Operator Panel

Overview

The operator panel is accessible only to Convertella staff, protected by Cloudflare Access (Zero Trust). Operators create organizations, provision projects, manage domains, invite users, and view the audit log.

Access Control

All operator routes are behind Cloudflare Access:

• Operators authenticate via Cloudflare Access (MFA-enforced)
• JWT verification in src/lib/auth/cf-access.ts
• Email allowlist via OPERATOR_ALLOWED_EMAILS env var
• No Lucia session — stateless per-request auth

Page Structure

Route	Page	Purpose
/operator/	Operator dashboard	Overview of organizations and projects
/operator/organizations/new	Create organization	Register a new real estate developer
/operator/projects/new	Create project	Provision a new project with portal defaults
/operator/users/invite	Invite CRM user	Create users row + project access (see below)
/operator/domains	Domain management	Manage portal domain registrations
/operator/audit	Audit log	View immutable audit trail

Inviting CRM users (/operator/users/invite)

Uses provisionCrmUser() from src/lib/auth/provision-crm-user.ts:

• Role is required: developer or agent
• At least one project must be selected
• Project list shows all projects platform-wide; each row shows the project name with organization as secondary text (not filtered to a single org)
• Developers: must pick an organisation; selected projects must belong to that org (memberships + assignments)
• Agents: no organisation field — assignments via agent_project_assignments only, including cross-org (same agent email can work on projects from different developers)

Invited users sign in at / (the CRM login page) with OTP (no password).

API Routes

Endpoint	Purpose
GET /api/operator/projects	List all projects (operator-scoped)
POST /api/operator/projects	Create project with portal

Cloudflare Integration

The operator panel manages platform infrastructure through these integrations:

• Custom Hostnames — src/lib/cloudflare/custom-hostnames.ts wraps the Cloudflare for SaaS API for registering, polling, and removing client domains
• Cloudflare Access — Creates/reuses Access apps and policies per client
• Cloudflare Tunnel — Configures tunnel ingress routes for Directus admin (legacy, during migration)

Lock-in Mitigation

All Cloudflare-specific functionality is wrapped in isolated modules:

Module	Purpose	Exit Strategy
src/lib/cloudflare/custom-hostnames.ts	Custom hostname CRUD	Replace with Caddy/CloudFront/Vercel API
src/lib/auth/cf-access.ts	JWT verification	Replace with Auth0/Clerk/WorkOS module
src/lib/r2/	Presigned URLs	Replace endpoint, keep S3 SDK interface