Function bodies 163 total

function ProtectedRoute({ children }: { children: React.ReactNode }) {
  const token = useStore((s) => s.token);
  const user = useStore((s) => s.user);

  if (!token) return <Navigate to="/login" replace />;

  // Force password change on first login
  if (user?.mustChangePassword && window.location.pathname !== '/change-password') {
    return <Navigate to="/change-password" replace />;
  }

  return <>{children}</>;
}

export default function App() {
  return (
    <Routes>
      <Route path="/login" element={<LoginPage />} />
      <Route path="/change-password" element={
        <ProtectedRoute><ChangePasswordPage /></ProtectedRoute>
      } />
      <Route path="/" element={
        <ProtectedRoute><Layout /></ProtectedRoute>
      }>
        <Route index element={<Navigate to="/dashboard" replace />} />
        <Route path="dashboard" element={<DashboardPage />} />
        <Route path="tenants" element={<TenantsPage />} />
        <Route path="tenants/:tenantId" element={<TenantDetailPage />} />
        <Route path="users" element={<UsersPage />} />
        <Route path="settings" element={<SettingsPage />} />
        <Route path="audit" element={<AuditPage />} />
        <Route path="health" element={<PlatformHealthPage />} />
      </Route>
    </Routes>
  );
}

export default function Header() {
  const user = useStore((s) => s.user);
  const logout = useStore((s) => s.logout);
  const navigate = useNavigate();
  const [menuOpen, setMenuOpen] = useState(false);

  const handleLogout = () => {
    logout();
    navigate('/login');
  };

  return (
    <header className="h-16 bg-white border-b border-slate-200 flex items-center justify-between px-6">
      <div>
        <h1 className="text-lg font-semibold text-slate-800">Platform Administration</h1>
      </div>

      <div className="relative">
        <button
          onClick={() => setMenuOpen(!menuOpen)}
          className="flex items-center gap-2 px-3 py-2 rounded-lg hover:bg-slate-100 transition-colors"
        >
          <div className="w-8 h-8 bg-blue-600 rounded-full flex items-center justify-center text-white text-sm font-medium">
            {user?.firstName?.charAt(0)}{user?.lastName?.charAt(0)}
          </div>
          <div className="text-left hidden sm:block">
            <

export default function Layout() {
  const sidebarOpen = useStore((s) => s.sidebarOpen);

  return (
    <div className="flex h-screen bg-slate-50">
      <Sidebar />
      <div className={`flex-1 flex flex-col transition-all duration-200 ${sidebarOpen ? 'ml-64' : 'ml-16'}`}>
        <Header />
        <main className="flex-1 overflow-auto p-6">
          <Outlet />
        </main>
      </div>
    </div>
  );
}

export default function Sidebar() {
  const sidebarOpen = useStore((s) => s.sidebarOpen);
  const toggleSidebar = useStore((s) => s.toggleSidebar);
  const hasPermission = useStore((s) => s.hasPermission);

  return (
    <aside className={`fixed left-0 top-0 h-full bg-slate-900 text-white transition-all duration-200 z-30 ${sidebarOpen ? 'w-64' : 'w-16'}`}>
      <div className="flex items-center h-16 px-4 border-b border-slate-700">
        <Globe className="w-7 h-7 text-blue-400 shrink-0" />
        {sidebarOpen && (
          <div className="ml-3">
            <div className="font-bold text-sm leading-tight">DnXT Global</div>
            <div className="text-[10px] text-slate-400 uppercase tracking-wider">Admin Portal</div>
          </div>
        )}
      </div>

      <nav className="mt-4 flex flex-col gap-1 px-2">
        {navItems.map((item) => {
          if (!hasPermission(item.permission)) return null;
          return (
            <NavLink
              key={item.to}
     

export default function AuditPage() {
  const [entries, setEntries] = useState<AuditEntry[]>([]);
  const [loading, setLoading] = useState(true);
  const [page, setPage] = useState(0);
  const [totalPages, setTotalPages] = useState(0);

  const fetchLogs = (p: number) => {
    setLoading(true);
    auditApi.list(p, 30)
      .then((res) => {
        setEntries(res.data.data.content);
        setTotalPages(res.data.data.totalPages);
      })
      .catch(console.error)
      .finally(() => setLoading(false));
  };

  useEffect(() => { fetchLogs(page); }, [page]);

