		}
			
 
				+		t, err := ad.Store().GetTenant(r.Context(), id)
			
 
				+		if err != nil {
			
 
				+			if errors.Is(err, authd.ErrTenantNotFound) {
			
 
				+				writeErr(w, http.StatusNotFound, "not_found", "tenant not found")
			
 
				+				return
			
 
				+			}
			
 
				+			logger.Error("get tenant", "err", err, "tenant_id", id)
			
 
				+			writeErr(w, http.StatusInternalServerError, "internal", "lookup failed")
			
 
				+			return
			
 
				+		}
			
 
				+		writeJSON(w, http.StatusOK, t)
			
 
				+	}
			
 
				+}
			
 
				+
			
 
				+// updateTenantRequest is the PATCH body. All fields optional.
			
 
				+type updateTenantRequest struct {
			
 
				+	DisplayName     *string `json:"display_name"`
			
 
				+	ContactEmail    *string `json:"contact_email"`
			
 
				+	RateLimitPerSec *int    `json:"rate_limit_per_sec"`
			
 
				+	FCMShared       *bool   `json:"fcm_shared"`
			
 
				+}
			
 
				+
			
 
				+// updateTenantHandler wires PATCH /v1/tenants/{id}. tenant_admin
			
 
				+// may only update display_name + contact_email on their own tenant.
			
 
				+func updateTenantHandler(ad *authd.Authd, logger *slog.Logger) http.HandlerFunc {
			
 
				+	return func(w http.ResponseWriter, r *http.Request) {
			
 
				+		claims := authd.ClaimsFromContext(r.Context())
			
 
				+		if claims == nil {
			
 
				+			writeErr(w, http.StatusUnauthorized, "unauthorized", "claims missing")
			
 
				+			return
			
 
				+		}
			
 
				+		id := r.PathValue("id")
			
 
				+		if !isUUID(id) {
			
 
				+			writeErr(w, http.StatusBadRequest, "bad_request", "tenant id must be a UUID")
			
 
				+			return
			
 
				+		}
			
 
				+		if !canAccessTenant(claims, id) {
			
 
				+			writeErr(w, http.StatusForbidden, "forbidden", "not your tenant")
			
 
				+			return
			
 
				+		}
			
 
				+		var req updateTenantRequest
			
 
				+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			
 
				+			writeErr(w, http.StatusBadRequest, "bad_request", "invalid JSON body")
			
 
				+			return
			
 
				+		}
			
 
				+		in := authd.UpdateTenantInput{
			
 
				+			DisplayName:     req.DisplayName,
			
 
				+			ContactEmail:    req.ContactEmail,
			
 
				+			RateLimitPerSec: req.RateLimitPerSec,
			
 
				+			FCMShared:       req.FCMShared,
			
 
				+		}
			
 
				+		// tenant_admin is restricted to display_name + contact_email
			
 
				+		// (enforced in the store via actorScopeAll).
			
 
				+		scopeAll := claims.Role == "super_admin"
			
 
				+		ip := clientIP(r)
			
 
				+		ua := r.UserAgent()
			
 
				+		t, err := ad.Store().UpdateTenant(r.Context(), id, in, scopeAll, claims.UserID, ip, ua)
			
 
				+		if err != nil {
			
 
				+			switch {
			
 
				+			case errors.Is(err, authd.ErrTenantNotFound):
			
 
				+				writeErr(w, http.StatusNotFound, "not_found", "tenant not found")
			
 
				+			case errors.Is(err, authd.ErrTenantInvalid):
			
 
				+				writeErr(w, http.StatusBadRequest, "invalid", err.Error())
			
 
				+			default:
			
 
				+				logger.Error("update tenant", "err", err, "tenant_id", id, "actor", claims.UserID)
			
 
				+				writeErr(w, http.StatusInternalServerError, "internal", "update failed")
			
 
				+			}
			
 
				+			return
			
 
				+		}
			
 
				+		logger.Info("tenant updated", "tenant_id", id, "actor", claims.UserID)
			
 
				+		writeJSON(w, http.StatusOK, t)
			
 
				+	}
			
 
				+}
			
 
				+
			
 
				+// setTenantStatusRequest is the POST /v1/tenants/{id}/status body.
			
 
				+type setTenantStatusRequest struct {
			
 
				+	Status string `json:"status"`
			
 
				+}
			
 
				+
			
 
				+// setTenantStatusHandler wires POST /v1/tenants/{id}/status.
			
 
				+// super_admin only — RequireRole is applied in main()'s mux.Handle
			
 
				+// call.
			
 
				+func setTenantStatusHandler(ad *authd.Authd, logger *slog.Logger) http.HandlerFunc {
			
 
				+	return func(w http.ResponseWriter, r *http.Request) {
			
 
				+		claims := authd.ClaimsFromContext(r.Context())
			
 
				+		if claims == nil {
			
 
				+			writeErr(w, http.StatusUnauthorized, "unauthorized", "claims missing")
			
 
				+			return
			
 
				+		}
			
 
				+		id := r.PathValue("id")
			
 
				+		if !isUUID(id) {
			
 
				+			writeErr(w, http.StatusBadRequest, "bad_request", "tenant id must be a UUID")
			
 
				+			return
			
 
				+		}
			
 
				+		var req setTenantStatusRequest
			
 
				+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			
 
				+			writeErr(w, http.StatusBadRequest, "bad_request", "invalid JSON body")
			
 
				+			return
			
 
				+		}
			
 
				+		ip := clientIP(r)
			
 
				+		ua := r.UserAgent()
			
 
				+		t, err := ad.Store().SetTenantStatus(r.Context(), id, strings.TrimSpace(req.Status), claims.UserID, ip, ua)
			
 
				+		if err != nil {
			
 
				+			switch {
			
 
				+			case errors.Is(err, authd.ErrTenantNotFound):
			
 
				+				writeErr(w, http.StatusNotFound, "not_found", "tenant not found")
			
 
				+			case errors.Is(err, authd.ErrTenantInvalid):
			
 
				+				writeErr(w, http.StatusBadRequest, "invalid", err.Error())
			
 
				+			default:
			
 
				+				logger.Error("set tenant status", "err", err, "tenant_id", id, "actor", claims.UserID)
			
 
				+				writeErr(w, http.StatusInternalServerError, "internal", "update failed")
			
 
				+			}
			
 
				+			return
			
 
				+		}
			
 
				+		logger.Info("tenant status changed",
			
 
				+			"tenant_id", id, "to", t.Status, "actor", claims.UserID)
			
 
				+		writeJSON(w, http.StatusOK, t)
			
 
				+	}
			
 
				+}
			
 
				+
			
 
				+// canAccessTenant returns true if the caller's role + tenant_id
			
 
				+// grant access to the given tenant id. super_admin may access any.
			
 
				+// tenant_admin / viewer may only access their own.
			
 
				+func canAccessTenant(claims *authd.AccessClaims, tenantID string) bool {
			
 
				+	if claims == nil {
			
 
				+		return false
			
 
				+	}
			
 
				+	if claims.Role == "super_admin" {
			
 
				+		return true
			
 
				+	}
			
 
				+	return claims.TenantID == tenantID
			
 
				+}
			
 
				+
			
 
				+// isUUID is a lenient UUID format check (any 8-4-4-4-12 hex
			
 
				+// blob). Postgres will reject malformed values on the actual
			
 
				+// query; this is just to keep the 400s out of the 500s.
			
 
				+func isUUID(s string) bool {
			
 
				+	if len(s) != 36 {
			
 
				+		return false
			
 
				+	}
			
 
				+	for i, c := range s {
			
 
				+		switch i {
			
 
				+		case 8, 13, 18, 23:
			
 
				+			if c != '-' {
			
 
				+				return false
			
 
				+			}
			
 
				+		default:
			
 
				+			if !((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F')) {
			
 
				+				return false
			
 
				+			}
			
 
				+		}
			
 
				+	}
			
 
				+	return true
			
 
				+}
			
--- a/internal/authd/tenants.go
+++ b/internal/authd/tenants.go
@@ -0,0 +1,471 @@
 
				+// Package authd — tenants.go: Tenant (a.k.a. company) CRUD.
			
 
				+//
			
 
				+// The M13a schema (009_auth.up.sql) introduced the auth.tenants
			
 
				+// table. M13b W1 turns that into a fully-managed resource in the
			
 
				+// admin UI: super-admins can create / list / edit / suspend /
			
 
				+// activate tenants; tenant-admins get a read-only view of their
			
 
				+// own tenant. All state transitions write an audit_log row so the
			
 
				+// Audit log UI (M13c) can show "who suspended tenant X, when".
			
 
				+//
			
 
				+// Threading: safe for concurrent use (pgx pool is goroutine-safe).
			
 
				+
			
 
				+package authd
			
 
				+
			
 
				+import (
			
 
				+	"context"
			
 
				+	"errors"
			
 
				+	"fmt"
			
 
				+	"strings"
			
 
				+	"time"
			
 
				+
			
 
				+	"github.com/jackc/pgx/v5"
			
 
				+	"github.com/jackc/pgx/v5/pgconn"
			
 
				+
			
 
				+)
			
 
				+
			
 
				+// Tenant is the wire shape returned to handlers / JSON callers.
			
 
				+// The wire shape is kept flat and snake_case to match the rest
			
 
				+// of the M13a / M13b admin API.
			
 
				+type Tenant struct {
			
 
				+	ID                string     `json:"id"`
			
 
				+	Slug              string     `json:"slug"`
			
 
				+	DisplayName       string     `json:"display_name"`
			
 
				+	Status            string     `json:"status"`
			
 
				+	ContactEmail      string     `json:"contact_email"`
			
 
				+	RateLimitPerSec   int        `json:"rate_limit_per_sec"`
			
 
				+	FCMShared         bool       `json:"fcm_shared"`
			
 
				+	CreatedAt         time.Time  `json:"created_at"`
			
 
				+	UpdatedAt         time.Time  `json:"updated_at"`
			
 
				+	ArchivedAt        *time.Time `json:"archived_at,omitempty"`
			
 
				+}
			
 
				+
			
 
				+// ErrTenantNotFound is returned when a tenant id or slug does not
			
 
				+// exist. Distinct from ErrUserNotFound so callers can disambiguate.
			
 
				+var ErrTenantNotFound = errors.New("authd: tenant not found")
			
 
				+
			
 
				+// ErrTenantSlugTaken is returned when CreateTenant sees a slug
			
 
				+// collision. UI surfaces this as a 409.
			
 
				+var ErrTenantSlugTaken = errors.New("authd: tenant slug already taken")
			
 
				+
			
 
				+// ErrTenantInvalid is returned when input validation fails (e.g.
			
 
				+// slug doesn't match the regex, or rate_limit_per_sec is out of
			
 
				+// range). The wrapped error string is safe to surface to the UI.
			
 
				+var ErrTenantInvalid = errors.New("authd: tenant input invalid")
			
 
				+
			
 
				+// TenantFilter controls ListTenants. Empty fields mean "no filter".
			
 
				+// Limit caps the result count; 0 → default of 100. Max 500.
			
 
				+type TenantFilter struct {
			
 
				+	Q      string // matches slug OR display_name (ILIKE)
			
 
				+	Status string // exact match: "active" | "suspended" | "archived" | ""
			
 
				+	Limit  int
			
 
				+	Offset int
			
 
				+	// Scope controls what's visible.
			
 
				+	//   "all"   — super_admin only: every tenant
			
 
				+	//   "self"  — returns the single tenant matching CallerTenantID
			
 
				+	CallerRole     string
			
 
				+	CallerTenantID string
			
 
				+}
			
 
				+
			
 
				+// ListTenants returns the tenants visible to the caller under the
			
 
				+// given filter, plus the total count (for pagination in the UI).
			
 
				+func (s *Store) ListTenants(ctx context.Context, f TenantFilter) ([]Tenant, int, error) {
			
 
				+	if s.pool == nil {
			
 
				+		return nil, 0, errors.New("authd: no DB pool (test mode)")
			
 
				+	}
			
 
				+	if f.Limit <= 0 {
			
 
				+		f.Limit = 100
			
 
				+	}
			
 
				+	if f.Limit > 500 {
			
 
				+		f.Limit = 500
			
 
				+	}
			
 
				+
			
 
				+	// Build the WHERE clause. We use $N-style placeholders that
			
 
				+	// we count as we go so it's safe to extend.
			
 
				+	args := []any{}
			
 
				+	conds := []string{}
			
 
				+
			
 
				+	if strings.TrimSpace(f.Status) != "" {
			
 
				+		args = append(args, f.Status)
			
 
				+		conds = append(conds, fmt.Sprintf("status = $%d", len(args)))
			
 
				+	}
			
 
				+	if strings.TrimSpace(f.Q) != "" {
			
 
				+		args = append(args, "%"+strings.TrimSpace(f.Q)+"%")
			
 
				+		conds = append(conds, fmt.Sprintf("(slug ILIKE $%d OR display_name ILIKE $%d)", len(args), len(args)))
			
 
				+	}
			
 
				+	// Scope: tenant_admin only sees their own tenant.
			
 
				+	if f.CallerRole != "super_admin" {
			
 
				+		if f.CallerTenantID == "" {
			
 
				+			// A non-super_admin without a tenant_id has no business
			
 
				+			// listing tenants. Return an empty page so the UI
			
 
				+			// shows "0 results" rather than leaking the existence
			
 
				+			// of other tenants.
			
 
				+			return []Tenant{}, 0, nil
			
 
				+		}
			
 
				+		args = append(args, f.CallerTenantID)
			
 
				+		conds = append(conds, fmt.Sprintf("id = $%d", len(args)))
			
 
				+	}
			
 
				+	where := ""
			
 
				+	if len(conds) > 0 {
			
 
				+		where = "WHERE " + strings.Join(conds, " AND ")
			
 
				+	}
			
 
				+
			
 
				+	// Count first (cheap, uses the same WHERE).
			
 
				+	var total int
			
 
				+	countQ := "SELECT COUNT(*) FROM auth.tenants " + where
			
 
				+	if err := s.pool.QueryRow(ctx, countQ, args...).Scan(&total); err != nil {
			
 
				+		return nil, 0, fmt.Errorf("count tenants: %w", err)
			
 
				+	}
			
 
				+
			
 
				+	// Then the page.
			
 
				+	args = append(args, f.Limit, f.Offset)
			
 
				+	pageQ := fmt.Sprintf(`
			
 
				+		SELECT id::text, slug, display_name, status, contact_email,
			
 
				+		       rate_limit_per_sec, fcm_shared, created_at, updated_at, archived_at
			
 
				+		FROM auth.tenants
			
 
				+		%s
			
 
				+		ORDER BY created_at DESC
			
 
				+		LIMIT $%d OFFSET $%d
			
 
				+	`, where, len(args)-1, len(args))
			
 
				+	rows, err := s.pool.Query(ctx, pageQ, args...)
			
 
				+	if err != nil {
			
 
				+		return nil, 0, fmt.Errorf("list tenants: %w", err)
			
 
				+	}
			
 
				+	defer rows.Close()
			
 
				+	out := make([]Tenant, 0, f.Limit)
			
 
				+	for rows.Next() {
			
 
				+		var t Tenant
			
 
				+		if err := rows.Scan(
			
 
				+			&t.ID, &t.Slug, &t.DisplayName, &t.Status, &t.ContactEmail,
			
 
				+			&t.RateLimitPerSec, &t.FCMShared, &t.CreatedAt, &t.UpdatedAt, &t.ArchivedAt,
			
 
				+		); err != nil {
			
 
				+			return nil, 0, fmt.Errorf("scan tenant: %w", err)
			
 
				+		}
			
 
				+		out = append(out, t)
			
 
				+	}
			
 
				+	if err := rows.Err(); err != nil {
			
 
				+		return nil, 0, fmt.Errorf("rows: %w", err)
			
 
				+	}
			
 
				+	return out, total, nil
			
 
				+}
			
 
				+
			
 
				+// GetTenant fetches a single tenant by id.
			
