feat: add web app pages for org portal, thread viewer, and admin org management

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/app/api/admin/orgs/[id]/admins/route.ts

@@ -0,0 +1,21 @@
+import { getApiBaseUrl, jsonResponse } from '../../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+async function getSuperToken(): Promise<string | undefined> {
+  const { cookies } = await import('next/headers');
+  return (await cookies()).get('tower_super_token')?.value;
+}
+
+export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }): Promise<Response> {
+  const { id } = await params;
+  const token = await getSuperToken();
+  const body = await req.json().catch(() => ({}));
+  const res = await fetch(`${getApiBaseUrl()}/admin/orgs/${id}/admins`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    body: JSON.stringify(body),
+    cache: 'no-store',
+  });
+  return jsonResponse(await res.json(), res.status);
+}

apps/web/app/api/admin/orgs/[id]/route.ts

@@ -0,0 +1,18 @@
+import { getApiBaseUrl, jsonResponse } from '../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+async function getSuperToken(): Promise<string | undefined> {
+  const { cookies } = await import('next/headers');
+  return (await cookies()).get('tower_super_token')?.value;
+}
+
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }): Promise<Response> {
+  const { id } = await params;
+  const token = await getSuperToken();
+  const res = await fetch(`${getApiBaseUrl()}/admin/orgs/${id}`, {
+    headers: { Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    cache: 'no-store',
+  });
+  return jsonResponse(await res.json(), res.status);
+}

apps/web/app/api/admin/orgs/route.ts

@@ -0,0 +1,29 @@
+import { getApiBaseUrl, jsonResponse } from '../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+async function getSuperToken(): Promise<string | undefined> {
+  const { cookies } = await import('next/headers');
+  return (await cookies()).get('tower_super_token')?.value;
+}
+
+export async function GET(): Promise<Response> {
+  const token = await getSuperToken();
+  const res = await fetch(`${getApiBaseUrl()}/admin/orgs`, {
+    headers: { Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    cache: 'no-store',
+  });
+  return jsonResponse(await res.json(), res.status);
+}
+
+export async function POST(req: Request): Promise<Response> {
+  const token = await getSuperToken();
+  const body = await req.json().catch(() => ({}));
+  const res = await fetch(`${getApiBaseUrl()}/admin/orgs`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    body: JSON.stringify(body),
+    cache: 'no-store',
+  });
+  return jsonResponse(await res.json(), res.status);
+}

apps/web/app/api/admin/tenants/[id]/org/route.ts

@@ -0,0 +1,21 @@
+import { getApiBaseUrl, jsonResponse } from '../../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+async function getSuperToken(): Promise<string | undefined> {
+  const { cookies } = await import('next/headers');
+  return (await cookies()).get('tower_super_token')?.value;
+}
+
+export async function PATCH(req: Request, { params }: { params: Promise<{ id: string }> }): Promise<Response> {
+  const { id } = await params;
+  const token = await getSuperToken();
+  const body = await req.json().catch(() => ({}));
+  const res = await fetch(`${getApiBaseUrl()}/admin/tenants/${id}/org`, {
+    method: 'PATCH',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    body: JSON.stringify(body),
+    cache: 'no-store',
+  });
+  return jsonResponse(await res.json(), res.status);
+}

apps/web/app/api/auth/org/login/route.ts

@@ -0,0 +1,19 @@
+import { getApiBaseUrl, jsonResponse } from '../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function POST(req: Request): Promise<Response> {
+  const body = await req.json().catch(() => ({}));
+  const res = await fetch(`${getApiBaseUrl()}/auth/org/login`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify(body),
+    cache: 'no-store',
+  });
+  const payload = await res.json();
+  const headers: Record<string, string> = {};
+  if (res.ok && payload.token) {
+    headers['Set-Cookie'] = `tower_org_token=${payload.token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${7 * 24 * 60 * 60}`;
+  }
+  return jsonResponse(payload, res.status, headers);
+}

apps/web/app/api/auth/org/logout/route.ts

@@ -0,0 +1,9 @@
+import { jsonResponse } from '../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function POST(): Promise<Response> {
+  return jsonResponse({ ok: true }, 200, {
+    'Set-Cookie': 'tower_org_token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',
+  });
+}

apps/web/app/api/auth/org/me/route.ts

@@ -0,0 +1,16 @@
+import { getApiBaseUrl, jsonResponse } from '../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(): Promise<Response> {
+  const token = await (await import('next/headers')).cookies().then(c => c.get('tower_org_token')?.value);
+  const res = await fetch(`${getApiBaseUrl()}/auth/org/me`, {
+    headers: {
+      Accept: 'application/json',
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+    },
+    cache: 'no-store',
+  });
+  const body = await res.json();
+  return jsonResponse(body, res.status);
+}