  const actionColors: Record<string, string> = {
    LOGIN_SUCCESS: 'bg-green-100 text-green-700',
    LOGIN_FAILED: 'bg-red-100 text-red-700',
    LOGIN_REJECTED: 'bg-red-100 text-red-700',
    LOGIN_RATE_LIMITED: 'bg-amber-100 text-amber-700',
    TENANT_CREATED: 'bg-blue-100 text-blue-700',
    TENANT_UPDATED: 'bg-blue-100 text-blue-700',
    TENANT_DEACTIVATED: 'bg-red-100 text-red-700',
    TENANT_REACTIVATED: 'bg-green-1

export default function ChangePasswordPage() {
  const [currentPassword, setCurrentPassword] = useState('');
  const [newPassword, setNewPassword] = useState('');
  const [confirmPassword, setConfirmPassword] = useState('');
  const [error, setError] = useState('');
  const [loading, setLoading] = useState(false);
  const user = useStore((s) => s.user);
  const setAuth = useStore((s) => s.setAuth);
  const token = useStore((s) => s.token);
  const navigate = useNavigate();

  const passwordReqs = [
    { met: newPassword.length >= 12, text: 'At least 12 characters' },
    { met: /[A-Z]/.test(newPassword), text: 'One uppercase letter' },
    { met: /[a-z]/.test(newPassword), text: 'One lowercase letter' },
    { met: /\d/.test(newPassword), text: 'One number' },
    { met: /[@$!%*?&#^()\-_=+]/.test(newPassword), text: 'One special character' },
    { met: newPassword === confirmPassword && newPassword.length > 0, text: 'Passwords match' },
  ];

  const allMet = passwordReqs.every((r) =

export default function DashboardPage() {
  const [data, setData] = useState<DashboardOverview | null>(null);
  const [loading, setLoading] = useState(true);

  useEffect(() => {
    dashboardApi.overview()
      .then((res) => setData(res.data.data))
      .catch(console.error)
      .finally(() => setLoading(false));
  }, []);

  if (loading) {
    return <div className="flex items-center justify-center h-64 text-slate-500">Loading dashboard...</div>;
  }

  if (!data) {
    return <div className="text-red-500">Failed to load dashboard data.</div>;
  }

  const stats = [
    { label: 'Active Tenants', value: data.activeTenants, total: data.totalTenants, icon: Building2, color: 'blue' },
    { label: 'Total Licenses', value: data.totalLicenses, icon: Key, color: 'green' },
    { label: 'Admin Users', value: data.activeAdminUsers, total: data.totalAdminUsers, icon: Users, color: 'purple' },
    { label: 'Audit Entries', value: data.totalAuditEntries, icon: Shield, color: 'amber' },
  ]

export default function LoginPage() {
  const [email, setEmail] = useState('');
  const [password, setPassword] = useState('');
  const [error, setError] = useState('');
  const [loading, setLoading] = useState(false);
  const [googleLoading, setGoogleLoading] = useState(false);
  const [showPasswordLogin, setShowPasswordLogin] = useState(false);
  const setAuth = useStore((s) => s.setAuth);
  const navigate = useNavigate();
  const [searchParams] = useSearchParams();

  // Handle Google SSO callback — exchange one-time code for token
  useEffect(() => {
    const urlParams = new URLSearchParams(window.location.search);
    const ssoCode = urlParams.get('sso_code');
    const errorMsg = urlParams.get('error');

    if (errorMsg) {
      setError(decodeURIComponent(errorMsg));
      window.history.replaceState({}, '', '/login');
      return;
    }

    if (ssoCode) {
      setGoogleLoading(true);
      window.history.replaceState({}, '', '/login');

      api.post('/auth/google/exchang

export default function PlatformHealthPage() {
  const [health, setHealth] = useState<any>(null);
  const [loading, setLoading] = useState(true);

  const fetchHealth = () => {
    setLoading(true);
    dashboardApi.health()
      .then((res) => setHealth(res.data.data))
      .catch(console.error)
      .finally(() => setLoading(false));
  };

  useEffect(() => { fetchHealth(); }, []);

  if (loading) return <div className="text-center text-slate-500 py-12">Loading platform health...</div>;
  if (!health) return <div className="text-red-500">Failed to load platform health.</div>;

  return (
    <div>
      <div className="flex items-center justify-between mb-6">
        <div className="flex items-center gap-2">
          <Activity className="w-5 h-5 text-slate-600" />
          <h2 className="text-xl font-bold text-slate-900">Platform Health</h2>
        </div>
        <button onClick={fetchHealth}
          className="px-3 py-1.5 text-sm border border-slate-300 rounded-lg hover:bg-s