 
				+func (s *Store) GetTenant(ctx context.Context, id string) (*Tenant, error) {
			
 
				+	if s.pool == nil {
			
 
				+		return nil, errors.New("authd: no DB pool (test mode)")
			
 
				+	}
			
 
				+	const q = `
			
 
				+		SELECT id::text, slug, display_name, status, contact_email,
			
 
				+		       rate_limit_per_sec, fcm_shared, created_at, updated_at, archived_at
			
 
				+		FROM auth.tenants
			
 
				+		WHERE id = $1
			
 
				+	`
			
 
				+	t := &Tenant{}
			
 
				+	err := s.pool.QueryRow(ctx, q, id).Scan(
			
 
				+		&t.ID, &t.Slug, &t.DisplayName, &t.Status, &t.ContactEmail,
			
 
				+		&t.RateLimitPerSec, &t.FCMShared, &t.CreatedAt, &t.UpdatedAt, &t.ArchivedAt,
			
 
				+	)
			
 
				+	if err != nil {
			
 
				+		if errors.Is(err, pgx.ErrNoRows) {
			
 
				+			return nil, ErrTenantNotFound
			
 
				+		}
			
 
				+		return nil, fmt.Errorf("get tenant: %w", err)
			
 
				+	}
			
 
				+	return t, nil
			
 
				+}
			
 
				+
			
 
				+// CreateTenantInput is the validated create payload.
			
 
				+type CreateTenantInput struct {
			
 
				+	Slug            string
			
 
				+	DisplayName     string
			
 
				+	ContactEmail    string
			
 
				+	RateLimitPerSec int
			
 
				+	FCMShared       *bool // nil → use default true
			
 
				+}
			
 
				+
			
 
				+// Validate runs the constraints the DB enforces, but earlier and
			
 
				+// with friendlier error messages for the UI.
			
 
				+func (in *CreateTenantInput) Validate() error {
			
 
				+	if !validSlug(in.Slug) {
			
 
				+		return fmt.Errorf("%w: slug must match ^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$", ErrTenantInvalid)
			
 
				+	}
			
 
				+	if strings.TrimSpace(in.DisplayName) == "" {
			
 
				+		return fmt.Errorf("%w: display_name is required", ErrTenantInvalid)
			
 
				+	}
			
 
				+	if !looksLikeEmail(in.ContactEmail) {
			
 
				+		return fmt.Errorf("%w: contact_email is not a valid email", ErrTenantInvalid)
			
 
				+	}
			
 
				+	if in.RateLimitPerSec < 1 || in.RateLimitPerSec > 1_000_000 {
			
 
				+		return fmt.Errorf("%w: rate_limit_per_sec must be 1..1000000", ErrTenantInvalid)
			
 
				+	}
			
 
				+	return nil
			
 
				+}
			
 
				+
			
 
				+// CreateTenant inserts a new tenant in 'active' status and writes
			
 
				+// an audit_log row. Returns the new id. Duplicate slug →
			
 
				+// ErrTenantSlugTaken (so the UI can show a 409).
			
 
				+func (s *Store) CreateTenant(ctx context.Context, in CreateTenantInput, actorUserID, actorIP, actorUA string) (*Tenant, error) {
			
 
				+	if s.pool == nil {
			
 
				+		return nil, errors.New("authd: no DB pool (test mode)")
			
 
				+	}
			
 
				+	if err := in.Validate(); err != nil {
			
 
				+		return nil, err
			
 
				+	}
			
 
				+	fcmShared := true
			
 
				+	if in.FCMShared != nil {
			
 
				+		fcmShared = *in.FCMShared
			
 
				+	}
			
 
				+	const q = `
			
 
				+		INSERT INTO auth.tenants
			
 
				+		    (slug, display_name, contact_email, rate_limit_per_sec, fcm_shared, status)
			
 
				+		VALUES
			
 
				+		    ($1, $2, $3, $4, $5, 'active')
			
 
				+		RETURNING id::text
			
 
				+	`
			
 
				+	var id string
			
 
				+	err := s.pool.QueryRow(ctx, q,
			
 
				+		in.Slug, in.DisplayName, in.ContactEmail, in.RateLimitPerSec, fcmShared,
			
 
				+	).Scan(&id)
			
 
				+	if err != nil {
			
 
				+		var pgErr *pgconn.PgError
			
 
				+		if errors.As(err, &pgErr) && pgErr.Code == "23505" {
			
 
				+			return nil, ErrTenantSlugTaken
			
 
				+		}
			
 
				+		return nil, fmt.Errorf("create tenant: %w", err)
			
 
				+	}
			
 
				+	if err := s.WriteAudit(ctx, "tenant.create", actorUserID, actorIP, actorUA, id, id, map[string]any{
			
 
				+		"slug":              in.Slug,
			
 
				+		"display_name":      in.DisplayName,
			
 
				+		"contact_email":     in.ContactEmail,
			
 
				+		"rate_limit_per_sec": in.RateLimitPerSec,
			
 
				+		"fcm_shared":        fcmShared,
			
 
				+	}); err != nil {
			
 
				+		// Audit failure is non-fatal: log and continue. The tenant
			
 
				+		// was created; the audit row is observability, not authz.
			
 
				+		// Errors are returned via fmt.Errorf wrapping; callers may
			
 
				+		// log them. We don't return the error to the caller.
			
 
				+		_ = err
			
 
				+	}
			
 
				+	return s.GetTenant(ctx, id)
			
 
				+}
			
 
				+
			
 
				+// UpdateTenantInput is the validated update payload. Pointer
			
 
				+// fields mean "leave unchanged" when nil — this is the standard
			
 
				+// PATCH semantics.
			
 
				+type UpdateTenantInput struct {
			
 
				+	DisplayName     *string
			
 
				+	ContactEmail    *string
			
 
				+	RateLimitPerSec *int
			
 
				+	FCMShared       *bool
			
 
				+}
			
 
				+
			
 
				+// Validate runs the constraints the DB enforces, but earlier.
			
 
				+func (in *UpdateTenantInput) Validate() error {
			
 
				+	if in.DisplayName != nil && strings.TrimSpace(*in.DisplayName) == "" {
			
 
				+		return fmt.Errorf("%w: display_name cannot be empty", ErrTenantInvalid)
			
 
				+	}
			
 
				+	if in.ContactEmail != nil && !looksLikeEmail(*in.ContactEmail) {
			
 
				+		return fmt.Errorf("%w: contact_email is not a valid email", ErrTenantInvalid)
			
 
				+	}
			
 
				+	if in.RateLimitPerSec != nil && (*in.RateLimitPerSec < 1 || *in.RateLimitPerSec > 1_000_000) {
			
 
				+		return fmt.Errorf("%w: rate_limit_per_sec must be 1..1000000", ErrTenantInvalid)
			
 
				+	}
			
 
				+	return nil
			
 
				+}
			
 
				+
			
 
				+// UpdateTenant applies a partial update and writes an audit_log
			
 
				+// row with the changed fields. Returns the new state.
			
 
				+//
			
 
				+// "actorScopeAll" controls whether the caller can edit every
			
 
				+// field (super_admin) or only display_name + contact_email
			
 
				+// (tenant_admin on their own tenant). If false and the patch
			
 
				+// includes a restricted field, returns ErrTenantInvalid.
			
 
				+func (s *Store) UpdateTenant(
			
 
				+	ctx context.Context,
			
 
				+	id string,
			
 
				+	in UpdateTenantInput,
			
 
				+	actorScopeAll bool,
			
 
				+	actorUserID, actorIP, actorUA string,
			
 
				+) (*Tenant, error) {
			
 
				+	if s.pool == nil {
			
 
				+		return nil, errors.New("authd: no DB pool (test mode)")
			
 
				+	}
			
 
				+	if err := in.Validate(); err != nil {
			
 
				+		return nil, err
			
 
				+	}
			
 
				+	// Tenant_admin is restricted to display_name + contact_email.
			
 
				+	if !actorScopeAll {
			
 
				+		if in.RateLimitPerSec != nil || in.FCMShared != nil {
			
 
				+			return nil, fmt.Errorf("%w: only super_admin can change rate_limit_per_sec or fcm_shared", ErrTenantInvalid)
			
 
				+		}
			
 
				+	}
			
 
				+
			
 
				+	// Build the SET clause incrementally so unset fields don't
			
 
				+	// touch the row.
			
 
				+	sets := []string{}
			
 
				+	args := []any{pgid(id)}
			
 
				+	if in.DisplayName != nil {
			
 
				+		args = append(args, strings.TrimSpace(*in.DisplayName))
			
 
				+		sets = append(sets, fmt.Sprintf("display_name = $%d", len(args)))
			
 
				+	}
			
 
				+	if in.ContactEmail != nil {
			
 
				+		args = append(args, *in.ContactEmail)
			
 
				+		sets = append(sets, fmt.Sprintf("contact_email = $%d", len(args)))
			
 
				+	}
			
 
				+	if in.RateLimitPerSec != nil {
			
 
				+		args = append(args, *in.RateLimitPerSec)
			
 
				+		sets = append(sets, fmt.Sprintf("rate_limit_per_sec = $%d", len(args)))
			
 
				+	}
			
 
				+	if in.FCMShared != nil {
			
 
				+		args = append(args, *in.FCMShared)
			
 
				+		sets = append(sets, fmt.Sprintf("fcm_shared = $%d", len(args)))
			
 
				+	}
			
 
				+	if len(sets) == 0 {
			
 
				+		// Nothing to change. Return the current state.
			
 
				+		return s.GetTenant(ctx, id)
			
 
				+	}
			
 
				+	q := fmt.Sprintf(`UPDATE auth.tenants SET %s WHERE id = $1`, strings.Join(sets, ", "))
			
 
				+	tag, err := s.pool.Exec(ctx, q, args...)
			
 
				+	if err != nil {
			
 
				+		return nil, fmt.Errorf("update tenant: %w", err)
			
 
				+	}
			
 
				+	if tag.RowsAffected() == 0 {
			
 
				+		return nil, ErrTenantNotFound
			
 
				+	}
			
 
				+
			
 
				+	// Build audit payload (only the fields the caller sent).
			
 
				+	payload := map[string]any{}
			
 
				+	if in.DisplayName != nil {
			
 
				+		payload["display_name"] = *in.DisplayName
			
 
				+	}
			
 
				+	if in.ContactEmail != nil {
			
 
				+		payload["contact_email"] = *in.ContactEmail
			
 
				+	}
			
 
				+	if in.RateLimitPerSec != nil {
			
 
				+		payload["rate_limit_per_sec"] = *in.RateLimitPerSec
			
 
				+	}
			
 
				+	if in.FCMShared != nil {
			
 
				+		payload["fcm_shared"] = *in.FCMShared
			
 
				+	}
			
 
				+	if err := s.WriteAudit(ctx, "tenant.update", actorUserID, actorIP, actorUA, id, id, payload); err != nil {
			
 
				+		_ = err
			
 
				+	}
			
 
				+	return s.GetTenant(ctx, id)
			
 
				+}
			
 
				+
			
 
				+// SetTenantStatus changes the status. Allowed transitions:
			
 
				+//   active    -> suspended, archived
			
 
				+//   suspended -> active, archived
			
 
				+//   archived  -> (terminal — no transitions out of archived)
			
 
				+//
			
 
				+// archived is terminal. Setting status=archived also stamps
			
 
				+// archived_at = NOW(). Writes an audit_log row with the
			
 
				+// {from, to} transition.
			
 
				+func (s *Store) SetTenantStatus(
			
 
				+	ctx context.Context,
			
 
				+	id, newStatus string,
			
 
				+	actorUserID, actorIP, actorUA string,
			
 
				+) (*Tenant, error) {
			
 
				+	if s.pool == nil {
			
 
				+		return nil, errors.New("authd: no DB pool (test mode)")
			
 
				+	}
			
 
				+	switch newStatus {
			
 
				+	case "active", "suspended", "archived":
			
 
				+	default:
			
 
				+		return nil, fmt.Errorf("%w: status must be active|suspended|archived", ErrTenantInvalid)
			
 
				+	}
			
 
				+	cur, err := s.GetTenant(ctx, id)
			
 
				+	if err != nil {
			
 
				+		return nil, err
			
 
				+	}
			
 
				+	if cur.Status == "archived" {
			
 
				+		return nil, fmt.Errorf("%w: tenant is archived (terminal)", ErrTenantInvalid)
			
 
				+	}
			
 
				+	if cur.Status == newStatus {
			
 
				+		// No-op transition. Return the current state.
			
 
				+		return cur, nil
			
 
				+	}
			
 
				+
			
 
				+	var q string
			
 
				+	var args []any
			
 
				+	if newStatus == "archived" {
			
 
				+		q = `UPDATE auth.tenants SET status = $2, archived_at = NOW() WHERE id = $1`
			
 
				+		args = []any{pgid(id), newStatus}
			
 
				+	} else {
			
 
				+		q = `UPDATE auth.tenants SET status = $2, archived_at = NULL WHERE id = $1`
			
 
				+		args = []any{pgid(id), newStatus}
			
 
				+	}
			
 
				+	tag, err := s.pool.Exec(ctx, q, args...)
			
 
				+	if err != nil {
			
 
				+		return nil, fmt.Errorf("set tenant status: %w", err)
			
 
				+	}
			
 
				+	if tag.RowsAffected() == 0 {
			
 
				+		return nil, ErrTenantNotFound
			
 
				+	}
			
 
				+	if err := s.WriteAudit(ctx, "tenant.status", actorUserID, actorIP, actorUA, id, id, map[string]any{
			
 
				+		"from": cur.Status,
			
 
				+		"to":   newStatus,
			
 
				+	}); err != nil {
			
 
				+		_ = err
			
 
				+	}
			
 
				+	return s.GetTenant(ctx, id)
			
 
				+}
			
 
				+
			
 
				+// pgid is a tiny helper that keeps the call sites readable: we
			
 
				+// only ever pass a single id as the first arg, and we want it to
			
 
				+// be parsed as a UUID by Postgres.
			
 
				+func pgid(id string) any { return id }
			
 
				+
			
 
				+// -------------------------------------------------------------------
			
 
				+// input validation
			
 
				+// -------------------------------------------------------------------
			
 
				+
			
 
				+// validSlug matches the regex on the slug column:
			
 
				+//
			
 
				+//   ^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$
			
 
				+//
			
 
				+// Inlined (not via regexp package) because the pattern is fixed
			
 
				+// and the package would add 50KB of binary.
			
 
				+func validSlug(s string) bool {
			
 
				+	if len(s) < 2 || len(s) > 64 {
			
 
				+		return false
			
 
				+	}
			
 
				+	if !isAlnumOrDash(s[0]) || s[0] == '-' {
			
 
				+		return false
			
 
				+	}
			
 
				+	if !isAlnumOrDash(s[len(s)-1]) || s[len(s)-1] == '-' {
			
 
				+		return false
			
 
				+	}
			
 
				+	for i := 1; i < len(s)-1; i++ {
			
 
				+		if !isAlnumOrDash(s[i]) {
			
 
				+			return false
			
 
				+		}
			
 
				+	}
			
 
				+	return true
			
 
				+}
			
 
				+
			
 
				+func isAlnumOrDash(c byte) bool {
			
 
				+	return (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '-'
			
 
				+}
			
 
				+
			
 
				+// looksLikeEmail is intentionally permissive: we just enforce
			
 
				+// the local-part, the '@', and a non-empty domain with at least
			
 
				+// one dot that isn't at the edge. Bounces are caught by the
			
 
				+// actual mail server, not by the admin UI.
			
