Skip to main content

​
Console

@cona/console — CONA staff only. Six pages, deployed to Vercel.
Console is architecturally different from the other two Next.js apps and that difference is intentional. It does not use @cona/core at all — it talks to @cona/database directly. The layering rules that govern webapp do not apply here.

​
Structure

​
Authorisation

Two gates, not one (app/lib/auth/): SUPERADMIN_REQUIRED_MESSAGE (authz.ts:3) is the shared denial string. Console also holds an Auth0 ManagementClient (auth0-management.ts:5) — it can create and invite users directly in the identity provider.

​
What it can do

Two of these reach outside the console’s own boundary:
  • Organisation deletion dispatches deleteOrganizationWorkflow on the org-deletion task queue via @cona/temporal-config.
  • Operational settings writes the config that apps/webapp/proxy.ts reads on every request to decide maintenance mode — the console can put the whole webapp into maintenance.

​
Dependencies

Note what is missing: no @cona/core, no @cona/types, no @cona/utils.

​
Notes

Console is cross-tenant by design. Every other app scopes queries by org_id; console reads across organisations. Any tenancy-isolation analysis must treat it as a deliberate exception rather than a violation. See Auth, Tenancy & Actors.
Console has the thinnest observability of any app — @axiomhq/js only. No OpenTelemetry, no Sentry, no PostHog. It is the surface with the widest blast radius (delete an organisation, put the platform into maintenance) and the least instrumentation. See Observability.
VAT catalog edits are global. product_tax_categories, product_tax_rate_types, and the eu_vat_* tables carry no tenancy column — they are shared reference data, so a console edit affects every organisation. See Data Model.