export default function SettingsPage() {
  const [configs, setConfigs] = useState<PlatformConfig[]>([]);
  const [edited, setEdited] = useState<Record<string, string>>({});
  const [loading, setLoading] = useState(true);
  const [saving, setSaving] = useState(false);
  const [activeTab, setActiveTab] = useState('GENERAL');
  const hasPermission = useStore((s) => s.hasPermission);
  const canEdit = hasPermission('CONFIG_EDIT');

  useEffect(() => {
    configApi.list()
      .then((res) => setConfigs(res.data.data))
      .catch(console.error)
      .finally(() => setLoading(false));
  }, []);

  const categories = [...new Set(configs.map((c) => c.category))];
  const filtered = configs.filter((c) => c.category === activeTab);

  const handleSave = async () => {
    if (Object.keys(edited).length === 0) return;
    setSaving(true);
    try {
      await configApi.update(edited);
      setConfigs(configs.map((c) =>
        edited[c.configKey] !== undefined
          ? { ...c, configValue

export default function TenantDetailPage() {
  const { tenantId } = useParams<{ tenantId: string }>();
  const [tenant, setTenant] = useState<Tenant | null>(null);
  const [modules, setModules] = useState<TenantModule[]>([]);
  const [loading, setLoading] = useState(true);
  const [accessLoading, setAccessLoading] = useState(false);
  const navigate = useNavigate();
  const hasPermission = useStore((s) => s.hasPermission);

  useEffect(() => {
    if (!tenantId) return;
    tenantApi.get(tenantId)
      .then((res) => {
        setTenant(res.data.data.tenant);
        setModules(res.data.data.modules);
      })
      .catch(console.error)
      .finally(() => setLoading(false));
  }, [tenantId]);

  const handleToggleModule = async (moduleName: string, currentEnabled: boolean) => {
    if (!tenantId) return;
    try {
      await tenantApi.toggleModule(tenantId, moduleName, !currentEnabled);
      setModules(modules.map((m) =>
        m.moduleName === moduleName ? { ...m, isEnabled: !c

export default function TenantsPage() {
  const [tenants, setTenants] = useState<Tenant[]>([]);
  const [search, setSearch] = useState('');
  const [loading, setLoading] = useState(true);
  const [showCreate, setShowCreate] = useState(false);
  const navigate = useNavigate();
  const hasPermission = useStore((s) => s.hasPermission);

  useEffect(() => {
    Promise.all([tenantApi.list(), planApi.list()])
      .then(([tenantsRes, plansRes]) => {
        setTenants(tenantsRes.data.data);
        setPlans(plansRes.data.data || []);
      })
      .catch(console.error)
      .finally(() => setLoading(false));
  }, []);

  const filtered = tenants.filter((t) =>
    t.tenantName.toLowerCase().includes(search.toLowerCase()) ||
    t.tenantSlug.toLowerCase().includes(search.toLowerCase()) ||
    (t.industry || '').toLowerCase().includes(search.toLowerCase())
  );

  const allModules = [
    { name: 'Operations', available: true },
    { name: 'Reviewer', available: false },
    { name: 'Publi

export default function UsersPage() {
  const [users, setUsers] = useState<AdminUser[]>([]);
  const [roles, setRoles] = useState<any[]>([]);
  const [loading, setLoading] = useState(true);
  const [showCreate, setShowCreate] = useState(false);
  const [editUser, setEditUser] = useState<AdminUser | null>(null);
  const hasPermission = useStore((s) => s.hasPermission);

  const [form, setForm] = useState({ email: '', firstName: '', lastName: '', roleId: '' });

  useEffect(() => {
    Promise.all([userApi.list(), roleApi.list()])
      .then(([usersRes, rolesRes]) => {
        setUsers(usersRes.data.data);
        setRoles(rolesRes.data.data);
      })
      .catch(console.error)
      .finally(() => setLoading(false));
  }, []);

  const handleCreate = async (e: React.FormEvent) => {
    e.preventDefault();
    try {
      const res = await userApi.create(form);
      setUsers([...users, res.data.data]);
      setShowCreate(false);
      setForm({ email: '', firstName: '', lastName: ''

    public RestTemplate restTemplate() {
        return new RestTemplate();
    }

    public String getOperationsServiceUrl() {
        return operationsServiceUrl;
    }

    public String getMailServiceUrl() {
        return mailServiceUrl;
    }

    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(12);
    }

                    protected Resource getResource(String resourcePath, Resource location) throws IOException {
                        Resource resource = location.createRelative(resourcePath);
                        if (resource.isReadable()) {
                            return resource;
                        }
                        // SPA fallback: return index.html for all unmatched routes
                        return new ClassPathResource("/static/index.html");
                    }

public class AuditController {

    @Autowired
    private AuditService auditService;