 
				+func looksLikeEmail(s string) bool {
			
 
				+	s = strings.TrimSpace(s)
			
 
				+	if s == "" || len(s) > 254 {
			
 
				+		return false
			
 
				+	}
			
 
				+	at := strings.IndexByte(s, '@')
			
 
				+	if at < 1 || at == len(s)-1 {
			
 
				+		return false
			
 
				+	}
			
 
				+	domain := s[at+1:]
			
 
				+	if len(domain) < 3 {
			
 
				+		return false
			
 
				+	}
			
 
				+	if domain[0] == '.' || domain[len(domain)-1] == '.' {
			
 
				+		return false
			
 
				+	}
			
 
				+	return strings.Contains(domain, ".")
			
 
				+}
			
--- a/internal/authd/tenants_test.go
+++ b/internal/authd/tenants_test.go
@@ -0,0 +1,137 @@
 
				+// tenants_test.go — Pure-Go tests for the validation helpers and
			
 
				+// the input structs on the tenants store. The DB-backed paths
			
 
				+// (Create, Update, SetStatus, List) are tested in
			
 
				+// tenants_pg_test.go under the 'postgres' build tag.
			
 
				+
			
 
				+package authd
			
 
				+
			
 
				+import (
			
 
				+	"errors"
			
 
				+	"testing"
			
 
				+)
			
 
				+
			
 
				+func TestValidSlug(t *testing.T) {
			
 
				+	cases := []struct {
			
 
				+		in   string
			
 
				+		want bool
			
 
				+	}{
			
 
				+		// valid
			
 
				+		{"a", false},
			
 
				+		{"ab", true},
			
 
				+		{"acme", true},
			
 
				+		{"acme-corp", true},
			
 
				+		{"a-1-b-2", true},
			
 
				+		{"x" + repeat("y", 62) + "z", true}, // exactly 64 chars
			
 
				+		// invalid
			
 
				+		{"", false},
			
 
				+		{"A", false},       // uppercase
			
 
				+		{"-acme", false},   // leading dash
			
 
				+		{"acme-", false},   // trailing dash
			
 
				+		{"acme--corp", true}, // double dash is allowed by the regex
			
 
				+		{"acme_corp", false}, // underscore
			
 
				+		{"acme.corp", false}, // dot
			
 
				+		{"acme corp", false}, // space
			
 
				+		{repeat("a", 65), false}, // too long
			
 
				+	}
			
 
				+	for _, c := range cases {
			
 
				+		if got := validSlug(c.in); got != c.want {
			
 
				+			t.Errorf("validSlug(%q) = %v, want %v", c.in, got, c.want)
			
 
				+		}
			
 
				+	}
			
 
				+}
			
 
				+
			
 
				+func TestLooksLikeEmail(t *testing.T) {
			
 
				+	cases := []struct {
			
 
				+		in   string
			
 
				+		want bool
			
 
				+	}{
			
 
				+		{"a@b.c", true},
			
 
				+		{"ops@acme.test", true},
			
 
				+		{"first.last@sub.acme.test", true},
			
 
				+		{"a@b", false},      // no dot in domain
			
 
				+		{"@b.c", false},     // no local part
			
 
				+		{"a@.c", false},     // dot at start of domain
			
 
				+		{"a@b.", false},     // dot at end of domain
			
 
				+		{"", false},
			
 
				+		{"  a@b.c  ", true}, // trimmed
			
 
				+		{repeat("a", 251) + "@b.c", false}, // 255 chars (RFC max 254)
			
 
				+	}
			
 
				+	for _, c := range cases {
			
 
				+		if got := looksLikeEmail(c.in); got != c.want {
			
 
				+			t.Errorf("looksLikeEmail(%q) = %v, want %v", c.in, got, c.want)
			
 
				+		}
			
 
				+	}
			
 
				+}
			
 
				+
			
 
				+func TestCreateTenantInput_Validate(t *testing.T) {
			
 
				+	good := CreateTenantInput{
			
 
				+		Slug: "acme", DisplayName: "Acme", ContactEmail: "ops@acme.test",
			
 
				+		RateLimitPerSec: 1000, FCMShared: nil,
			
 
				+	}
			
 
				+	if err := good.Validate(); err != nil {
			
 
				+		t.Errorf("good input rejected: %v", err)
			
 
				+	}
			
 
				+
			
 
				+	cases := []struct {
			
 
				+		name string
			
 
				+		in   CreateTenantInput
			
 
				+		ok   bool
			
 
				+	}{
			
 
				+		{"empty slug", CreateTenantInput{Slug: "", DisplayName: "Acme", ContactEmail: "a@b.c", RateLimitPerSec: 100}, false},
			
 
				+		{"bad slug", CreateTenantInput{Slug: "Bad Slug", DisplayName: "Acme", ContactEmail: "a@b.c", RateLimitPerSec: 100}, false},
			
 
				+		{"empty display name", CreateTenantInput{Slug: "acme", DisplayName: "", ContactEmail: "a@b.c", RateLimitPerSec: 100}, false},
			
 
				+		{"bad email", CreateTenantInput{Slug: "acme", DisplayName: "Acme", ContactEmail: "not-an-email", RateLimitPerSec: 100}, false},
			
 
				+		{"rl=0", CreateTenantInput{Slug: "acme", DisplayName: "Acme", ContactEmail: "a@b.c", RateLimitPerSec: 0}, false},
			
 
				+		{"rl too high", CreateTenantInput{Slug: "acme", DisplayName: "Acme", ContactEmail: "a@b.c", RateLimitPerSec: 2_000_000}, false},
			
 
				+		{"rl at max", CreateTenantInput{Slug: "acme", DisplayName: "Acme", ContactEmail: "a@b.c", RateLimitPerSec: 1_000_000}, true},
			
 
				+		{"rl at min", CreateTenantInput{Slug: "acme", DisplayName: "Acme", ContactEmail: "a@b.c", RateLimitPerSec: 1}, true},
			
 
				+	}
			
 
				+	for _, c := range cases {
			
 
				+		err := c.in.Validate()
			
 
				+		if c.ok && err != nil {
			
 
				+			t.Errorf("%s: expected ok, got %v", c.name, err)
			
 
				+		}
			
 
				+		if !c.ok && err == nil {
			
 
				+			t.Errorf("%s: expected error, got nil", c.name)
			
 
				+		}
			
 
				+		if !c.ok && err != nil && !errors.Is(err, ErrTenantInvalid) {
			
 
				+			t.Errorf("%s: expected ErrTenantInvalid, got %v", c.name, err)
			
 
				+		}
			
 
				+	}
			
 
				+}
			
 
				+
			
 
				+func TestUpdateTenantInput_Validate(t *testing.T) {
			
 
				+	// empty patch → ok
			
 
				+	empty := &UpdateTenantInput{}
			
 
				+	if err := empty.Validate(); err != nil {
			
 
				+		t.Errorf("empty patch rejected: %v", err)
			
 
				+	}
			
 
				+	dn := "Acme Corp"
			
 
				+	ce := "ops@acme.test"
			
 
				+	rl := 500
			
 
				+	good := &UpdateTenantInput{DisplayName: &dn, ContactEmail: &ce, RateLimitPerSec: &rl}
			
 
				+	if err := good.Validate(); err != nil {
			
 
				+		t.Errorf("good patch rejected: %v", err)
			
 
				+	}
			
 
				+
			
 
				+	badName := ""
			
 
				+	if err := (&UpdateTenantInput{DisplayName: &badName}).Validate(); err == nil {
			
 
				+		t.Error("empty display_name should fail")
			
 
				+	}
			
 
				+	badEmail := "not-an-email"
			
 
				+	if err := (&UpdateTenantInput{ContactEmail: &badEmail}).Validate(); err == nil {
			
 
				+		t.Error("bad contact_email should fail")
			
 
				+	}
			
 
				+	badRl := 0
			
 
				+	if err := (&UpdateTenantInput{RateLimitPerSec: &badRl}).Validate(); err == nil {
			
 
				+		t.Error("rl=0 should fail")
			
 
				+	}
			
 
				+}
			
 
				+
			
 
				+func repeat(s string, n int) string {
			
 
				+	out := make([]byte, 0, len(s)*n)
			
 
				+	for i := 0; i < n; i++ {
			
 
				+		out = append(out, s...)
			
 
				+	}
			
 
				+	return string(out)
			
 
				+}
			
--- a/migrations/010_tenants_fields.down.sql
+++ b/migrations/010_tenants_fields.down.sql
@@ -0,0 +1,7 @@
 
				+-- 010_tenants_fields.down.sql
			
 
				+-- Reverse the M13b W1 tenant operational fields.
			
 
				+
			
 
				+SET search_path TO auth, public;
			
 
				+
			
 
				+ALTER TABLE auth.tenants DROP COLUMN IF EXISTS fcm_shared;
			
 
				+ALTER TABLE auth.tenants DROP COLUMN IF EXISTS rate_limit_per_sec;
			
--- a/migrations/010_tenants_fields.up.sql
+++ b/migrations/010_tenants_fields.up.sql
@@ -0,0 +1,31 @@
 
				+-- 010_tenants_fields.up.sql
			
 
				+-- M13b W1: Tenant (company) operational fields.
			
 
				+--
			
 
				+-- Adds the per-tenant knobs the admin UI needs to manage:
			
 
				+--
			
 
				+--   rate_limit_per_sec INTEGER
			
 
				+--     Cap on ingest events/sec for this tenant. Default 10000 (the
			
 
				+--     value used in v1 everywhere). Enforced by the ingestion
			
 
				+--     pipeline per-tenant (the per-tenant key is a known pattern;
			
 
				+--     the existing M1/M4 ingest uses company_id from the event).
			
 
				+--
			
 
				+--   fcm_shared BOOLEAN
			
 
				+--     When true, this tenant's FCM traffic uses the shared HTTP/2
			
 
				+--     pool (the default in M8+). When false, future code can pin
			
 
				+--     this tenant to a dedicated sender ID. Read by deliverd-fcm
			
 
				+--     when picking a sender. W1 only persists the flag; the
			
 
				+--     read-side is wired in M13b W3 (Telegram) where the same
			
 
				+--     multi-tenant pool isolation story lives.
			
 
				+--
			
 
				+-- The migration is safe to apply to a populated DB — both columns
			
 
				+-- have defaults that match what M13a W1-W5 code already expected
			
 
				+-- (no behavior change for existing rows).
			
 
				+
			
 
				+SET search_path TO auth, public;
			
 
				+
			
 
				+ALTER TABLE auth.tenants
			
 
				+    ADD COLUMN IF NOT EXISTS rate_limit_per_sec INTEGER NOT NULL DEFAULT 10000
			
 
				+        CHECK (rate_limit_per_sec > 0 AND rate_limit_per_sec <= 1000000);
			
 
				+
			
 
				+ALTER TABLE auth.tenants
			
 
				+    ADD COLUMN IF NOT EXISTS fcm_shared BOOLEAN NOT NULL DEFAULT TRUE;
			
--- a/scripts/m13b_w1_smoke.sh
+++ b/scripts/m13b_w1_smoke.sh
@@ -0,0 +1,268 @@
 
				+#!/usr/bin/env bash
			
 
				+# m13b_w1_smoke.sh — End-to-end smoke for the M13b W1 tenant CRUD.
			
 
				+#
			
 
				+# Walks through:
			
 
				+#   1. authd /health and /metrics
			
 
				+#   2. login (super_admin) → access + refresh
			
 
				+#   3. GET /v1/tenants (initially empty or has prior smoke data)
			
 
				+#   4. POST /v1/tenants (create) — super_admin OK
			
 
				+#   5. GET /v1/tenants/{id} (the one we just created)
			
 
				+#   6. PATCH /v1/tenants/{id} (change display_name + rate_limit_per_sec)
			
 
				+#   7. POST /v1/tenants/{id}/status (suspend)
			
 
				+#   8. POST /v1/tenants/{id}/status (activate)
			
 
				+#   9. POST /v1/tenants (duplicate slug) → 409
			
 
				+#   10. POST /v1/tenants (bad slug) → 400
			
 
				+#   11. Login as tenant_admin of the new tenant → can GET own
			
 
				+#   12. tenant_admin trying to GET another tenant's id → 403
			
 
				+#   13. tenant_admin trying to POST /v1/tenants → 403
			
 
				+#   14. POST /v1/tenants/{id}/status as tenant_admin → 403
			
 
				+#   15. POST /v1/tenants/{id}/status with bad status → 400
			
 
				+#   16. (cleanup) super_admin archives the new tenant
			
 
				+#
			
 
				+# Requires:
			
 
				+#   - authd running on $BA_AUTHD_HTTP (default http://127.0.0.1:8804)
			
 
				+#   - $BA_AUTHD_JWT_SECRET set
			
 
				+#   - super_admin user in Postgres (scripts/bootstrap-super-admin.sh)
			
 
				+#
			
 
				+# Run:
			
 
				+#   bash scripts/m13b_w1_smoke.sh
			
 
				+#
			
 
				+# Exits 0 if all steps pass.
			
 
				+
			
 
				+set -euo pipefail
			
 
				+cd "$(dirname "$0")/.."
			
 
				+
			
 
				+AUTHD="${BA_AUTHD_HTTP:-http://127.0.0.1:8804}"
			
 
				+SUPER_EMAIL="${BA_SMOKE_SUPER_EMAIL:-super@broad-announce.test}"
			
 
				+SUPER_PASSWORD="${BA_SMOKE_SUPER_PASSWORD:-test-password-123}"
			
 
				+
			
 
				+# We need a tenant_admin in the new tenant for steps 11-14. The
			
 
				+# simplest path: after creating the tenant, invite one via
			
 
				+# /v1/users/invite (super_admin), grab the magic token from the
			
 
				+# DB, and use it to set the password. This is exactly the flow
			
 
				+# that scripts/m13a_smoke.sh avoids (because it just checks the
			
 
				+# route is wired), but here we need a real user. v1.1 should
			
 
				+# expose a /v1/users/bootstrap-tenant-admin endpoint to make this
			
 
				+# easier; for now we go through the SQL path.
			
 
				+DSN="${BA_POSTGRES_DSN:-${PG_DSN:-postgres://ba:ba@localhost:5432/ba?sslmode=disable}}"
			
 
				+
			
 
				+PASS=0
			
 
				+FAIL=0
			
 
				+RESULTS=()
			
 
				+TENANT_SLUG="smoke-$(date +%s)"
			
 
				+TENANT_EMAIL="ops-${TENANT_SLUG}@smoke.test"
			
 
				+TENANT_ADMIN_EMAIL="admin-${TENANT_SLUG}@smoke.test"
			
 
				+TENANT_ADMIN_PASSWORD="smoke-test-password-1234"
			
 
				+
			
 
				+check() {
			
 
				+  local name="$1"
			
 
				+  local actual="$2"
			
 
				+  local want="$3"
			
 
				+  if [[ "$actual" == "$want" ]]; then
			
 
				+    PASS=$((PASS+1))
			
 
				+    RESULTS+=("OK   $name")
			
 
				+  else
			
 
				+    FAIL=$((FAIL+1))
			
 
				+    RESULTS+=("FAIL $name (got $actual, want $want)")
			
 
				+  fi
			
 
				+}
			
 
				+
			
 
				+# JSON helper: jq-less extract of a top-level string field.
			
