Admin App — Code Map

Frontend (apps/admin)

• apps/admin/src/main.tsx — Vite + React entry.
• apps/admin/src/App.tsx — Refine + Clerk + AntD wiring, resource list, route table.
• apps/admin/src/theme.ts — AntD theme overrides.
• apps/admin/src/styles.css — global styles (login layout).
• apps/admin/src/providers/data-provider.ts — custom Refine dataProvider with Clerk bearer injection; throws HttpError on non-2xx.
• apps/admin/src/providers/auth-provider.ts — Refine authProvider over Clerk hooks; check requires GET /admin/session to return 200.

Pages

• apps/admin/src/pages/organizations/{list,show}.tsx
• apps/admin/src/pages/users/{list,show}.tsx
• apps/admin/src/pages/leads/list.tsx
• apps/admin/src/pages/owner-invitations/list.tsx — grants table, “Invite owner” modal (email + “Existing account” switch), resend / revoke row actions. App.tsx registers resource owner-invitations.
• apps/admin/src/pages/audit-logs/list.tsx
• apps/admin/src/pages/queues/list.tsx
• apps/admin/src/pages/system/show.tsx
• apps/admin/src/pages/costs/list.tsx
• apps/admin/src/pages/billing/show.tsx
• apps/admin/src/pages/platform-billing/list.tsx
• apps/admin/src/pages/observability/show.tsx
• apps/admin/src/pages/actions/show.tsx
• apps/admin/src/pages/payments/list.tsx
• apps/admin/src/pages/subscriptions/list.tsx
• apps/admin/src/pages/jobs/list.tsx
• apps/admin/src/pages/canonical/show.tsx

Backend (apps/api/src/admin)

Module + cross-cutting

• apps/api/src/admin/admin.module.ts — wires controllers, services, the global AdminAuditInterceptor.
• apps/api/src/admin/guards/platform-admin.guard.ts — Redis-cached Clerk privateMetadata.platformRole check.
• apps/api/src/admin/guards/platform-admin.decorator.ts — @PlatformAdmin() decorator (controller-level).
• apps/api/src/admin/interceptors/admin-audit.interceptor.ts — writes one audit row per mutation.

Controllers

• admin-organizations.controller.ts — org list / detail / tier updates.
• admin-users.controller.ts — user search / detail (emailOwnership) / reset-password / delete / POST :id/verify-email-ownership (AdminUsersService.verifyEmailOwnership(id, adminClerkId) → UsersService.markEmailOwnershipProven(clerkId, adminClerkId); 404 for soft-deleted users).
• admin-owner-invitations.controller.ts — owner grants: list / create / resend / revoke, delegating to OwnerInvitationsService (apps/api/src/owner-invitations/). DTOs: dto/create-owner-invitation.dto.ts, dto/owner-invitations-query.dto.ts.
• admin-leads.controller.ts — leads pipeline.
• admin-audit-logs.controller.ts — audit log query surface.
• admin-queues.controller.ts — BullMQ ops.
• admin-system.controller.ts — health + env summary.
• admin-costs.controller.ts — cost dashboards.
• admin-billing.controller.ts — per-org billing inspection.
• admin-platform-billing.controller.ts — Taikan’s own billing.
• admin-impersonate.controller.ts — impersonation token issuance.
• admin-actions.controller.ts — manual repair actions.
• admin-data-repair.controller.ts — typed data-repair operations.
• admin-observability.controller.ts — observability dashboards.
• admin-payments.controller.ts — payment list / refund.
• admin-subscriptions.controller.ts — subscription list.
• admin-jobs.controller.ts — cross-org job listing.

Services

Each controller has a corresponding admin-<resource>.service.ts under apps/api/src/admin/services/. They wrap the underlying resource services with cross-org capabilities and admin-only filters.

DTOs

apps/api/src/admin/dto/* — typed bodies for every admin mutation (reset password, refund, cancel platform txn, impersonate, etc.).

Schema

• libs/db/src/lib/schema/admin.ts — audit_logs.
• libs/db/src/lib/schema/owner-invitations.ts — owner_invitations (see users-auth data model).