    @GetMapping
    @PermissionCheck("AUDIT_VIEW")
    public ResponseEntity<ApiResponse> getLogs(
            @RequestParam(defaultValue = "0") int page,
            @RequestParam(defaultValue = "50") int size) {
        return ResponseEntity.ok(ApiResponse.ok(auditService.getLogs(page, size)));
    }

    @GetMapping("/action/{action}")
    @PermissionCheck("AUDIT_VIEW")
    public ResponseEntity<ApiResponse> getLogsByAction(
            @PathVariable String action,
            @RequestParam(defaultValue = "0") int page,
            @RequestParam(defaultValue = "50") int size) {
        return ResponseEntity.ok(ApiResponse.ok(auditService.getLogsByAction(action, page, size)));
    }

    @GetMapping("/user/{userId}")
    @PermissionCheck("AUDIT_VIEW")
    public ResponseEntity<ApiResponse> getLogsByUser(
            @PathVariable String userId,
            @RequestParam(defaultValue = "0") int page

public class AuthController {

    private static final Logger log = LoggerFactory.getLogger(AuthController.class);

    @Autowired
    private AuthService authService;

    @Autowired
    private AuditService auditService;

    @Autowired
    private LoginRateLimiter rateLimiter;

    @PostMapping("/login")
    public ResponseEntity<ApiResponse> login(@Valid @RequestBody LoginRequest request,
                                             HttpServletRequest httpRequest) {
        String clientIp = getClientIp(httpRequest);

        // Rate limit check
        if (rateLimiter.isRateLimited(clientIp)) {
            auditService.log("LOGIN_RATE_LIMITED",
                    "IP: " + clientIp + ", email: " + request.getEmail(), httpRequest);
            return ResponseEntity.status(HttpStatus.TOO_MANY_REQUESTS)
                    .body(ApiResponse.error("Too many login attempts. Please try again later."));
        }

        try {
            LoginResponse response = authService.login(requ

    public ResponseEntity<ApiResponse> login(@Valid @RequestBody LoginRequest request,
                                             HttpServletRequest httpRequest) {
        String clientIp = getClientIp(httpRequest);

        // Rate limit check
        if (rateLimiter.isRateLimited(clientIp)) {
            auditService.log("LOGIN_RATE_LIMITED",
                    "IP: " + clientIp + ", email: " + request.getEmail(), httpRequest);
            return ResponseEntity.status(HttpStatus.TOO_MANY_REQUESTS)
                    .body(ApiResponse.error("Too many login attempts. Please try again later."));
        }

        try {
            LoginResponse response = authService.login(request);
            auditService.log(response.getUserId(), response.getUsername(), "LOGIN_SUCCESS",
                    "USER", response.getUserId(), response.getEmail(),
                    "Role: " + response.getRole(), httpRequest);
            return ResponseEntity.ok(ApiResponse.ok(response));
        } ca

    public ResponseEntity<ApiResponse> getCurrentUser(Authentication authentication) {
        if (authentication == null || authentication.getName() == null) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                    .body(ApiResponse.error("Not authenticated"));
        }
        try {
            String userId = authentication.getName();
            LoginResponse response = authService.getCurrentUser(userId);
            return ResponseEntity.ok(ApiResponse.ok(response));
        } catch (IllegalArgumentException e) {
            return ResponseEntity.status(HttpStatus.NOT_FOUND)
                    .body(ApiResponse.error(e.getMessage()));
        }
    }

    public ResponseEntity<ApiResponse> changePassword(Authentication authentication,
                                                       @Valid @RequestBody ChangePasswordRequest request,
                                                       HttpServletRequest httpRequest) {
        if (authentication == null) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                    .body(ApiResponse.error("Not authenticated"));
        }
        try {
            String userId = authentication.getName();
            authService.changePassword(userId, request);
            auditService.log(userId, null, "PASSWORD_CHANGED",
                    "USER", userId, null, null, httpRequest);
            return ResponseEntity.ok(ApiResponse.ok("Password changed successfully"));
        } catch (IllegalArgumentException e) {
            return ResponseEntity.badRequest().body(ApiResponse.error(e.getMessage()));
        }
    }

    private String getClientIp(HttpServletRequest request) {
        String xff = request.getHeader("X-Forwarded-For");
        if (xff != null && !xff.isEmpty()) {
            return xff.split(",")[0].trim();
        }
        return request.getRemoteAddr();
    }

public class ConfigController {

    @Autowired
    private ConfigService configService;