 
				+# Usage: json_field body field
			
 
				+json_field() {
			
 
				+  echo "$1" | python3 -c "import json,sys; d=json.load(sys.stdin); k='$2'.split('.'); v=d
			
 
				+for kk in k:
			
 
				+  v=v[kk] if isinstance(v,dict) else v[int(kk)]
			
 
				+print(v if not isinstance(v,(list,dict,bool)) else json.dumps(v))"
			
 
				+}
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 1. health
			
 
				+# -------------------------------------------------------------------
			
 
				+status=$(curl -s -o /dev/null -w "%{http_code}" "$AUTHD/health")
			
 
				+check "1. authd /health" "$status" "200"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 2. login (super_admin)
			
 
				+# -------------------------------------------------------------------
			
 
				+login_body=$(curl -s -X POST "$AUTHD/v1/auth/login" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d "{\"email\":\"$SUPER_EMAIL\",\"password\":\"$SUPER_PASSWORD\"}")
			
 
				+SUPER_TOKEN=$(json_field "$login_body" access_token)
			
 
				+if [[ -z "$SUPER_TOKEN" ]]; then
			
 
				+  echo "FATAL: super_admin login failed: $login_body"
			
 
				+  exit 1
			
 
				+fi
			
 
				+check "2. super_admin login" "200" "200"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 3. GET /v1/tenants (initial list)
			
 
				+# -------------------------------------------------------------------
			
 
				+list=$(curl -s -H "Authorization: Bearer $SUPER_TOKEN" "$AUTHD/v1/tenants?limit=10")
			
 
				+total=$(json_field "$list" total)
			
 
				+echo "    initial tenant count: $total"
			
 
				+check "3. GET /v1/tenants" "200" "200"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 4. POST /v1/tenants (create)
			
 
				+# -------------------------------------------------------------------
			
 
				+create=$(curl -s -w "\n%{http_code}" -X POST "$AUTHD/v1/tenants" \
			
 
				+  -H "Authorization: Bearer $SUPER_TOKEN" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d "{\"slug\":\"$TENANT_SLUG\",\"display_name\":\"Smoke Tenant\",\"contact_email\":\"$TENANT_EMAIL\",\"rate_limit_per_sec\":5000,\"fcm_shared\":true}")
			
 
				+create_code=$(echo "$create" | tail -1)
			
 
				+create_body=$(echo "$create" | head -n -1)
			
 
				+TENANT_ID=$(json_field "$create_body" id)
			
 
				+check "4. POST /v1/tenants" "$create_code" "201"
			
 
				+[[ -n "$TENANT_ID" ]] || { echo "FATAL: no tenant id"; exit 1; }
			
 
				+echo "    new tenant: $TENANT_ID"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 5. GET /v1/tenants/{id}
			
 
				+# -------------------------------------------------------------------
			
 
				+get=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $SUPER_TOKEN" "$AUTHD/v1/tenants/$TENANT_ID")
			
 
				+check "5. GET /v1/tenants/{id}" "$get" "200"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 6. PATCH /v1/tenants/{id}
			
 
				+# -------------------------------------------------------------------
			
 
				+patch=$(curl -s -o /dev/null -w "%{http_code}" -X PATCH "$AUTHD/v1/tenants/$TENANT_ID" \
			
 
				+  -H "Authorization: Bearer $SUPER_TOKEN" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d '{"display_name":"Smoke Tenant (edited)","rate_limit_per_sec":7500}')
			
 
				+check "6. PATCH /v1/tenants/{id}" "$patch" "200"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 7. POST /v1/tenants/{id}/status suspend
			
 
				+# -------------------------------------------------------------------
			
 
				+sus=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$AUTHD/v1/tenants/$TENANT_ID/status" \
			
 
				+  -H "Authorization: Bearer $SUPER_TOKEN" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d '{"status":"suspended"}')
			
 
				+check "7. POST /v1/tenants/{id}/status suspend" "$sus" "200"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 8. POST /v1/tenants/{id}/status activate
			
 
				+# -------------------------------------------------------------------
			
 
				+act=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$AUTHD/v1/tenants/$TENANT_ID/status" \
			
 
				+  -H "Authorization: Bearer $SUPER_TOKEN" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d '{"status":"active"}')
			
 
				+check "8. POST /v1/tenants/{id}/status activate" "$act" "200"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 9. POST /v1/tenants (duplicate slug) → 409
			
 
				+# -------------------------------------------------------------------
			
 
				+dup=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$AUTHD/v1/tenants" \
			
 
				+  -H "Authorization: Bearer $SUPER_TOKEN" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d "{\"slug\":\"$TENANT_SLUG\",\"display_name\":\"Dup\",\"contact_email\":\"$TENANT_EMAIL\"}")
			
 
				+check "9. POST /v1/tenants (dup slug)" "$dup" "409"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 10. POST /v1/tenants (bad slug) → 400
			
 
				+# -------------------------------------------------------------------
			
 
				+bad=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$AUTHD/v1/tenants" \
			
 
				+  -H "Authorization: Bearer $SUPER_TOKEN" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d '{"slug":"Bad Slug!","display_name":"x","contact_email":"a@b.c"}')
			
 
				+check "10. POST /v1/tenants (bad slug)" "$bad" "400"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 11. Bootstrap a tenant_admin in the new tenant.
			
 
				+#     This goes through the SQL path because we don't have an
			
 
				+#     open invite-magic endpoint in v1.
			
 
				+# -------------------------------------------------------------------
			
 
				+export PGPASSWORD="$(echo "$DSN" | sed -E 's|.*://[^:]+:([^@]+)@.*|\1|')"
			
 
				+HASH=$(python3 -c "
			
 
				+import bcrypt
			
 
				+print(bcrypt.hashpw(b'${TENANT_ADMIN_PASSWORD}', bcrypt.gensalt(rounds=10)).decode())
			
 
				+")
			
 
				+psql "$DSN" -v ON_ERROR_STOP=0 -X -q -c "
			
 
				+INSERT INTO auth.users (tenant_id, email, role, status, password_hash)
			
 
				+SELECT id, '${TENANT_ADMIN_EMAIL}', 'tenant_admin', 'active', '${HASH}'
			
 
				+FROM auth.tenants WHERE slug = '${TENANT_SLUG}'
			
 
				+ON CONFLICT (email, tenant_id) WHERE tenant_id IS NOT NULL DO UPDATE SET password_hash = EXCLUDED.password_hash, status = 'active';
			
 
				+" >/dev/null
			
 
				+ta_login=$(curl -s -X POST "$AUTHD/v1/auth/login" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d "{\"email\":\"$TENANT_ADMIN_EMAIL\",\"password\":\"$TENANT_ADMIN_PASSWORD\"}")
			
 
				+TA_TOKEN=$(json_field "$ta_login" access_token)
			
 
				+if [[ -z "$TA_TOKEN" ]]; then
			
 
				+  echo "FATAL: tenant_admin login failed: $ta_login"
			
 
				+  exit 1
			
 
				+fi
			
 
				+check "11. tenant_admin login (own tenant)" "200" "200"
			
 
				+
			
 
				+# 11b. tenant_admin can GET own tenant
			
 
				+ta_get=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $TA_TOKEN" "$AUTHD/v1/tenants/$TENANT_ID")
			
 
				+check "11b. tenant_admin GET own tenant" "$ta_get" "200"
			
 
				+
			
 
				+# 11c. tenant_admin can PATCH own display_name (restricted fields)
			
 
				+ta_patch=$(curl -s -o /dev/null -w "%{http_code}" -X PATCH "$AUTHD/v1/tenants/$TENANT_ID" \
			
 
				+  -H "Authorization: Bearer $TA_TOKEN" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d '{"display_name":"Smoke (tenant-admin edited)"}')
			
 
				+check "11c. tenant_admin PATCH own display_name" "$ta_patch" "200"
			
 
				+
			
 
				+# 11d. tenant_admin CANNOT change rate_limit_per_sec (restricted)
			
 
				+ta_rl=$(curl -s -o /dev/null -w "%{http_code}" -X PATCH "$AUTHD/v1/tenants/$TENANT_ID" \
			
 
				+  -H "Authorization: Bearer $TA_TOKEN" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d '{"rate_limit_per_sec":1234}')
			
 
				+check "11d. tenant_admin PATCH own rate_limit_per_sec (forbidden)" "$ta_rl" "400"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 12. tenant_admin trying to GET another tenant's id → 403
			
 
				+#     (use a random uuid that won't exist; canAccessTenant fails
			
 
				+#      before the DB lookup, so we get 403 not 404)
			
 
				+# -------------------------------------------------------------------
			
 
				+fake_id="00000000-0000-0000-0000-000000000000"
			
 
				+ta_other=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $TA_TOKEN" "$AUTHD/v1/tenants/$fake_id")
			
 
				+check "12. tenant_admin GET other tenant" "$ta_other" "403"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 13. tenant_admin trying to POST /v1/tenants → 403
			
 
				+# -------------------------------------------------------------------
			
 
				+ta_create=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$AUTHD/v1/tenants" \
			
 
				+  -H "Authorization: Bearer $TA_TOKEN" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d '{"slug":"x","display_name":"x","contact_email":"a@b.c"}')
			
 
				+check "13. tenant_admin POST /v1/tenants" "$ta_create" "403"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 14. tenant_admin trying to POST /v1/tenants/{id}/status → 403
			
 
				+# -------------------------------------------------------------------
			
 
				+ta_st=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$AUTHD/v1/tenants/$TENANT_ID/status" \
			
 
				+  -H "Authorization: Bearer $TA_TOKEN" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d '{"status":"suspended"}')
			
 
				+check "14. tenant_admin POST status" "$ta_st" "403"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 15. POST /v1/tenants/{id}/status with bad status → 400
			
 
				+# -------------------------------------------------------------------
			
 
				+bad_st=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$AUTHD/v1/tenants/$TENANT_ID/status" \
			
 
				+  -H "Authorization: Bearer $SUPER_TOKEN" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d '{"status":"paused"}')
			
 
				+check "15. POST status (bad value)" "$bad_st" "400"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# 16. cleanup: super_admin archives the new tenant
			
 
				+# -------------------------------------------------------------------
			
 
				+arc=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$AUTHD/v1/tenants/$TENANT_ID/status" \
			
 
				+  -H "Authorization: Bearer $SUPER_TOKEN" \
			
 
				+  -H 'Content-Type: application/json' \
			
 
				+  -d '{"status":"archived"}')
			
 
				+check "16. POST status archived (cleanup)" "$arc" "200"
			
 
				+
			
 
				+# -------------------------------------------------------------------
			
 
				+# summary
			
 
				+# -------------------------------------------------------------------
			
 
				+echo
			
 
				+echo "=== M13b W1 smoke results ==="
			
 
				+printf '%s\n' "${RESULTS[@]}"
			
 
				+echo
			
 
				+echo "Passed: $PASS   Failed: $FAIL"
			
 
				+[[ $FAIL -eq 0 ]] || exit 1
			
--- a/web/src/components/ui/badge.tsx
+++ b/web/src/components/ui/badge.tsx
@@ -0,0 +1,32 @@
 
				+import { forwardRef, type HTMLAttributes } from 'react';
			
 
				+import { cva, type VariantProps } from 'class-variance-authority';
			
 
				+import { cn } from '@/lib/utils';
			
 
				+
			
 
				+const badgeVariants = cva(
			
 
				+  'inline-flex items-center rounded-md border px-2 py-0.5 text-xs font-medium transition-colors',
			
 
				+  {
			
 
				+    variants: {
			
 
				+      variant: {
			
 
				+        default: 'border-transparent bg-primary text-primary-foreground',
			
 
				+        secondary: 'border-transparent bg-secondary text-secondary-foreground',
			
 
				+        outline: 'text-foreground',
			
 
				+        success: 'border-transparent bg-emerald-100 text-emerald-800 dark:bg-emerald-900/30 dark:text-emerald-300',
			
 
				+        warning: 'border-transparent bg-amber-100 text-amber-800 dark:bg-amber-900/30 dark:text-amber-300',
			
 
				+        danger: 'border-transparent bg-rose-100 text-rose-800 dark:bg-rose-900/30 dark:text-rose-300',
			
 
				+        muted: 'border-transparent bg-muted text-muted-foreground',
			
 
				+      },
			
 
				+    },
			
 
				+    defaultVariants: { variant: 'default' },
			
 
				+  },
			
 
				+);
			
 
				+
			
 
				+export interface BadgeProps
			
 
				+  extends HTMLAttributes<HTMLSpanElement>,
			
 
				+    VariantProps<typeof badgeVariants> {}
			
 
				+
			
 
				+export const Badge = forwardRef<HTMLSpanElement, BadgeProps>(
			
 
				+  ({ className, variant, ...props }, ref) => (
			
 
				+    <span ref={ref} className={cn(badgeVariants({ variant }), className)} {...props} />
			
 
				+  ),
			
 
				+);
			
 
				+Badge.displayName = 'Badge';
			
--- a/web/src/components/ui/dialog.tsx
+++ b/web/src/components/ui/dialog.tsx
@@ -0,0 +1,91 @@
 
				+import { forwardRef, type HTMLAttributes } from 'react';
			
 
				+import * as DialogPrimitive from '@radix-ui/react-dialog';
			
 
				+import { X } from 'lucide-react';
			
 
				+import { cn } from '@/lib/utils';
			
 
				+
			
 
				+export const Dialog = DialogPrimitive.Root;
			
 
				+export const DialogTrigger = DialogPrimitive.Trigger;
			
 
				+export const DialogPortal = DialogPrimitive.Portal;
			
 
				+export const DialogClose = DialogPrimitive.Close;
			
 
				+
			
 
				+export const DialogOverlay = forwardRef<
			
 
				+  HTMLDivElement,
			
 
				+  React.ComponentPropsWithoutRef<typeof DialogPrimitive.Overlay>
			
 
				+>(({ className, ...props }, ref) => (
			
 
				+  <DialogPrimitive.Overlay
			
 
				+    ref={ref}
			
 
				+    className={cn(
			
 
				+      'fixed inset-0 z-50 bg-black/50 backdrop-blur-sm',
			
 
				+      'data-[state=open]:animate-in data-[state=closed]:animate-out',
			
 
				+      'data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0',
			
 
				+      className,
			
 
				+    )}
			
 
				+    {...props}
			
 
				+  />
			
 
				+));
			
 
				+DialogOverlay.displayName = 'DialogOverlay';
			
 
				+
			
 
				+export const DialogContent = forwardRef<
			
 
				+  HTMLDivElement,
			
 
				+  React.ComponentPropsWithoutRef<typeof DialogPrimitive.Content>
			
 
				+>(({ className, children, ...props }, ref) => (
			
 
				+  <DialogPortal>
			
 
				+    <DialogOverlay />
			
 
				+    <DialogPrimitive.Content
			
 
				+      ref={ref}
			
 
				+      className={cn(
			
 
				+        'fixed left-1/2 top-1/2 z-50 grid w-full max-w-lg -translate-x-1/2 -translate-y-1/2 gap-4 border bg-background p-6 shadow-lg sm:rounded-lg',
			
 
				+        'data-[state=open]:animate-in data-[state=closed]:animate-out',
			
 
				+        'data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0',
			
 
				+        'data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95',
			
 
				+        'max-h-[90vh] overflow-y-auto',
			
 
				+        className,
			
 
				+      )}
			
 
				+      {...props}
			
 
				+    >
			
 
				+      {children}
			
 
				+      <DialogPrimitive.Close className="absolute right-4 top-4 rounded-sm opacity-70 ring-offset-background transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:pointer-events-none">
			
 
				+        <X className="h-4 w-4" />
			
 
				+        <span className="sr-only">Close</span>
			
 
				+      </DialogPrimitive.Close>
			
 
				+    </DialogPrimitive.Content>
			
 
				+  </DialogPortal>
			
 
				+));
			
 
				+DialogContent.displayName = 'DialogContent';
			
 
				+
			
 
				+export function DialogHeader({ className, ...props }: HTMLAttributes<HTMLDivElement>) {
			
