Metadata-Version: 2.4
Name: tba-app-backend-platform-administration
Version: 0.4.0.dev2
Summary: Platform owner and operator control-plane backend application for TBA.
License-Expression: Apache-2.0
Requires-Python: >=3.10,<3.15
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Requires-Dist: pydantic (==2.12.5)
Requires-Dist: tba-app-backend-core (==0.4.0.dev2)
Requires-Dist: tba-auth (==0.4.0.dev2)
Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
Requires-Dist: tba-router-administration-gate (==0.4.0.dev2)
Requires-Dist: tba-server-identity (==0.4.0.dev2)
Requires-Dist: tigrbl (==0.4.5.dev8)
Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/90-backend-apps/tba-app-backend-platform-administration
Description-Content-Type: text/markdown

# tba-app-backend-platform-administration

Platform-scoped tenant lifecycle and authority-assignment API front door.

## Surface

| Property | Value |
| --- | --- |
| Product surface | `platform-admin-app` |

The backend app owns HTTP schemas and routes only. Tenant, realm, and identity
administration are invoked through request-scoped layer-40 capabilities composed
by `tba-server-identity`; durable table operations and secret hashing remain
in the layer-60 runtime adapters and their lower-layer providers.
| Intended UIX | `@tba/ui-platform-administration` |
| Exposes | Tenant lifecycle, platform authority assignment, admin identity lookup, audit/session/profile RPC |
| Excludes | Public login/consent pages, tenant self-service-only workflows, developer app registration surface |

## Entrypoint

```python
from tba_app_backend_platform_administration import app, build_app
```

## Local dev deployment

Run the isolated platform control-plane front door on port `8015`:

```bash
docker compose -f docker/docker-compose.platform-admin-app.yml up -d --build
```

The dev API key defaults to `dev-platform-admin-key`.

Useful endpoints:

| Endpoint | Purpose |
| --- | --- |
| `/openapi.json` | Platform-admin REST/control-plane contract. |
| `/openrpc.json` | Platform-admin JSON-RPC method contract. |
| `/rpc` | API-key-protected JSON-RPC dispatch. |
| `/tenant` | API-key-protected platform tenant lifecycle resource. |