    @Autowired
    private AuditService auditService;

    @GetMapping
    @PermissionCheck("CONFIG_VIEW")
    public ResponseEntity<ApiResponse> getAllConfig() {
        return ResponseEntity.ok(ApiResponse.ok(configService.getAllConfig()));
    }

    @GetMapping("/category/{category}")
    @PermissionCheck("CONFIG_VIEW")
    public ResponseEntity<ApiResponse> getConfigByCategory(@PathVariable String category) {
        return ResponseEntity.ok(ApiResponse.ok(configService.getConfigByCategory(category)));
    }

    @PutMapping
    @PermissionCheck("CONFIG_EDIT")
    public ResponseEntity<ApiResponse> updateConfig(@RequestBody Map<String, String> updates,
                                                     Authentication auth,
                                                     HttpServletRequest httpRequest) {
        configService.updateConfig(updates, auth.getName());
        auditService.l

    public ResponseEntity<ApiResponse> getAllConfig() {
        return ResponseEntity.ok(ApiResponse.ok(configService.getAllConfig()));
    }

    public ResponseEntity<ApiResponse> getConfigByCategory(@PathVariable String category) {
        return ResponseEntity.ok(ApiResponse.ok(configService.getConfigByCategory(category)));
    }

    public ResponseEntity<ApiResponse> updateConfig(@RequestBody Map<String, String> updates,
                                                     Authentication auth,
                                                     HttpServletRequest httpRequest) {
        configService.updateConfig(updates, auth.getName());
        auditService.log(auth.getName(), null, "CONFIG_UPDATED",
                "CONFIG", null, null,
                "Keys: " + String.join(", ", updates.keySet()), httpRequest);
        return ResponseEntity.ok(ApiResponse.ok("Configuration updated"));
    }

public class DashboardController {

    @Autowired
    private DashboardService dashboardService;

    @GetMapping("/overview")
    @PermissionCheck("DASHBOARD_VIEW")
    public ResponseEntity<ApiResponse> getOverview() {
        return ResponseEntity.ok(ApiResponse.ok(dashboardService.getOverview()));
    }

    @GetMapping("/health")
    @PermissionCheck("DASHBOARD_VIEW")
    public ResponseEntity<ApiResponse> getPlatformHealth() {
        return ResponseEntity.ok(ApiResponse.ok(dashboardService.getPlatformHealth()));
    }
}

    public ResponseEntity<ApiResponse> getOverview() {
        return ResponseEntity.ok(ApiResponse.ok(dashboardService.getOverview()));
    }

    public ResponseEntity<ApiResponse> getPlatformHealth() {
        return ResponseEntity.ok(ApiResponse.ok(dashboardService.getPlatformHealth()));
    }

public class GoogleAuthController {

    private static final Logger log = LoggerFactory.getLogger(GoogleAuthController.class);

    @Autowired
    private GoogleAuthService googleAuthService;

    @Autowired
    private AuditService auditService;

    // Temporary store for SSO tokens — keyed by one-time code, expires after use
    private final ConcurrentHashMap<String, LoginResponse> pendingTokens = new ConcurrentHashMap<>();

    /**
     * GET /api/auth/google/url — returns the Google OAuth2 authorization URL.
     * Frontend redirects the browser to this URL.
     */
    @GetMapping("/url")
    public ResponseEntity<ApiResponse> getAuthUrl() {
        String url = googleAuthService.getAuthorizationUrl();
        return ResponseEntity.ok(ApiResponse.ok(Map.of("url", url)));
    }