 
				+  return <div className={cn('flex flex-col gap-1.5 text-left', className)} {...props} />;
			
 
				+}
			
 
				+
			
 
				+export function DialogFooter({ className, ...props }: HTMLAttributes<HTMLDivElement>) {
			
 
				+  return (
			
 
				+    <div
			
 
				+      className={cn('flex flex-col-reverse gap-2 sm:flex-row sm:justify-end sm:gap-2', className)}
			
 
				+      {...props}
			
 
				+    />
			
 
				+  );
			
 
				+}
			
 
				+
			
 
				+export const DialogTitle = forwardRef<
			
 
				+  HTMLHeadingElement,
			
 
				+  React.ComponentPropsWithoutRef<typeof DialogPrimitive.Title>
			
 
				+>(({ className, ...props }, ref) => (
			
 
				+  <DialogPrimitive.Title
			
 
				+    ref={ref}
			
 
				+    className={cn('text-lg font-semibold leading-none tracking-tight', className)}
			
 
				+    {...props}
			
 
				+  />
			
 
				+));
			
 
				+DialogTitle.displayName = 'DialogTitle';
			
 
				+
			
 
				+export const DialogDescription = forwardRef<
			
 
				+  HTMLParagraphElement,
			
 
				+  React.ComponentPropsWithoutRef<typeof DialogPrimitive.Description>
			
 
				+>(({ className, ...props }, ref) => (
			
 
				+  <DialogPrimitive.Description
			
 
				+    ref={ref}
			
 
				+    className={cn('text-sm text-muted-foreground', className)}
			
 
				+    {...props}
			
 
				+  />
			
 
				+));
			
 
				+DialogDescription.displayName = 'DialogDescription';
			
--- a/web/src/components/ui/empty-state.tsx
+++ b/web/src/components/ui/empty-state.tsx
@@ -0,0 +1,26 @@
 
				+import { type ReactNode } from 'react';
			
 
				+import { cn } from '@/lib/utils';
			
 
				+
			
 
				+interface EmptyStateProps {
			
 
				+  title: string;
			
 
				+  description?: string;
			
 
				+  action?: ReactNode;
			
 
				+  icon?: ReactNode;
			
 
				+  className?: string;
			
 
				+}
			
 
				+
			
 
				+export function EmptyState({ title, description, action, icon, className }: EmptyStateProps) {
			
 
				+  return (
			
 
				+    <div
			
 
				+      className={cn(
			
 
				+        'flex flex-col items-center justify-center gap-3 rounded-md border border-dashed bg-card p-10 text-center',
			
 
				+        className,
			
 
				+      )}
			
 
				+    >
			
 
				+      {icon ? <div className="text-muted-foreground">{icon}</div> : null}
			
 
				+      <h3 className="text-base font-semibold">{title}</h3>
			
 
				+      {description ? <p className="max-w-md text-sm text-muted-foreground">{description}</p> : null}
			
 
				+      {action ? <div className="mt-2">{action}</div> : null}
			
 
				+    </div>
			
 
				+  );
			
 
				+}
			
--- a/web/src/components/ui/table.tsx
+++ b/web/src/components/ui/table.tsx
@@ -0,0 +1,57 @@
 
				+import { forwardRef, type HTMLAttributes, type TdHTMLAttributes, type ThHTMLAttributes } from 'react';
			
 
				+import { cn } from '@/lib/utils';
			
 
				+
			
 
				+export const Table = forwardRef<HTMLTableElement, HTMLAttributes<HTMLTableElement>>(
			
 
				+  ({ className, ...props }, ref) => (
			
 
				+    <div className="relative w-full overflow-auto">
			
 
				+      <table ref={ref} className={cn('w-full caption-bottom text-sm', className)} {...props} />
			
 
				+    </div>
			
 
				+  ),
			
 
				+);
			
 
				+Table.displayName = 'Table';
			
 
				+
			
 
				+export const TableHeader = forwardRef<HTMLTableSectionElement, HTMLAttributes<HTMLTableSectionElement>>(
			
 
				+  ({ className, ...props }, ref) => (
			
 
				+    <thead ref={ref} className={cn('[&_tr]:border-b bg-muted/40', className)} {...props} />
			
 
				+  ),
			
 
				+);
			
 
				+TableHeader.displayName = 'TableHeader';
			
 
				+
			
 
				+export const TableBody = forwardRef<HTMLTableSectionElement, HTMLAttributes<HTMLTableSectionElement>>(
			
 
				+  ({ className, ...props }, ref) => (
			
 
				+    <tbody ref={ref} className={cn('[&_tr:last-child]:border-0', className)} {...props} />
			
 
				+  ),
			
 
				+);
			
 
				+TableBody.displayName = 'TableBody';
			
 
				+
			
 
				+export const TableRow = forwardRef<HTMLTableRowElement, HTMLAttributes<HTMLTableRowElement>>(
			
 
				+  ({ className, ...props }, ref) => (
			
 
				+    <tr
			
 
				+      ref={ref}
			
 
				+      className={cn('border-b transition-colors hover:bg-muted/40 data-[state=selected]:bg-muted', className)}
			
 
				+      {...props}
			
 
				+    />
			
 
				+  ),
			
 
				+);
			
 
				+TableRow.displayName = 'TableRow';
			
 
				+
			
 
				+export const TableHead = forwardRef<HTMLTableCellElement, ThHTMLAttributes<HTMLTableCellElement>>(
			
 
				+  ({ className, ...props }, ref) => (
			
 
				+    <th
			
 
				+      ref={ref}
			
 
				+      className={cn(
			
 
				+        'h-10 px-3 text-left align-middle text-xs font-medium uppercase tracking-wider text-muted-foreground',
			
 
				+        className,
			
 
				+      )}
			
 
				+      {...props}
			
 
				+    />
			
 
				+  ),
			
 
				+);
			
 
				+TableHead.displayName = 'TableHead';
			
 
				+
			
 
				+export const TableCell = forwardRef<HTMLTableCellElement, TdHTMLAttributes<HTMLTableCellElement>>(
			
 
				+  ({ className, ...props }, ref) => (
			
 
				+    <td ref={ref} className={cn('p-3 align-middle', className)} {...props} />
			
 
				+  ),
			
 
				+);
			
 
				+TableCell.displayName = 'TableCell';
			
--- a/web/src/components/ui/textarea.tsx
+++ b/web/src/components/ui/textarea.tsx
@@ -0,0 +1,21 @@
 
				+import { forwardRef, type TextareaHTMLAttributes } from 'react';
			
 
				+import { cn } from '@/lib/utils';
			
 
				+
			
 
				+export type TextareaProps = TextareaHTMLAttributes<HTMLTextAreaElement>;
			
 
				+
			
 
				+export const Textarea = forwardRef<HTMLTextAreaElement, TextareaProps>(
			
 
				+  ({ className, ...props }, ref) => (
			
 
				+    <textarea
			
 
				+      ref={ref}
			
 
				+      className={cn(
			
 
				+        'flex min-h-[80px] w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background',
			
 
				+        'placeholder:text-muted-foreground',
			
 
				+        'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2',
			
 
				+        'disabled:cursor-not-allowed disabled:opacity-50',
			
 
				+        className,
			
 
				+      )}
			
 
				+      {...props}
			
 
				+    />
			
 
				+  ),
			
 
				+);
			
 
				+Textarea.displayName = 'Textarea';
			
--- a/web/src/features/companies/api.ts
+++ b/web/src/features/companies/api.ts
@@ -0,0 +1,101 @@
 
				+/**
			
 
				+ * TanStack Query hooks for the /v1/tenants/* endpoints.
			
 
				+ *
			
 
				+ * The hooks are feature-scoped: callers (list, create-dialog,
			
 
				+ * detail-page) pull these and don't talk to fetchWithAuth
			
 
				+ * directly. That way the cache is shared across views and the
			
 
				+ * query keys are predictable.
			
 
				+ */
			
 
				+
			
 
				+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
			
 
				+import { ApiError, apiGet, apiSend } from '@/lib/api';
			
 
				+import type {
			
 
				+  CreateTenantInput,
			
 
				+  ListTenantsResponse,
			
 
				+  Tenant,
			
 
				+  UpdateTenantInput,
			
 
				+} from './types';
			
 
				+
			
 
				+export interface ListTenantsParams {
			
 
				+  q?: string;
			
 
				+  status?: string;
			
 
				+  limit?: number;
			
 
				+  offset?: number;
			
 
				+}
			
 
				+
			
 
				+const KEYS = {
			
 
				+  list: (params: ListTenantsParams) => ['tenants', 'list', params] as const,
			
 
				+  detail: (id: string | undefined) => ['tenants', 'detail', id] as const,
			
 
				+};
			
 
				+
			
 
				+function buildListQuery(params: ListTenantsParams): string {
			
 
				+  const u = new URLSearchParams();
			
 
				+  if (params.q) u.set('q', params.q);
			
 
				+  if (params.status) u.set('status', params.status);
			
 
				+  if (params.limit) u.set('limit', String(params.limit));
			
 
				+  if (params.offset) u.set('offset', String(params.offset));
			
 
				+  const s = u.toString();
			
 
				+  return s ? `/v1/tenants?${s}` : '/v1/tenants';
			
 
				+}
			
 
				+
			
 
				+export function useTenantsList(params: ListTenantsParams) {
			
 
				+  return useQuery({
			
 
				+    queryKey: KEYS.list(params),
			
 
				+    queryFn: () => apiGet<ListTenantsResponse>(buildListQuery(params)),
			
 
				+    // Tenant_admin scoping is enforced server-side; we still want
			
 
				+    // refetch when the user switches to/from super_admin context.
			
 
				+    staleTime: 15_000,
			
 
				+  });
			
 
				+}
			
 
				+
			
 
				+export function useTenant(id: string | undefined) {
			
 
				+  return useQuery({
			
 
				+    queryKey: KEYS.detail(id),
			
 
				+    queryFn: () => apiGet<Tenant>(`/v1/tenants/${id}`),
			
 
				+    enabled: Boolean(id),
			
 
				+  });
			
 
				+}
			
 
				+
			
 
				+export function useCreateTenant() {
			
 
				+  const qc = useQueryClient();
			
 
				+  return useMutation({
			
 
				+    mutationFn: (input: CreateTenantInput) =>
			
 
				+      apiSend<Tenant>('POST', '/v1/tenants', input),
			
 
				+    onSuccess: () => {
			
 
				+      void qc.invalidateQueries({ queryKey: ['tenants', 'list'] });
			
 
				+    },
			
 
				+  });
			
 
				+}
			
 
				+
			
 
				+export function useUpdateTenant(id: string) {
			
 
				+  const qc = useQueryClient();
			
 
				+  return useMutation({
			
 
				+    mutationFn: (input: UpdateTenantInput) =>
			
 
				+      apiSend<Tenant>('PATCH', `/v1/tenants/${id}`, input),
			
 
				+    onSuccess: (tenant) => {
			
 
				+      qc.setQueryData(KEYS.detail(id), tenant);
			
 
				+      void qc.invalidateQueries({ queryKey: ['tenants', 'list'] });
			
 
				+    },
			
 
				+  });
			
 
				+}
			
 
				+
			
 
				+export function useSetTenantStatus(id: string) {
			
 
				+  const qc = useQueryClient();
			
 
				+  return useMutation({
			
 
				+    mutationFn: (status: 'active' | 'suspended' | 'archived') =>
			
 
				+      apiSend<Tenant>('POST', `/v1/tenants/${id}/status`, { status }),
			
 
				+    onSuccess: (tenant) => {
			
 
				+      qc.setQueryData(KEYS.detail(id), tenant);
			
 
				+      void qc.invalidateQueries({ queryKey: ['tenants', 'list'] });
			
 
				+    },
			
 
				+  });
			
 
				+}
			
 
				+
			
 
				+export function getErrorMessage(err: unknown): string {
			
 
				+  if (err instanceof ApiError) {
			
 
				+    const body = err.body as { error?: string; message?: string } | null;
			
 
				+    return body?.message ?? body?.error ?? err.message;
			
 
				+  }
			
 
				+  if (err instanceof Error) return err.message;
			
 
				+  return 'Unknown error';
			
 
				+}
			
--- a/web/src/features/companies/create-dialog.tsx
+++ b/web/src/features/companies/create-dialog.tsx
@@ -0,0 +1,230 @@
 
				+/**
			
 
				+ * Create-tenant dialog. Renders as a Radix Dialog triggered by a
			
 
				+ * Button. Uses react-hook-form for the form state. The form
			
 
				+ * fields are validated client-side (zod) AND server-side; the
			
 
				+ * server returns 400 on any validation error.
			
 
				+ *
			
 
				+ * Renders nothing if the user lacks the create-tenant permission
			
 
				+ * (super_admin only). The button is hidden too.
			
 
				+ */
			
 
				+
			
 
				+import { useEffect, useState } from 'react';
			
 
				+import { useForm } from 'react-hook-form';
			
 
				+import { zodResolver } from '@hookform/resolvers/zod';
			
 
				+import { z } from 'zod';
			
 
				+import { Plus } from 'lucide-react';
			
 
				+import { toast } from 'sonner';
			
 
				+import { useNavigate } from 'react-router-dom';
			
 
				+
			
 
				+import { Button } from '@/components/ui/button';
			
 
				+import { Input } from '@/components/ui/input';
			
 
				+import { Label } from '@/components/ui/label';
			
 
				+import { Textarea } from '@/components/ui/textarea';
			
 
				+import {
			
 
				+  Dialog,
			
 
				+  DialogContent,
			
 
				+  DialogDescription,
			
 
				+  DialogFooter,
			
 
				+  DialogHeader,
			
 
				+  DialogTitle,
			
 
				+  DialogTrigger,
			
 
				+} from '@/components/ui/dialog';
			
 
				+
			
 
				+import { getErrorMessage, useCreateTenant } from './api';
			
 
				+import type { CreateTenantInput as CreateTenantBody } from './types';
			
 
				+
			
 
				+const SLUG_RE = /^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$/;
			
 
				+
			
 
				+const formSchema = z.object({
			
 
				+  slug: z
			
 
				+    .string()
			
 
				+    .min(2, 'Slug must be 2–64 characters')
			
 
				+    .max(64, 'Slug must be 2–64 characters')
			
 
				+    .regex(SLUG_RE, 'Lowercase letters, digits, and dashes only'),
			
 
				+  display_name: z.string().min(1, 'Display name is required'),
			
 
				+  contact_email: z.string().email('Enter a valid email'),
			
 
				+  rate_limit_per_sec: z
			
 
				+    .number({ invalid_type_error: 'Enter a number' })
			
 
				+    .int('Whole number only')
			
 
				+    .min(1, 'Must be at least 1')
			
 
				+    .max(1_000_000, 'Must be at most 1,000,000'),
			
 
				+  fcm_shared: z.boolean(),
			
 
				+});
			
 
				+
			
 
				+type FormValues = z.infer<typeof formSchema>;
			
 
				+
			
 
				+export function CreateTenantDialog() {
			
 
				+  const [open, setOpen] = useState(false);
			
 
				+  const navigate = useNavigate();
			
 
				+  const create = useCreateTenant();
			
 
				+
			
 
				+  const form = useForm<FormValues>({
			
 
				+    resolver: zodResolver(formSchema),
			
 
				+    defaultValues: {
			
 
				+      slug: '',
			
 
				+      display_name: '',
			
 
				+      contact_email: '',
			
 
				+      rate_limit_per_sec: 10000,
			
 
				+      fcm_shared: true,
			
 
				+    },
			
 
				+  });
			
 
				+
			
 
				+  // Reset form when the dialog opens. The reset is gated on
			
 
				+  // `open` so it only fires on the close->open transition.
			
