Panduan Admin

Surface internal di ai.numintek.com/admin. Untuk operator platform Danum, bukan tenant customer.

Siapa admin

User yang punya record AdminUser. Role:

• SUPER_ADMIN — permission wildcard (semua aksi).
• ADMIN — kebanyakan aksi kecuali hapus admin lain.
• SUPPORT — read-only + impersonate.
• FINANCE — billing + approval pembayaran saja.
• COMPLIANCE — audit log, compliance rules, data subject requests.

Editable di /admin/roles. Role SUPER_ADMIN selalu keep wildcard.

Workflow umum

Approve pembayaran manual

1. /admin/payments-manual → buka row SUBMITTED.
2. Verify gambar bukti terhadap statement bank Danum (nominal + pengirim + tanggal).
3. Klik Approve — invoice jadi PAID, subscription aktif.

Impersonate tenant (support)

1. /admin/tenants/<id> → Issue impersonation token → alasan (min 8 karakter).
2. Salin JWT yang muncul.
3. Paste sebagai cookie danum_session di browser (atau Authorization: Bearer untuk API).
4. Session valid 30 menit. Setiap issuance ter-audit-log.

Kirim broadcast

1. /admin/broadcasts → Compose new broadcast.
2. Title + body (markdown OK).
3. Audience: ALL, PLAN_TIER, INDUSTRY, atau TENANT_LIST.
4. Channels: IN_APP (notifikasi dashboard) + EMAIL (via Resend).
5. Save → Send (idempotent, aman di-retry).

Toggle feature flag

1. /admin/feature-flags.
2. Toggle isActive untuk master on/off.
3. defaultValue dikembalikan kalau tidak ada tenant override.
4. Override per tenant via Overrides collapse.

Verify audit chain

/admin/audit → Verify chain. Jalankan SHA-256 chain check di semua audit row (scoped by tenant kalau kamu set filter). intact: false → escalate ke security lead. Jangan hapus atau modifikasi row yang di-flag.

Support hub

/admin/support adalah card grid yang mengarah ke semua ops surface + escalation playbook (billing dispute, security incident, compliance report, outage).

Runbook

Deploy, restore, rotasi secret, incident response — lihat docs/RUNBOOK.md di repo.