> ## Documentation Index
> Fetch the complete documentation index at: https://cona.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Console

> The superadmin console — cross-tenant operations, direct database access, and why it deliberately skips @cona/core

# Console

`@cona/console` — CONA staff only. Six pages, deployed to Vercel.

<Note>
  Console is architecturally different from the other two Next.js apps and that difference is
  intentional. It **does not use `@cona/core` at all** — it talks to `@cona/database` directly. The
  layering rules that govern webapp do not apply here.
</Note>

## Structure

```mermaid theme={null}
flowchart TB
    Superadmin["CONA staff"]

    subgraph Console["@cona/console"]
        Pages["6 pages<br/>organizations · app-store<br/>operational-settings · vat-catalog"]
        Auth["lib/auth/<br/>requireAuth<br/>requireSuperadmin"]
        Actions["lib/actions/<br/>6 domains"]
        Prisma["lib/db/prisma.ts"]
    end

    Auth0["Auth0<br/>+ ManagementClient"]
    DB[("Supabase Postgres<br/>cross-tenant")]
    OpConfig["@cona/operational-config"]
    TemporalConfig["@cona/temporal-config"]
    Temporal["Temporal Cloud"]

    Superadmin -->|"HTTPS + Auth0"| Pages
    Pages --> Auth
    Auth -->|"OIDC + user management"| Auth0
    Pages --> Actions
    Actions --> Prisma
    Prisma -->|"direct Prisma, no core"| DB
    Actions --> OpConfig
    Actions -->|"delete-organization"| TemporalConfig
    TemporalConfig --> Temporal

    classDef boundary fill:#f8fafc,stroke:#94a3b8,color:#334155

    classDef app fill:#dbe2fb,stroke:#3B56C5,color:#111827
    classDef pkg fill:#e8eafd,stroke:#4967E6,color:#111827
    classDef data fill:#fde8e8,stroke:#c53b3b,color:#111827
    classDef external fill:#fff4dd,stroke:#c98a12,color:#111827
    classDef async fill:#e3f7ea,stroke:#2f9e5c,color:#111827
    classDef actor fill:#eceff4,stroke:#64748b,color:#111827

    class Pages,Auth,Actions app
    class OpConfig,TemporalConfig pkg
    class Prisma,DB data
    class Auth0 external
    class Temporal async
    class Superadmin actor
    class Console boundary
```

## Authorisation

Two gates, not one (`app/lib/auth/`):

| Function                       | Location      | Purpose                            |
| ------------------------------ | ------------- | ---------------------------------- |
| `requireAuth()`                | `auth.ts:26`  | valid Auth0 session                |
| `requireSuperadmin()`          | `auth.ts:43`  | session **and** superadmin subject |
| `isConsoleSuperadmin(subject)` | `authz.ts:14` | the membership predicate           |

`SUPERADMIN_REQUIRED_MESSAGE` (`authz.ts:3`) is the shared denial string.

Console also holds an Auth0 `ManagementClient` (`auth0-management.ts:5`) — it can create
and invite users directly in the identity provider.

## What it can do

| Area                 | Actions                                                         |
| -------------------- | --------------------------------------------------------------- |
| Organisations        | list, get by id, **delete**, set trial expiry, mark/unmark demo |
| Users                | invite, create in Auth0                                         |
| Operational settings | update global maintenance and announcement config               |
| App Store            | list, upsert, delete listings                                   |
| VAT catalog          | read and mutate global VAT reference data                       |

Two of these reach outside the console's own boundary:

* **Organisation deletion** dispatches `deleteOrganizationWorkflow` on the `org-deletion`
  task queue via `@cona/temporal-config`.
* **Operational settings** writes the config that `apps/webapp/proxy.ts` reads on every
  request to decide maintenance mode — the console can put the whole webapp into
  maintenance.

## Dependencies

| Package                    | Imports |
| -------------------------- | ------: |
| `@cona/ui`                 |      95 |
| `@cona/operational-config` |       7 |
| `@cona/database`           |       4 |
| `@cona/tailwind-config`    |       2 |
| `@cona/temporal-config`    |       1 |

Note what is missing: no `@cona/core`, no `@cona/types`, no `@cona/utils`.

## Notes

**Console is cross-tenant by design.** Every other app scopes queries by `org_id`; console
reads across organisations. Any tenancy-isolation analysis must treat it as a deliberate
exception rather than a violation. See
[Auth, Tenancy & Actors](/architecture/auth-tenancy-actors).

<Warning>
  **Console has the thinnest observability of any app** — `@axiomhq/js` only. No OpenTelemetry, no
  Sentry, no PostHog. It is the surface with the widest blast radius (delete an organisation, put
  the platform into maintenance) and the least instrumentation. See
  [Observability](/architecture/observability).
</Warning>

**VAT catalog edits are global.** `product_tax_categories`, `product_tax_rate_types`, and
the `eu_vat_*` tables carry no tenancy column — they are shared reference data, so a
console edit affects every organisation. See [Data Model](/architecture/data-model).