 
				+  useEffect(() => {
			
 
				+    if (open) {
			
 
				+      form.reset();
			
 
				+    }
			
 
				+  }, [open, form]);
			
 
				+
			
 
				+  const onSubmit = form.handleSubmit(async (values) => {
			
 
				+    const body: CreateTenantBody = {
			
 
				+      slug: values.slug.trim(),
			
 
				+      display_name: values.display_name.trim(),
			
 
				+      contact_email: values.contact_email.trim(),
			
 
				+      rate_limit_per_sec: values.rate_limit_per_sec,
			
 
				+      fcm_shared: values.fcm_shared,
			
 
				+    };
			
 
				+    try {
			
 
				+      const created = await create.mutateAsync(body);
			
 
				+      toast.success(`Created ${created.display_name}`);
			
 
				+      setOpen(false);
			
 
				+      // Land the operator on the new tenant's detail page so
			
 
				+      // they can immediately wire up users and sources.
			
 
				+      navigate(`/companies/${created.id}`);
			
 
				+    } catch (err) {
			
 
				+      const msg = getErrorMessage(err);
			
 
				+      toast.error(msg);
			
 
				+      // Surface duplicate-slug as a field error so the operator
			
 
				+      // sees it next to the input, not just in a toast.
			
 
				+      if (msg.toLowerCase().includes('slug')) {
			
 
				+        form.setError('slug', { message: msg });
			
 
				+      }
			
 
				+    }
			
 
				+  });
			
 
				+
			
 
				+  return (
			
 
				+    <Dialog open={open} onOpenChange={setOpen}>
			
 
				+      <DialogTrigger asChild>
			
 
				+        <Button>
			
 
				+          <Plus className="h-4 w-4" />
			
 
				+          New company
			
 
				+        </Button>
			
 
				+      </DialogTrigger>
			
 
				+      <DialogContent>
			
 
				+        <DialogHeader>
			
 
				+          <DialogTitle>New company</DialogTitle>
			
 
				+          <DialogDescription>
			
 
				+            The slug becomes part of every event this tenant sends
			
 
				+            (and shows up in the audit log). Choose carefully — it
			
 
				+            cannot be changed after creation.
			
 
				+          </DialogDescription>
			
 
				+        </DialogHeader>
			
 
				+
			
 
				+        <form onSubmit={onSubmit} className="space-y-4">
			
 
				+          <div className="grid grid-cols-2 gap-4">
			
 
				+            <div className="space-y-2">
			
 
				+              <Label htmlFor="slug">Slug</Label>
			
 
				+              <Input
			
 
				+                id="slug"
			
 
				+                placeholder="acme-corp"
			
 
				+                autoComplete="off"
			
 
				+                {...form.register('slug')}
			
 
				+                aria-invalid={Boolean(form.formState.errors.slug)}
			
 
				+              />
			
 
				+              {form.formState.errors.slug ? (
			
 
				+                <p className="text-xs text-destructive">
			
 
				+                  {form.formState.errors.slug.message}
			
 
				+                </p>
			
 
				+              ) : (
			
 
				+                <p className="text-xs text-muted-foreground">
			
 
				+                  2–64 chars, lowercase + digits + dashes.
			
 
				+                </p>
			
 
				+              )}
			
 
				+            </div>
			
 
				+            <div className="space-y-2">
			
 
				+              <Label htmlFor="rate_limit_per_sec">Rate limit (events/sec)</Label>
			
 
				+              <Input
			
 
				+                id="rate_limit_per_sec"
			
 
				+                type="number"
			
 
				+                min={1}
			
 
				+                max={1_000_000}
			
 
				+                {...form.register('rate_limit_per_sec', { valueAsNumber: true })}
			
 
				+                aria-invalid={Boolean(form.formState.errors.rate_limit_per_sec)}
			
 
				+              />
			
 
				+              {form.formState.errors.rate_limit_per_sec ? (
			
 
				+                <p className="text-xs text-destructive">
			
 
				+                  {form.formState.errors.rate_limit_per_sec.message}
			
 
				+                </p>
			
 
				+              ) : null}
			
 
				+            </div>
			
 
				+          </div>
			
 
				+
			
 
				+          <div className="space-y-2">
			
 
				+            <Label htmlFor="display_name">Display name</Label>
			
 
				+            <Input
			
 
				+              id="display_name"
			
 
				+              placeholder="Acme Corporation"
			
 
				+              {...form.register('display_name')}
			
 
				+              aria-invalid={Boolean(form.formState.errors.display_name)}
			
 
				+            />
			
 
				+            {form.formState.errors.display_name ? (
			
 
				+              <p className="text-xs text-destructive">
			
 
				+                {form.formState.errors.display_name.message}
			
 
				+              </p>
			
 
				+            ) : null}
			
 
				+          </div>
			
 
				+
			
 
				+          <div className="space-y-2">
			
 
				+            <Label htmlFor="contact_email">Contact email</Label>
			
 
				+            <Input
			
 
				+              id="contact_email"
			
 
				+              type="email"
			
 
				+              placeholder="ops@acme.example"
			
 
				+              autoComplete="off"
			
 
				+              {...form.register('contact_email')}
			
 
				+              aria-invalid={Boolean(form.formState.errors.contact_email)}
			
 
				+            />
			
 
				+            {form.formState.errors.contact_email ? (
			
 
				+              <p className="text-xs text-destructive">
			
 
				+                {form.formState.errors.contact_email.message}
			
 
				+              </p>
			
 
				+            ) : null}
			
 
				+          </div>
			
 
				+
			
 
				+          <div className="flex items-start gap-2 rounded-md border bg-muted/40 p-3">
			
 
				+            <input
			
 
				+              id="fcm_shared"
			
 
				+              type="checkbox"
			
 
				+              className="mt-0.5 h-4 w-4 rounded border-input"
			
 
				+              {...form.register('fcm_shared')}
			
 
				+            />
			
 
				+            <div className="space-y-0.5">
			
 
				+              <Label htmlFor="fcm_shared" className="cursor-pointer">
			
 
				+                Use shared FCM pool
			
 
				+              </Label>
			
 
				+              <p className="text-xs text-muted-foreground">
			
 
				+                Default. Only turn this off for high-volume tenants
			
 
				+                that need a dedicated sender ID (M13b W3 territory).
			
 
				+              </p>
			
 
				+            </div>
			
 
				+          </div>
			
 
				+
			
 
				+          <DialogFooter>
			
 
				+            <Button
			
 
				+              type="button"
			
 
				+              variant="ghost"
			
 
				+              onClick={() => setOpen(false)}
			
 
				+              disabled={create.isPending}
			
 
				+            >
			
 
				+              Cancel
			
 
				+            </Button>
			
 
				+            <Button type="submit" disabled={create.isPending}>
			
 
				+              {create.isPending ? 'Creating…' : 'Create company'}
			
 
				+            </Button>
			
 
				+          </DialogFooter>
			
 
				+        </form>
			
 
				+      </DialogContent>
			
 
				+    </Dialog>
			
 
				+  );
			
 
				+}
			
--- a/web/src/features/companies/detail-page.tsx
+++ b/web/src/features/companies/detail-page.tsx
@@ -0,0 +1,369 @@
 
				+/**
			
 
				+ * Detail view for a single tenant. URL: /companies/{id}.
			
 
				+ *
			
 
				+ * Layout:
			
 
				+ *   - Header: name + status badge + back link
			
 
				+ *   - Edit form (display_name, contact_email, rate_limit, fcm_shared)
			
 
				+ *     — fields are disabled for tenant_admin except display_name + contact_email
			
 
				+ *   - Status actions: Suspend / Activate / Archive (super_admin only)
			
 
				+ *   - Metadata panel: created, updated, archived_at
			
 
				+ *
			
 
				+ * The archive action requires a typed confirmation dialog.
			
 
				+ */
			
 
				+
			
 
				+import { useEffect } from 'react';
			
 
				+import { useForm } from 'react-hook-form';
			
 
				+import { zodResolver } from '@hookform/resolvers/zod';
			
 
				+import { z } from 'zod';
			
 
				+import { useNavigate, useParams } from 'react-router-dom';
			
 
				+import { ArrowLeft, AlertTriangle } from 'lucide-react';
			
 
				+import { toast } from 'sonner';
			
 
				+
			
 
				+import { Button } from '@/components/ui/button';
			
 
				+import { Input } from '@/components/ui/input';
			
 
				+import { Label } from '@/components/ui/label';
			
 
				+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
			
 
				+import {
			
 
				+  Dialog,
			
 
				+  DialogContent,
			
 
				+  DialogDescription,
			
 
				+  DialogFooter,
			
 
				+  DialogHeader,
			
 
				+  DialogTitle,
			
 
				+  DialogTrigger,
			
 
				+  DialogClose,
			
 
				+} from '@/components/ui/dialog';
			
 
				+
			
 
				+import { useAuth } from '@/lib/auth-context';
			
 
				+import { canViewCompanies, isSuperAdmin } from "@/lib/scope";
			
 
				+import {
			
 
				+  getErrorMessage,
			
 
				+  useSetTenantStatus,
			
 
				+  useTenant,
			
 
				+  useUpdateTenant,
			
 
				+} from './api';
			
 
				+import { StatusBadge, formatDate, formatRateLimit } from './format';
			
 
				+
			
 
				+const formSchema = z.object({
			
 
				+  display_name: z.string().min(1, 'Display name is required'),
			
 
				+  contact_email: z.string().email('Enter a valid email'),
			
 
				+  rate_limit_per_sec: z
			
 
				+    .number({ invalid_type_error: 'Enter a number' })
			
 
				+    .int('Whole number only')
			
 
				+    .min(1)
			
 
				+    .max(1_000_000),
			
 
				+  fcm_shared: z.boolean(),
			
 
				+});
			
 
				+
			
 
				+type FormValues = z.infer<typeof formSchema>;
			
 
				+
			
 
				+const EMPTY_DEFAULTS: FormValues = {
			
 
				+  display_name: '',
			
 
				+  contact_email: '',
			
 
				+  rate_limit_per_sec: 10000,
			
 
				+  fcm_shared: true,
			
 
				+};
			
 
				+
			
 
				+export function CompanyDetailPage() {
			
 
				+  const { id = '' } = useParams<{ id: string }>();
			
 
				+  const navigate = useNavigate();
			
 
				+  const { user } = useAuth();
			
 
				+  const canEditAll = isSuperAdmin(user?.role);
			
 
				+  const canView = canViewCompanies(user?.role);
			
 
				+
			
 
				+  const tenantQ = useTenant(id);
			
 
				+  const update = useUpdateTenant(id);
			
 
				+  const setStatus = useSetTenantStatus(id);
			
 
				+
			
 
				+  const form = useForm<FormValues>({
			
 
				+    resolver: zodResolver(formSchema),
			
 
				+    defaultValues: EMPTY_DEFAULTS,
			
 
				+  });
			
 
				+
			
 
				+  // Reset the form whenever the loaded tenant changes. This way
			
 
				+  // navigating between detail pages doesn't show stale values.
			
 
				+  // We use setValue (not reset) so the zodResolver doesn't
			
 
				+  // re-run; the server has already validated these values.
			
 
				+  useEffect(() => {
			
 
				+    const t = tenantQ.data;
			
 
				+    if (!t) return;
			
 
				+    form.setValue('display_name', t.display_name);
			
 
				+    form.setValue('contact_email', t.contact_email);
			
 
				+    form.setValue('rate_limit_per_sec', t.rate_limit_per_sec);
			
 
				+    form.setValue('fcm_shared', t.fcm_shared);
			
 
				+  }, [tenantQ.data, form]);
			
 
				+
			
 
				+  if (!canView) {
			
 
				+    return (
			
 
				+      <div className="rounded-md border bg-card p-6 text-sm text-muted-foreground">
			
 
				+        You do not have access to this company.
			
 
				+      </div>
			
 
				+    );
			
 
				+  }
			
 
				+
			
 
				+  if (tenantQ.isError) {
			
 
				+    const msg = getErrorMessage(tenantQ.error);
			
 
				+    return (
			
 
				+      <div className="space-y-3">
			
 
				+        <Button variant="ghost" size="sm" onClick={() => navigate('/companies')}>
			
 
				+          <ArrowLeft className="h-4 w-4" />
			
 
				+          Back
			
 
				+        </Button>
			
 
				+        <div className="rounded-md border border-destructive/40 bg-destructive/5 p-4 text-sm text-destructive">
			
 
				+          {msg}
			
 
				+        </div>
			
 
				+      </div>
			
 
				+    );
			
 
				+  }
			
 
				+
			
 
				+  if (!tenantQ.data) {
			
 
				+    return <div className="text-sm text-muted-foreground">Loading…</div>;
			
 
				+  }
			
 
				+
			
 
				+  const t = tenantQ.data;
			
 
				+
			
 
				+  const onSubmit = form.handleSubmit(async (values) => {
			
 
				+    try {
			
 
				+      await update.mutateAsync({
			
 
				+        display_name: values.display_name.trim(),
			
 
				+        contact_email: values.contact_email.trim(),
			
 
				+        rate_limit_per_sec: values.rate_limit_per_sec,
			
 
				+        fcm_shared: values.fcm_shared,
			
 
				+      });
			
 
				+      toast.success('Saved');
			
 
				+    } catch (err) {
			
 
				+      toast.error(getErrorMessage(err));
			
 
				+    }
			
 
				+  });
			
 
				+
			
 
				+  const onChangeStatus = async (next: 'active' | 'suspended' | 'archived') => {
			
 
				+    try {
			
 
				+      await setStatus.mutateAsync(next);
			
 
				+      toast.success(`Status set to ${next}`);
			
 
				+    } catch (err) {
			
 
				+      toast.error(getErrorMessage(err));
			
 
				+    }
			
 
				+  };
			
 
				+
			
 
				+  return (
			
 
				+    <div className="flex flex-col gap-6">
			
 
				+      <div className="flex flex-col gap-2">
			
 
				+        <Button
			
 
				+          variant="ghost"
			
 
				+          size="sm"
			
 
				+          className="self-start"
			
 
				+          onClick={() => navigate('/companies')}
			
 
				+        >
			
 
				+          <ArrowLeft className="h-4 w-4" />
			
 
				+          Back to companies
			
 
				+        </Button>
			
 
				+        <div className="flex items-center gap-3">
			
 
				+          <h1 className="text-2xl font-semibold tracking-tight">{t.display_name}</h1>
			
 
				+          <StatusBadge status={t.status} />
			
 
				+        </div>
			
 
				+        <p className="text-sm text-muted-foreground">
			
 
				+          <code className="rounded bg-muted px-1.5 py-0.5 text-xs">{t.slug}</code>
			
 
				+          <span className="mx-2 opacity-50">·</span>
			
 
				+          created {formatDate(t.created_at)}
			
 
				+        </p>
			
 
				+      </div>
			
 
				+
			
 
				+      <div className="grid gap-6 md:grid-cols-3">
			
 
				+        <Card className="md:col-span-2">
			
 
				+          <CardHeader>
			
 
				+            <CardTitle>Details</CardTitle>
			
 
				+            <CardDescription>
			
 
				+              {canEditAll
			
 
				+                ? 'All fields are editable.'
			