    /**
     * GET /api/auth/google/callback — Google redirects here after user consents.
     * Exchanges the auth code for tokens, verifies identity, issues JWT.
     * Redirects to frontend with token

    public ResponseEntity<ApiResponse> getAuthUrl() {
        String url = googleAuthService.getAuthorizationUrl();
        return ResponseEntity.ok(ApiResponse.ok(Map.of("url", url)));
    }

    public ResponseEntity<ApiResponse> exchangeCode(@RequestBody Map<String, String> body) {
        String code = body.get("code");
        if (code == null || code.isBlank()) {
            return ResponseEntity.badRequest().body(ApiResponse.error("SSO code is required"));
        }

        LoginResponse response = pendingTokens.remove(code);
        if (response == null) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                    .body(ApiResponse.error("Invalid or expired SSO code"));
        }

        return ResponseEntity.ok(ApiResponse.ok(response));
    }

    public ResponseEntity<ApiResponse> exchangeToken(@RequestBody Map<String, String> body,
                                                      HttpServletRequest httpRequest) {
        String code = body.get("code");
        if (code == null || code.isBlank()) {
            return ResponseEntity.badRequest().body(ApiResponse.error("Authorization code is required"));
        }

        try {
            LoginResponse response = googleAuthService.handleCallback(code);

            auditService.log(response.getUserId(), response.getUsername(),
                    "GOOGLE_SSO_LOGIN", "USER", response.getUserId(),
                    response.getEmail(), "Role: " + response.getRole(), httpRequest);

            return ResponseEntity.ok(ApiResponse.ok(response));

        } catch (SecurityException e) {
            auditService.log("GOOGLE_SSO_REJECTED", e.getMessage(), httpRequest);
            return ResponseEntity.status(HttpStatus.FORBIDDEN)
                    .body(ApiResponse.error

public class PlanController {

    @Autowired
    private ModulePlanRepository planRepository;

    @GetMapping
    @PermissionCheck("TENANT_VIEW")
    public ResponseEntity<ApiResponse> getAllPlans() {
        return ResponseEntity.ok(ApiResponse.ok(planRepository.findAll()));
    }

    @GetMapping("/{module}")
    @PermissionCheck("TENANT_VIEW")
    public ResponseEntity<ApiResponse> getPlansByModule(@PathVariable String module) {
        return ResponseEntity.ok(ApiResponse.ok(
                planRepository.findByModuleNameAndIsActiveTrueOrderBySortOrderAsc(module)));
    }
}

    public ResponseEntity<ApiResponse> getAllPlans() {
        return ResponseEntity.ok(ApiResponse.ok(planRepository.findAll()));
    }

    public ResponseEntity<ApiResponse> getPlansByModule(@PathVariable String module) {
        return ResponseEntity.ok(ApiResponse.ok(
                planRepository.findByModuleNameAndIsActiveTrueOrderBySortOrderAsc(module)));
    }

public class RoleController {

    @Autowired
    private AdminRoleRepository roleRepository;

    @GetMapping
    @PermissionCheck("USER_VIEW")
    public ResponseEntity<ApiResponse> getAllRoles() {
        return ResponseEntity.ok(ApiResponse.ok(roleRepository.findAll()));
    }
}

    public ResponseEntity<ApiResponse> getAllRoles() {
        return ResponseEntity.ok(ApiResponse.ok(roleRepository.findAll()));
    }

public class TenantController {

    @Autowired
    private TenantService tenantService;

    @Autowired
    private AuditService auditService;

    @Autowired
    private SupportAccessService supportAccessService;

    @GetMapping
    @PermissionCheck("TENANT_VIEW")
    public ResponseEntity<ApiResponse> getAllTenants() {
        return ResponseEntity.ok(ApiResponse.ok(tenantService.getAllTenants()));
    }

    @GetMapping("/active")
    @PermissionCheck("TENANT_VIEW")
    public ResponseEntity<ApiResponse> getActiveTenants() {
        return ResponseEntity.ok(ApiResponse.ok(tenantService.getActiveTenants()));
    }

    @GetMapping("/{tenantId}")
    @PermissionCheck("TENANT_VIEW")
    public ResponseEntity<ApiResponse> getTenant(@PathVariable String tenantId) {
        try {
            PlatformTenant tenant = tenantService.getTenant(tenantId);
            List<TenantModule> modules = tenantService.getTenantModules(tenantId);
            return ResponseEntity.ok(ApiResponse.ok(Map.

