Skip to main content

​
Console

@cona/console — CONA staff only. Six pages, deployed to Vercel.
Console is architecturally different from the other two Next.js apps and that difference is intentional. It does not use @cona/core at all — it talks to @cona/database directly. The layering rules that govern webapp do not apply here.

​
Structure

​
Authorisation

One permission level: requireAuth() validates the Console Auth0 session’s subject and email. All admitted users can use every Console page and action. The header shows identity without a per-user role. Mutation audit attribution is preserved. Admission belongs to the dedicated Console Auth0 application. Verify enabled connections, signup policy, and deployed post-login Actions exclude customer accounts before rollout. Local inspection on 8 November 2026 could not verify this policy because the saved Auth0 CLI credentials could not renew; activation is blocked pending that evidence. No production access settings were changed. Organization deletion requires DELETE <current slug> on the server as well as in the shared confirmation dialog. Active subscriptions remain blocked; sandbox purge and production retention behavior are unchanged. Console also holds an Auth0 ManagementClient (auth0-management.ts:5) — it can create and invite users directly in the identity provider.

​
What it can do

Two of these reach outside the console’s own boundary:
  • Organisation deletion dispatches deleteOrganizationWorkflow on the org-deletion task queue via @cona/temporal-config.
  • Operational settings writes the config that apps/webapp/proxy.ts reads on every request to decide maintenance mode — the console can put the whole webapp into maintenance.

​
Dependencies

Note what is missing: no @cona/core, no @cona/types, no @cona/utils.

​
Notes

Console is cross-tenant by design. Every other app scopes queries by org_id; console reads across organisations. Any tenancy-isolation analysis must treat it as a deliberate exception rather than a violation. See Auth, Tenancy & Actors.
Console has the thinnest observability of any app — @axiomhq/js only. No OpenTelemetry, no Sentry, no PostHog. It is the surface with the widest blast radius (delete an organisation, put the platform into maintenance) and the least instrumentation. See Observability.
VAT catalog edits are global. product_tax_categories, product_tax_rate_types, and the eu_vat_* tables carry no tenancy column — they are shared reference data, so a console edit affects every organisation. See Data Model.