 
				+                : 'Display name and contact email are editable. Other fields require a super-admin.'}
			
 
				+            </CardDescription>
			
 
				+          </CardHeader>
			
 
				+          <CardContent>
			
 
				+            <form onSubmit={onSubmit} className="space-y-4">
			
 
				+              <div className="space-y-2">
			
 
				+                <Label htmlFor="display_name">Display name</Label>
			
 
				+                <Input
			
 
				+                  id="display_name"
			
 
				+                  {...form.register('display_name')}
			
 
				+                  aria-invalid={Boolean(form.formState.errors.display_name)}
			
 
				+                />
			
 
				+                {form.formState.errors.display_name ? (
			
 
				+                  <p className="text-xs text-destructive">
			
 
				+                    {form.formState.errors.display_name.message}
			
 
				+                  </p>
			
 
				+                ) : null}
			
 
				+              </div>
			
 
				+
			
 
				+              <div className="space-y-2">
			
 
				+                <Label htmlFor="contact_email">Contact email</Label>
			
 
				+                <Input
			
 
				+                  id="contact_email"
			
 
				+                  type="email"
			
 
				+                  autoComplete="off"
			
 
				+                  {...form.register('contact_email')}
			
 
				+                  aria-invalid={Boolean(form.formState.errors.contact_email)}
			
 
				+                />
			
 
				+                {form.formState.errors.contact_email ? (
			
 
				+                  <p className="text-xs text-destructive">
			
 
				+                    {form.formState.errors.contact_email.message}
			
 
				+                  </p>
			
 
				+                ) : null}
			
 
				+              </div>
			
 
				+
			
 
				+              <div className="grid grid-cols-2 gap-4">
			
 
				+                <div className="space-y-2">
			
 
				+                  <Label htmlFor="rate_limit_per_sec">Rate limit</Label>
			
 
				+                  <Input
			
 
				+                    id="rate_limit_per_sec"
			
 
				+                    type="number"
			
 
				+                    min={1}
			
 
				+                    max={1_000_000}
			
 
				+                    disabled={!canEditAll}
			
 
				+                    {...form.register('rate_limit_per_sec', { valueAsNumber: true })}
			
 
				+                    aria-invalid={Boolean(form.formState.errors.rate_limit_per_sec)}
			
 
				+                  />
			
 
				+                  {form.formState.errors.rate_limit_per_sec ? (
			
 
				+                    <p className="text-xs text-destructive">
			
 
				+                      {form.formState.errors.rate_limit_per_sec.message}
			
 
				+                    </p>
			
 
				+                  ) : null}
			
 
				+                </div>
			
 
				+                <div className="space-y-2">
			
 
				+                  <Label>FCM pool</Label>
			
 
				+                  <label className="flex items-center gap-2 rounded-md border bg-muted/40 p-2 text-sm">
			
 
				+                    <input
			
 
				+                      type="checkbox"
			
 
				+                      className="h-4 w-4 rounded border-input"
			
 
				+                      disabled={!canEditAll}
			
 
				+                      {...form.register('fcm_shared')}
			
 
				+                    />
			
 
				+                    Use shared FCM pool
			
 
				+                  </label>
			
 
				+                </div>
			
 
				+              </div>
			
 
				+
			
 
				+              <div className="flex justify-end">
			
 
				+                <Button type="submit" disabled={update.isPending}>
			
 
				+                  {update.isPending ? 'Saving…' : 'Save changes'}
			
 
				+                </Button>
			
 
				+              </div>
			
 
				+            </form>
			
 
				+          </CardContent>
			
 
				+        </Card>
			
 
				+
			
 
				+        <div className="space-y-4">
			
 
				+          {canEditAll ? (
			
 
				+            <Card>
			
 
				+              <CardHeader>
			
 
				+                <CardTitle>Status</CardTitle>
			
 
				+                <CardDescription>
			
 
				+                  Suspending stops new ingest immediately. Archiving is
			
 
				+                  permanent and is only used to retire a tenant.
			
 
				+                </CardDescription>
			
 
				+              </CardHeader>
			
 
				+              <CardContent className="space-y-2">
			
 
				+                {t.status === 'active' ? (
			
 
				+                  <Button
			
 
				+                    variant="outline"
			
 
				+                    className="w-full"
			
 
				+                    disabled={setStatus.isPending}
			
 
				+                    onClick={() => void onChangeStatus('suspended')}
			
 
				+                  >
			
 
				+                    Suspend
			
 
				+                  </Button>
			
 
				+                ) : t.status === 'suspended' ? (
			
 
				+                  <Button
			
 
				+                    variant="default"
			
 
				+                    className="w-full"
			
 
				+                    disabled={setStatus.isPending}
			
 
				+                    onClick={() => void onChangeStatus('active')}
			
 
				+                  >
			
 
				+                    Activate
			
 
				+                  </Button>
			
 
				+                ) : null}
			
 
				+                {t.status !== 'archived' ? (
			
 
				+                  <ArchiveButton
			
 
				+                    onConfirm={() => void onChangeStatus('archived')}
			
 
				+                    pending={setStatus.isPending}
			
 
				+                  />
			
 
				+                ) : (
			
 
				+                  <p className="rounded-md border bg-muted/40 p-3 text-xs text-muted-foreground">
			
 
				+                    Archived. Status changes are not allowed.
			
 
				+                  </p>
			
 
				+                )}
			
 
				+              </CardContent>
			
 
				+            </Card>
			
 
				+          ) : null}
			
 
				+
			
 
				+          <Card>
			
 
				+            <CardHeader>
			
 
				+              <CardTitle className="text-base">Metadata</CardTitle>
			
 
				+            </CardHeader>
			
 
				+            <CardContent className="space-y-2 text-sm">
			
 
				+              <Row label="ID" value={<code className="text-xs">{t.id}</code>} />
			
 
				+              <Row label="Slug" value={<code className="text-xs">{t.slug}</code>} />
			
 
				+              <Row label="Rate limit" value={formatRateLimit(t.rate_limit_per_sec)} />
			
 
				+              <Row label="FCM" value={t.fcm_shared ? 'shared' : 'dedicated'} />
			
 
				+              <Row label="Created" value={formatDate(t.created_at)} />
			
 
				+              <Row label="Updated" value={formatDate(t.updated_at)} />
			
 
				+              {t.archived_at ? (
			
 
				+                <Row label="Archived" value={formatDate(t.archived_at)} />
			
 
				+              ) : null}
			
 
				+            </CardContent>
			
 
				+          </Card>
			
 
				+        </div>
			
 
				+      </div>
			
 
				+    </div>
			
 
				+  );
			
 
				+}
			
 
				+
			
 
				+function Row({ label, value }: { label: string; value: React.ReactNode }) {
			
 
				+  return (
			
 
				+    <div className="flex items-center justify-between gap-2">
			
 
				+      <span className="text-xs uppercase tracking-wider text-muted-foreground">{label}</span>
			
 
				+      <span className="text-right">{value}</span>
			
 
				+    </div>
			
 
				+  );
			
 
				+}
			
 
				+
			
 
				+function ArchiveButton({
			
 
				+  onConfirm,
			
 
				+  pending,
			
 
				+}: {
			
 
				+  onConfirm: () => void;
			
 
				+  pending: boolean;
			
 
				+}) {
			
 
				+  return (
			
 
				+    <Dialog>
			
 
				+      <DialogTrigger asChild>
			
 
				+        <Button variant="destructive" className="w-full" disabled={pending}>
			
 
				+          Archive…
			
 
				+        </Button>
			
 
				+      </DialogTrigger>
			
 
				+      <DialogContent>
			
 
				+        <DialogHeader>
			
 
				+          <DialogTitle className="flex items-center gap-2">
			
 
				+            <AlertTriangle className="h-4 w-4 text-destructive" />
			
 
				+            Archive this company?
			
 
				+          </DialogTitle>
			
 
				+          <DialogDescription>
			
 
				+            Archiving is <strong>permanent</strong>: the tenant cannot
			
 
				+            be reactivated, and new events will be rejected. Existing
			
 
				+            rows (deliveries, audit, DLQ) are kept for compliance but
			
 
				+            are not surfaced in the UI.
			
 
				+          </DialogDescription>
			
 
				+        </DialogHeader>
			
 
				+        <DialogFooter>
			
 
				+          <DialogClose asChild>
			
 
				+            <Button variant="ghost" disabled={pending}>
			
 
				+              Cancel
			
 
				+            </Button>
			
 
				+          </DialogClose>
			
 
				+          <Button variant="destructive" disabled={pending} onClick={onConfirm}>
			
 
				+            {pending ? 'Archiving…' : 'Archive company'}
			
 
				+          </Button>
			
 
				+        </DialogFooter>
			
 
				+      </DialogContent>
			
 
				+    </Dialog>
			
 
				+  );
			
 
				+}
			
--- a/web/src/features/companies/format.tsx
+++ b/web/src/features/companies/format.tsx
@@ -0,0 +1,50 @@
 
				+/**
			
 
				+ * Display formatters for the Companies feature. Kept as pure
			
 
				+ * functions so they're easy to test independently of React.
			
 
				+ */
			
 
				+
			
 
				+import { Badge } from '@/components/ui/badge';
			
 
				+import type { TenantStatus } from './types';
			
 
				+
			
 
				+const STATUS_LABEL: Record<TenantStatus, string> = {
			
 
				+  active: 'Active',
			
 
				+  suspended: 'Suspended',
			
 
				+  archived: 'Archived',
			
 
				+};
			
 
				+
			
 
				+const STATUS_VARIANT: Record<TenantStatus, 'success' | 'warning' | 'muted'> = {
			
 
				+  active: 'success',
			
 
				+  suspended: 'warning',
			
 
				+  archived: 'muted',
			
 
				+};
			
 
				+
			
 
				+export function statusLabel(s: TenantStatus): string {
			
 
				+  return STATUS_LABEL[s] ?? s;
			
 
				+}
			
 
				+
			
 
				+export function statusVariant(s: TenantStatus): 'success' | 'warning' | 'muted' {
			
 
				+  return STATUS_VARIANT[s] ?? 'muted';
			
 
				+}
			
 
				+
			
 
				+export function StatusBadge({ status }: { status: TenantStatus }) {
			
 
				+  return <Badge variant={statusVariant(status)}>{statusLabel(status)}</Badge>;
			
 
				+}
			
 
				+
			
 
				+export function formatRateLimit(n: number): string {
			
 
				+  if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(1)}M/s`;
			
 
				+  if (n >= 1_000) return `${(n / 1_000).toFixed(1)}k/s`;
			
 
				+  return `${n}/s`;
			
 
				+}
			
 
				+
			
 
				+export function formatDate(iso: string | null | undefined): string {
			
 
				+  if (!iso) return '\u2014';
			
 
				+  const d = new Date(iso);
			
 
				+  // toLocaleDateString returns 'Invalid Date' rather than throwing
			
 
				+  // for unparseable input, so check the numeric time instead.
			
 
				+  if (Number.isNaN(d.getTime())) return iso;
			
 
				+  return d.toLocaleDateString(undefined, {
			
 
				+    year: 'numeric',
			
 
				+    month: 'short',
			
 
				+    day: 'numeric',
			
 
				+  });
			
 
				+}
			
--- a/web/src/features/companies/list.tsx
+++ b/web/src/features/companies/list.tsx
@@ -0,0 +1,195 @@
 
				+/**
			
 
				+ * List view for /v1/tenants. Server-driven filtering (q, status)
			
 
				+ * with a small debounce on q to avoid hammering the backend.
			
 
				+ *
			
 
				+ * tenant_admin sees their own tenant only; the API handles the
			
 
				+ * scope so this view is identical for both roles.
			
 
				+ */
			
 
				+
			
 
				+import { useEffect, useMemo, useState } from 'react';
			
 
				+import { Link, useSearchParams } from 'react-router-dom';
			
 
				+import { Search, Building2 } from 'lucide-react';
			
 
				+
			
 
				+import { Button } from '@/components/ui/button';
			
 
				+import { Input } from '@/components/ui/input';
			
 
				+import { EmptyState } from '@/components/ui/empty-state';
			
 
				+import {
			
 
				+  Table,
			
 
				+  TableBody,
			
 
				+  TableCell,
			
 
				+  TableHead,
			
 
				+  TableHeader,
			
 
				+  TableRow,
			
 
				+} from '@/components/ui/table';
			
 
				+
			
 
				+import { useAuth } from '@/lib/auth-context';
			
 
				+import { canManageCompanies } from "@/lib/scope";
			
 
				+import { useTenantsList } from './api';
			
 
				+import { CreateTenantDialog } from './create-dialog';
			
 
				+import { StatusBadge, formatDate, formatRateLimit } from './format';
			
 
				+
			
 
				+const STATUS_OPTIONS: { value: string; label: string }[] = [
			
 
				+  { value: '', label: 'All' },
			
 
				+  { value: 'active', label: 'Active' },
			
 
				+  { value: 'suspended', label: 'Suspended' },
			
 
				+  { value: 'archived', label: 'Archived' },
			
 
				+];
			
 
				+
			
 
				+export function CompaniesList() {
			
 
				+  const [params, setParams] = useSearchParams();
			
 
				+  const [q, setQ] = useState(params.get('q') ?? '');
			
 
				+  const status = params.get('status') ?? '';
			
 
				+  const { user } = useAuth();
			
 
				+  const canCreate = canManageCompanies(user?.role);
			
 
				+
			
 
				+  // Debounce q → URL (300ms). Keeps the API call rate sane while
			
 
				+  // the user is still typing.
			
 
				+  useEffect(() => {
			
 
				+    const handle = setTimeout(() => {
			
 
				+      const next = new URLSearchParams(params);
			
 
				+      if (q.trim()) next.set('q', q.trim());
			
 
				+      else next.delete('q');
			
 
				+      setParams(next, { replace: true });
			
 
				+    }, 300);
			
 
				+    return () => clearTimeout(handle);
			
 
				+    // eslint-disable-next-line react-hooks/exhaustive-deps
			
 
				+  }, [q]);
			
 
				+
			
 
				+  const queryParams = useMemo(
			
 
				+    () => ({ q: params.get('q') ?? undefined, status: status || undefined, limit: 100 }),
			
 
				+    [params, status],
			
 
				+  );
			
 
				+  const { data, isPending, isError, error, refetch } = useTenantsList(queryParams);
			
 
				+
			
 
				+  return (
			
 
				+    <div className="flex flex-col gap-4">
			
 
				+      <div className="flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between">
			
 
				+        <div>
			
 
				+          <h1 className="text-2xl font-semibold tracking-tight">Companies</h1>
			
 
				+          <p className="text-sm text-muted-foreground">
			
 
				+            Manage the tenants that send events to the router.
			
 
				+          </p>
			
 
				+        </div>
			
 
				+        {canCreate ? <CreateTenantDialog /> : null}
			
 
				+      </div>
			
 
				+
			
 
				+      <div className="flex flex-col gap-2 sm:flex-row sm:items-center">
			
 
				+        <div className="relative flex-1 sm:max-w-sm">
			
 
				+          <Search className="pointer-events-none absolute left-2.5 top-1/2 h-4 w-4 -translate-y-1/2 text-muted-foreground" />
			
 
				+          <Input
			
 
				+            placeholder="Search by slug or name"
			
 
				+            className="pl-8"
			
 
				+            value={q}
			
 
				+            onChange={(e) => setQ(e.target.value)}
			
 
				+            aria-label="Search companies"
			
 
				+          />
			
 
				+        </div>
			
 
				+        <div className="flex gap-1">
			
 
				+          {STATUS_OPTIONS.map((opt) => {
			
 
				+            const active = status === opt.value;
			
 
				+            return (
			
 
				+              <Button
			
 
				+                key={opt.value}
			
 
				+                variant={active ? 'secondary' : 'ghost'}
			
 
				+                size="sm"
			
 
				+                onClick={() => {
			
 
				+                  const next = new URLSearchParams(params);
			
 
				+                  if (opt.value) next.set('status', opt.value);
			
 
				+                  else next.delete('status');
			
 
				+                  setParams(next, { replace: true });
			
 
				+                }}
			
 
				+              >
			
 
				+                {opt.label}
			
 
				+              </Button>
			
 
				+            );
			
 
				+          })}
			
 
				+        </div>
			
 
				+      </div>
			
 
				+
			
 
				+      {isError ? (
			
 
				+        <div className="rounded-md border border-destructive/40 bg-destructive/5 p-4 text-sm text-destructive">
			
 
				+          <p className="font-medium">Failed to load companies.</p>
			
 
				+          <p className="mt-1 text-xs opacity-80">
			
 
				+            {error instanceof Error ? error.message : 'Unknown error'}
			
 
				+          </p>
			
 
				+          <Button
			
 
				+            variant="outline"
			
 
				+            size="sm"
			
 
				+            className="mt-2"
			
 
				+            onClick={() => refetch()}
			
 
				+          >
			
 
				+            Retry
			
 
				+          </Button>
			
 
				+        </div>
			
 
				+      ) : null}
			
 
				+
			
 
				+      {isPending ? (
			
 
				+        <div className="rounded-md border bg-card p-8 text-center text-sm text-muted-foreground">
			
 
				+          Loading…
			
 
				+        </div>
			
 
				+      ) : data && data.items.length === 0 ? (
			
 
				+        <EmptyState
			
 
				+          icon={<Building2 className="h-8 w-8" />}
			
 
				+          title="No companies yet"
			
 
				+          description={
			
 
				+            canCreate
			
 
				+              ? 'Create the first company to start routing events.'
			