    public ResponseEntity<ApiResponse> getAllTenants() {
        return ResponseEntity.ok(ApiResponse.ok(tenantService.getAllTenants()));
    }

    public ResponseEntity<ApiResponse> getActiveTenants() {
        return ResponseEntity.ok(ApiResponse.ok(tenantService.getActiveTenants()));
    }

    public ResponseEntity<ApiResponse> getTenant(@PathVariable String tenantId) {
        try {
            PlatformTenant tenant = tenantService.getTenant(tenantId);
            List<TenantModule> modules = tenantService.getTenantModules(tenantId);
            return ResponseEntity.ok(ApiResponse.ok(Map.of("tenant", tenant, "modules", modules)));
        } catch (IllegalArgumentException e) {
            return ResponseEntity.status(404).body(ApiResponse.error(e.getMessage()));
        }
    }

    public ResponseEntity<ApiResponse> createTenant(@Valid @RequestBody TenantCreateRequest request,
                                                     Authentication auth,
                                                     HttpServletRequest httpRequest) {
        try {
            PlatformTenant tenant = tenantService.createTenant(request, auth.getName());
            auditService.log(auth.getName(), null, "TENANT_CREATED",
                    "TENANT", tenant.getTenantId(), tenant.getTenantName(),
                    "Slug: " + tenant.getTenantSlug(), httpRequest);
            return ResponseEntity.ok(ApiResponse.ok(tenant));
        } catch (IllegalArgumentException e) {
            return ResponseEntity.badRequest().body(ApiResponse.error(e.getMessage()));
        }
    }

    public ResponseEntity<ApiResponse> updateTenant(@PathVariable String tenantId,
                                                     @Valid @RequestBody TenantCreateRequest request,
                                                     Authentication auth,
                                                     HttpServletRequest httpRequest) {
        try {
            PlatformTenant tenant = tenantService.updateTenant(tenantId, request, auth.getName());
            auditService.log(auth.getName(), null, "TENANT_UPDATED",
                    "TENANT", tenantId, tenant.getTenantName(), null, httpRequest);
            return ResponseEntity.ok(ApiResponse.ok(tenant));
        } catch (IllegalArgumentException e) {
            return ResponseEntity.badRequest().body(ApiResponse.error(e.getMessage()));
        }
    }

    public ResponseEntity<ApiResponse> deactivateTenant(@PathVariable String tenantId,
                                                         Authentication auth,
                                                         HttpServletRequest httpRequest) {
        try {
            PlatformTenant tenant = tenantService.getTenant(tenantId);
            tenantService.deactivateTenant(tenantId, auth.getName());
            auditService.log(auth.getName(), null, "TENANT_DEACTIVATED",
                    "TENANT", tenantId, tenant.getTenantName(),
                    "All modules disabled", httpRequest);
            return ResponseEntity.ok(ApiResponse.ok("Tenant deactivated"));
        } catch (IllegalArgumentException e) {
            return ResponseEntity.badRequest().body(ApiResponse.error(e.getMessage()));
        }
    }

    public ResponseEntity<ApiResponse> reactivateTenant(@PathVariable String tenantId,
                                                         Authentication auth,
                                                         HttpServletRequest httpRequest) {
        try {
            PlatformTenant tenant = tenantService.getTenant(tenantId);
            tenantService.reactivateTenant(tenantId, auth.getName());
            auditService.log(auth.getName(), null, "TENANT_REACTIVATED",
                    "TENANT", tenantId, tenant.getTenantName(), null, httpRequest);
            return ResponseEntity.ok(ApiResponse.ok("Tenant reactivated"));
        } catch (IllegalArgumentException e) {
            return ResponseEntity.badRequest().body(ApiResponse.error(e.getMessage()));
        }
    }

    public ResponseEntity<ApiResponse> toggleModule(@PathVariable String tenantId,
                                                     @PathVariable String moduleName,
                                                     @RequestBody Map<String, Boolean> body,
                                                     Authentication auth,
                                                     HttpServletRequest httpRequest) {
        try {
            boolean enabled = Boolean.TRUE.equals(body.get("enabled"));
            TenantModule module = tenantService.toggleModule(tenantId, moduleName, enabled, auth.getName());
            auditService.log(auth.getName(), null, enabled ? "MODULE_ENABLED" : "MODULE_DISABLED",
                    "MODULE", module.getModuleId(), moduleName,
                    "Tenant: " + tenantId, httpRequest);
            return ResponseEntity.ok(ApiResponse.ok(module));
        } catch (IllegalArgumentException e) {
            return ResponseEntity.badRequest().body(A