apps/web/app/api/org/dashboard/route.ts

@@ -0,0 +1,17 @@
+import { getApiBaseUrl, jsonResponse } from '../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+async function getOrgToken(): Promise<string | undefined> {
+  const { cookies } = await import('next/headers');
+  return (await cookies()).get('tower_org_token')?.value;
+}
+
+export async function GET(): Promise<Response> {
+  const token = await getOrgToken();
+  const res = await fetch(`${getApiBaseUrl()}/org/dashboard`, {
+    headers: { Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    cache: 'no-store',
+  });
+  return jsonResponse(await res.json(), res.status);
+}

apps/web/app/api/org/rules/[id]/route.ts

@@ -0,0 +1,32 @@
+import { getApiBaseUrl, jsonResponse } from '../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+async function getOrgToken(): Promise<string | undefined> {
+  const { cookies } = await import('next/headers');
+  return (await cookies()).get('tower_org_token')?.value;
+}
+
+export async function PATCH(req: Request, { params }: { params: Promise<{ id: string }> }): Promise<Response> {
+  const { id } = await params;
+  const token = await getOrgToken();
+  const body = await req.json().catch(() => ({}));
+  const res = await fetch(`${getApiBaseUrl()}/org/rules/${id}`, {
+    method: 'PATCH',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    body: JSON.stringify(body),
+    cache: 'no-store',
+  });
+  return jsonResponse(await res.json(), res.status);
+}
+
+export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }): Promise<Response> {
+  const { id } = await params;
+  const token = await getOrgToken();
+  const res = await fetch(`${getApiBaseUrl()}/org/rules/${id}`, {
+    method: 'DELETE',
+    headers: { Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    cache: 'no-store',
+  });
+  return res.ok ? jsonResponse({ ok: true }, 200) : jsonResponse(await res.json(), res.status);
+}

apps/web/app/api/org/rules/route.ts

@@ -0,0 +1,29 @@
+import { getApiBaseUrl, jsonResponse } from '../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+async function getOrgToken(): Promise<string | undefined> {
+  const { cookies } = await import('next/headers');
+  return (await cookies()).get('tower_org_token')?.value;
+}
+
+export async function GET(): Promise<Response> {
+  const token = await getOrgToken();
+  const res = await fetch(`${getApiBaseUrl()}/org/rules`, {
+    headers: { Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    cache: 'no-store',
+  });
+  return jsonResponse(await res.json(), res.status);
+}
+
+export async function POST(req: Request): Promise<Response> {
+  const token = await getOrgToken();
+  const body = await req.json().catch(() => ({}));
+  const res = await fetch(`${getApiBaseUrl()}/org/rules`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    body: JSON.stringify(body),
+    cache: 'no-store',
+  });
+  return jsonResponse(await res.json(), res.status);
+}

apps/web/app/api/org/tenants/[id]/route.ts

@@ -0,0 +1,18 @@
+import { getApiBaseUrl, jsonResponse } from '../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+async function getOrgToken(): Promise<string | undefined> {
+  const { cookies } = await import('next/headers');
+  return (await cookies()).get('tower_org_token')?.value;
+}
+
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }): Promise<Response> {
+  const { id } = await params;
+  const token = await getOrgToken();
+  const res = await fetch(`${getApiBaseUrl()}/org/tenants/${id}`, {
+    headers: { Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    cache: 'no-store',
+  });
+  return jsonResponse(await res.json(), res.status);
+}

apps/web/app/api/org/tenants/route.ts

@@ -0,0 +1,29 @@
+import { getApiBaseUrl, jsonResponse } from '../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+async function getOrgToken(): Promise<string | undefined> {
+  const { cookies } = await import('next/headers');
+  return (await cookies()).get('tower_org_token')?.value;
+}
+
+export async function GET(): Promise<Response> {
+  const token = await getOrgToken();
+  const res = await fetch(`${getApiBaseUrl()}/org/tenants`, {
+    headers: { Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    cache: 'no-store',
+  });
+  return jsonResponse(await res.json(), res.status);
+}
+
+export async function POST(req: Request): Promise<Response> {
+  const token = await getOrgToken();
+  const body = await req.json().catch(() => ({}));
+  const res = await fetch(`${getApiBaseUrl()}/org/tenants`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    body: JSON.stringify(body),
+    cache: 'no-store',
+  });
+  return jsonResponse(await res.json(), res.status);
+}

apps/web/app/api/threads/[id]/route.ts

@@ -0,0 +1,13 @@
+import { apiFetch, jsonResponse } from '../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(
+  _req: Request,
+  { params }: { params: Promise<{ id: string }> },
+): Promise<Response> {
+  const { id } = await params;
+  const res = await apiFetch(`/admin/threads/${id}`);
+  const body = await res.json();
+  return jsonResponse(body, res.status);
+}

apps/web/app/api/threads/route.ts

@@ -0,0 +1,9 @@
+import { apiFetch, jsonResponse } from '../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(_req: Request): Promise<Response> {
+  const res = await apiFetch('/admin/threads');
+  const body = await res.json();
+  return jsonResponse(body, res.status);
+}