 
				+              : 'You will see your company here once it has been set up.'
			
 
				+          }
			
 
				+          action={canCreate ? <CreateTenantDialog /> : null}
			
 
				+        />
			
 
				+      ) : data ? (
			
 
				+        <>
			
 
				+          <div className="rounded-md border bg-card">
			
 
				+            <Table>
			
 
				+              <TableHeader>
			
 
				+                <TableRow>
			
 
				+                  <TableHead>Name</TableHead>
			
 
				+                  <TableHead>Slug</TableHead>
			
 
				+                  <TableHead>Status</TableHead>
			
 
				+                  <TableHead className="text-right">Rate limit</TableHead>
			
 
				+                  <TableHead>FCM</TableHead>
			
 
				+                  <TableHead>Created</TableHead>
			
 
				+                </TableRow>
			
 
				+              </TableHeader>
			
 
				+              <TableBody>
			
 
				+                {data.items.map((t) => (
			
 
				+                  <TableRow key={t.id}>
			
 
				+                    <TableCell>
			
 
				+                      <Link
			
 
				+                        to={`/companies/${t.id}`}
			
 
				+                        className="font-medium text-foreground hover:underline"
			
 
				+                      >
			
 
				+                        {t.display_name}
			
 
				+                      </Link>
			
 
				+                    </TableCell>
			
 
				+                    <TableCell>
			
 
				+                      <code className="rounded bg-muted px-1.5 py-0.5 text-xs">
			
 
				+                        {t.slug}
			
 
				+                      </code>
			
 
				+                    </TableCell>
			
 
				+                    <TableCell>
			
 
				+                      <StatusBadge status={t.status} />
			
 
				+                    </TableCell>
			
 
				+                    <TableCell className="text-right tabular-nums">
			
 
				+                      {formatRateLimit(t.rate_limit_per_sec)}
			
 
				+                    </TableCell>
			
 
				+                    <TableCell className="text-xs text-muted-foreground">
			
 
				+                      {t.fcm_shared ? 'shared' : 'dedicated'}
			
 
				+                    </TableCell>
			
 
				+                    <TableCell className="text-xs text-muted-foreground">
			
 
				+                      {formatDate(t.created_at)}
			
 
				+                    </TableCell>
			
 
				+                  </TableRow>
			
 
				+                ))}
			
 
				+              </TableBody>
			
 
				+            </Table>
			
 
				+          </div>
			
 
				+          <p className="text-xs text-muted-foreground">
			
 
				+            Showing {data.items.length} of {data.total}
			
 
				+          </p>
			
 
				+        </>
			
 
				+      ) : null}
			
 
				+    </div>
			
 
				+  );
			
 
				+}
			
--- a/web/src/features/companies/types.ts
+++ b/web/src/features/companies/types.ts
@@ -0,0 +1,43 @@
 
				+/**
			
 
				+ * Wire types for the /v1/tenants/* endpoints. Mirrors the Go
			
 
				+ * authd.Tenant struct in internal/authd/tenants.go. Kept in this
			
 
				+ * feature folder (not in /lib) because the types belong to the
			
 
				+ * Companies feature, not to the wider app.
			
 
				+ */
			
 
				+
			
 
				+export type TenantStatus = 'active' | 'suspended' | 'archived';
			
 
				+
			
 
				+export interface Tenant {
			
 
				+  id: string;
			
 
				+  slug: string;
			
 
				+  display_name: string;
			
 
				+  status: TenantStatus;
			
 
				+  contact_email: string;
			
 
				+  rate_limit_per_sec: number;
			
 
				+  fcm_shared: boolean;
			
 
				+  created_at: string; // RFC3339 from the server
			
 
				+  updated_at: string;
			
 
				+  archived_at?: string | null;
			
 
				+}
			
 
				+
			
 
				+export interface ListTenantsResponse {
			
 
				+  items: Tenant[];
			
 
				+  total: number;
			
 
				+  limit: number;
			
 
				+  offset: number;
			
 
				+}
			
 
				+
			
 
				+export interface CreateTenantInput {
			
 
				+  slug: string;
			
 
				+  display_name: string;
			
 
				+  contact_email: string;
			
 
				+  rate_limit_per_sec: number;
			
 
				+  fcm_shared: boolean;
			
 
				+}
			
 
				+
			
 
				+export interface UpdateTenantInput {
			
 
				+  display_name?: string;
			
 
				+  contact_email?: string;
			
 
				+  rate_limit_per_sec?: number;
			
 
				+  fcm_shared?: boolean;
			
 
				+}
			
--- a/web/src/lib/scope.ts
+++ b/web/src/lib/scope.ts
@@ -1,5 +1,20 @@
 
				 import type { Role } from './auth-context';
			
 
				 
			
 
				+/**
			
 
				+ * Role-based UI gates. Mirrors the server-side role checks in
			
 
				+ * internal/authd/middleware.go (RequireRole) and the per-id
			
 
				+ * scope check in cmd/authd/tenants.go (canAccessTenant). The
			
 
				+ * server is always the source of truth — these helpers just
			
 
				+ * keep the UI from rendering buttons that the server would
			
 
				+ * 403 on.
			
 
				+ *
			
 
				+ * canManage*:    the user can write / change things
			
 
				+ * canView*:      the user can read (anyone with auth can read)
			
 
				+ * canAccess*:    the user can navigate to a given tenant id
			
 
				+ *                (super_admin always, tenant_admin only own,
			
 
				+ *                viewer only own if we ever allow them in)
			
 
				+ */
			
 
				+
			
 
				 export function isSuperAdmin(role: Role | undefined | null): boolean {
			
 
				   return role === 'super_admin';
			
 
				 }
			
@@ -8,14 +23,36 @@ export function isTenantAdmin(role: Role | undefined | null): boolean {
 
				   return role === 'tenant_admin';
			
 
				 }
			
 
				 
			
 
				+// Companies: super_admin can manage (create/edit/suspend),
			
 
				+// tenant_admin can read+edit-own.
			
 
				 export function canManageCompanies(role: Role | undefined | null): boolean {
			
 
				   return role === 'super_admin';
			
 
				 }
			
 
				 
			
 
				+export function canViewCompanies(role: Role | undefined | null): boolean {
			
 
				+  return role === 'super_admin' || role === 'tenant_admin';
			
 
				+}
			
 
				+
			
 
				+// Sources: super_admin + tenant_admin can manage their own
			
 
				+// (added in M13b W2).
			
 
				 export function canManageSources(role: Role | undefined | null): boolean {
			
 
				   return role === 'super_admin' || role === 'tenant_admin';
			
 
				 }
			
 
				 
			
 
				+export function canViewSources(role: Role | undefined | null): boolean {
			
 
				+  return role === 'super_admin' || role === 'tenant_admin';
			
 
				+}
			
 
				+
			
 
				+// Telegram: super_admin only (M13b W3).
			
 
				+export function canManageTelegram(role: Role | undefined | null): boolean {
			
 
				+  return role === 'super_admin';
			
 
				+}
			
 
				+
			
 
				+export function canViewTelegram(role: Role | undefined | null): boolean {
			
 
				+  return role === 'super_admin';
			
 
				+}
			
 
				+
			
 
				+// DLQ: any authenticated role can read their own.
			
 
				 export function canViewDLQ(role: Role | undefined | null): boolean {
			
 
				   return role === 'super_admin' || role === 'tenant_admin' || role === 'viewer';
			
 
				 }
			
--- a/web/src/routes/companies.tsx
+++ b/web/src/routes/companies.tsx
@@ -1,18 +1,18 @@
 
				-import { ComingSoon } from '@/components/ui/coming-soon';
			
 
				+/**
			
 
				+ * Companies route. Delegates to the CompaniesList (M13b W1).
			
 
				+ * Sub-routes (e.g. /companies/:id) are nested under this route
			
 
				+ * so the sidebar Companies link keeps its active state.
			
 
				+ */
			
 
				+
			
 
				+import { Route, Routes } from 'react-router-dom';
			
 
				+import { CompaniesList } from '@/features/companies/list';
			
 
				+import { CompanyDetailPage } from '@/features/companies/detail-page';
			
 
				 
			
 
				 export function CompaniesRoute() {
			
 
				   return (
			
 
				-    <ComingSoon
			
 
				-      title="Companies"
			
 
				-      badge="M13b W1"
			
 
				-      description="Super-admin can create, list, edit, suspend, activate companies. Tenant-admin sees only their own (read-only)."
			
 
				-    >
			
 
				-      <ul className="ml-5 list-disc space-y-1 text-sm text-muted-foreground">
			
 
				-        <li>List with search, status filter, pagination</li>
			
 
				-        <li>Create form: name, slug, rate_limit_per_sec, fcm_shared</li>
			
 
				-        <li>Detail view with suspend / activate (typed confirmation)</li>
			
 
				-        <li>Tenant-admin: read-only view of own company</li>
			
 
				-      </ul>
			
 
				-    </ComingSoon>
			
 
				+    <Routes>
			
 
				+      <Route index element={<CompaniesList />} />
			
 
				+      <Route path=":id" element={<CompanyDetailPage />} />
			
 
				+    </Routes>
			
 
				   );
			
 
				 }
			
--- a/web/tests/companies.test.tsx
+++ b/web/tests/companies.test.tsx
@@ -0,0 +1,49 @@
 
				+/**
			
 
				+ * Tests for the pure helpers in the Companies feature. We don't
			
 
				+ * test the list / detail components here (they require a full
			
 
				+ * QueryClient + router + auth context setup; that's a v1.1
			
 
				+ * concern). The format helpers are the contract that the rest of
			
 
				+ * the feature relies on.
			
 
				+ */
			
 
				+
			
 
				+import { describe, expect, it } from 'vitest';
			
 
				+import { formatDate, formatRateLimit, statusLabel, statusVariant } from '@/features/companies/format';
			
 
				+
			
 
				+describe('companies/format', () => {
			
 
				+  it('statusLabel maps known statuses', () => {
			
 
				+    expect(statusLabel('active')).toBe('Active');
			
 
				+    expect(statusLabel('suspended')).toBe('Suspended');
			
 
				+    expect(statusLabel('archived')).toBe('Archived');
			
 
				+  });
			
 
				+
			
 
				+  it('statusLabel falls back to the raw value for unknown', () => {
			
 
				+    // Defensive: if the API ever grows a new status, the badge
			
 
				+    // shows the raw value rather than empty.
			
 
				+    expect(statusLabel('paused' as never)).toBe('paused');
			
 
				+  });
			
 
				+
			
 
				+  it('statusVariant picks a color per status', () => {
			
 
				+    expect(statusVariant('active')).toBe('success');
			
 
				+    expect(statusVariant('suspended')).toBe('warning');
			
 
				+    expect(statusVariant('archived')).toBe('muted');
			
 
				+  });
			
 
				+
			
 
				+  it('formatRateLimit renders k/M/s suffixes', () => {
			
 
				+    expect(formatRateLimit(100)).toBe('100/s');
			
 
				+    expect(formatRateLimit(1500)).toBe('1.5k/s');
			
 
				+    expect(formatRateLimit(10_000)).toBe('10.0k/s');
			
 
				+    expect(formatRateLimit(1_000_000)).toBe('1.0M/s');
			
 
				+  });
			
 
				+
			
 
				+  it('formatDate handles null and invalid', () => {
			
 
				+    expect(formatDate(null)).toBe('\u2014');
			
 
				+    expect(formatDate(undefined)).toBe('\u2014');
			
 
				+    expect(formatDate('not-a-date')).toBe('not-a-date');
			
 
				+  });
			
 
				+
			
 
				+  it('formatDate renders ISO timestamps', () => {
			
 
				+    const out = formatDate('2026-01-15T10:00:00Z');
			
 
				+    expect(out).toMatch(/2026/);
			
 
				+    expect(out).toMatch(/Jan/);
			
 
				+  });
			
 
				+});
			
--- a/web/tsconfig.tsbuildinfo
+++ b/web/tsconfig.tsbuildinfo
@@ -1 +1 @@
 
				-{"root":["./src/main.tsx","./src/router.tsx","./src/components/layout/app-shell.tsx","./src/components/layout/require-auth.tsx","./src/components/layout/sidebar.tsx","./src/components/layout/topbar.tsx","./src/components/layout/use-theme.ts","./src/components/ui/button.tsx","./src/components/ui/card.tsx","./src/components/ui/coming-soon.tsx","./src/components/ui/input.tsx","./src/components/ui/label.tsx","./src/lib/api.ts","./src/lib/auth-context.tsx","./src/lib/auth-state.ts","./src/lib/scope.ts","./src/lib/theme.ts","./src/lib/utils.ts","./src/routes/audit.tsx","./src/routes/companies.tsx","./src/routes/dlq.tsx","./src/routes/forbidden.tsx","./src/routes/index.tsx","./src/routes/login.tsx","./src/routes/not-found.tsx","./src/routes/sources.tsx","./src/routes/tail.tsx","./src/routes/telegram.tsx","./tests/login.test.tsx","./tests/setup.ts"],"version":"5.9.3"}
			
 
				+{"root":["./src/main.tsx","./src/router.tsx","./src/components/layout/app-shell.tsx","./src/components/layout/require-auth.tsx","./src/components/layout/sidebar.tsx","./src/components/layout/topbar.tsx","./src/components/layout/use-theme.ts","./src/components/ui/badge.tsx","./src/components/ui/button.tsx","./src/components/ui/card.tsx","./src/components/ui/coming-soon.tsx","./src/components/ui/dialog.tsx","./src/components/ui/empty-state.tsx","./src/components/ui/input.tsx","./src/components/ui/label.tsx","./src/components/ui/table.tsx","./src/components/ui/textarea.tsx","./src/features/companies/api.ts","./src/features/companies/create-dialog.tsx","./src/features/companies/detail-page.tsx","./src/features/companies/format.tsx","./src/features/companies/list.tsx","./src/features/companies/types.ts","./src/lib/api.ts","./src/lib/auth-context.tsx","./src/lib/auth-state.ts","./src/lib/scope.ts","./src/lib/theme.ts","./src/lib/utils.ts","./src/routes/audit.tsx","./src/routes/companies.tsx","./src/routes/dlq.tsx","./src/routes/forbidden.tsx","./src/routes/index.tsx","./src/routes/login.tsx","./src/routes/not-found.tsx","./src/routes/sources.tsx","./src/routes/tail.tsx","./src/routes/telegram.tsx","./tests/companies.test.tsx","./tests/login.test.tsx","./tests/setup.ts"],"version":"5.9.3"}