# System Admin Implementation Checklist

Complete this checklist to fully integrate the System Admin system into your Beezifi workspace.

## Database Setup
- [ ] Run database migration with updated schema.sql
- [ ] Verify three new tables created:
  - [ ] `banned_accounts`
  - [ ] `system_admin_logs`
  - [ ] `system_admin_sessions`
- [ ] Check foreign keys created correctly
- [ ] Verify indexes created for performance

## Backend Implementation

### Controllers & Routes
- [ ] Copy `systemAdminController.js` to `backend/src/controllers/`
- [ ] Copy `systemAdmin.js` to `backend/src/routes/`
- [ ] Update `backend/src/routes/index.js` to include system admin routes
- [ ] Verify route mounts: `router.use('/system-admin', require('./systemAdmin'));`

### Authentication Middleware
- [ ] Verify `requireSystemAdmin` middleware exists in `backend/src/middleware/auth.js`
- [ ] Ensure middleware checks `req.user.is_system_admin === true`
- [ ] Middleware is used on protected system admin endpoints

### Initialization Script
- [ ] Copy `initSystemAdmin.js` to `backend/scripts/`
- [ ] Make script executable: `chmod +x backend/scripts/initSystemAdmin.js`
- [ ] Test script runs without errors
- [ ] Test creating first system admin with script

## Frontend Implementation

### Components
- [ ] Copy `systemAdminConsole.js` to `frontend/js/components/`
- [ ] Verify component exports properly
- [ ] Component ready to import in main app

### Styles
- [ ] Copy `systemAdmin.css` to `frontend/css/`
- [ ] Import styles in frontend main HTML or CSS file
- [ ] Verify styles load correctly

### Integration Points
- [ ] Add system admin console link to main navigation (for admins only)
- [ ] Create route to `/admin` page that loads `SystemAdminConsole`
- [ ] Add authentication check to `/admin` route
- [ ] Ensure only `is_system_admin` users can access

## Testing

### API Testing
- [ ] Test `/api/system-admin/check` returns correct status
- [ ] Test `/api/system-admin/init` creates first admin
- [ ] Test each endpoint with valid/invalid data
- [ ] Test authentication requirements (should reject without token)
- [ ] Test authorization (should reject non-admins)
- [ ] Test all promo code endpoints
- [ ] Test all account ban/unban endpoints
- [ ] Test audit logging

### Admin Setup
- [ ] Initialize first system admin with script
- [ ] Log in with admin credentials
- [ ] Verify access to system admin console

### Console Testing
- [ ] Dashboard tab loads stats correctly
- [ ] Admins tab shows all admins
- [ ] Can add new admin
- [ ] Can remove admin
- [ ] Accounts tab shows ban management
- [ ] Can ban accounts
- [ ] Can unban accounts
- [ ] Promo tab shows batch creation
- [ ] Can create new batch
- [ ] Can view batch details
- [ ] Logs tab shows audit trail

## Documentation
- [ ] Add link to `docs/system-admin.md` in main documentation
- [ ] Add link to `docs/SYSTEM_ADMIN_QUICK_REF.md`
- [ ] Update `docs/setup.md` with system admin initialization steps
- [ ] Update API documentation with new endpoints

## Security Review
- [ ] Verify TOTP fields exist in users table (already present)
- [ ] Ensure all passwords hashed with bcrypt
- [ ] Verify IP addresses logged for all admin actions
- [ ] Check audit logs cannot be modified after creation
- [ ] Ensure system admin routes use HTTPS in production
- [ ] Verify rate limiting applied to admin endpoints
- [ ] Check error messages don't leak sensitive info
- [ ] Ensure tokens expire appropriately

## Dependencies
- [ ] Verify bcryptjs installed (for password hashing): `npm list bcryptjs`
- [ ] Verify uuid installed: `npm list uuid`
- [ ] Check MySQL driver installed and compatible
- [ ] Verify Express.js middleware order is correct

## Deployment Checklist
- [ ] Environment variables configured (if needed)
- [ ] Database backups taken before migration
- [ ] Rollback plan in place
- [ ] Monitor system admin logs after deployment
- [ ] Verify no performance degradation
- [ ] Check all audit logs being created

## Post-Deployment
- [ ] Document admin account credentials securely
- [ ] Add second system admin for backup
- [ ] Enable TOTP 2FA on all admin accounts
- [ ] Set up monitoring for audit logs
- [ ] Create backup procedures for admin credentials
- [ ] Schedule regular audit log reviews
- [ ] Test account ban/unban functionality
- [ ] Test promo code redemption with created codes
- [ ] Document any customizations made

## Troubleshooting
If you encounter issues during implementation:

### Database Issues
- [ ] Verify database user has proper permissions
- [ ] Check that all tables created: 
  ```sql
  SHOW TABLES LIKE '%banned%';
  SHOW TABLES LIKE '%log%';
  ```
- [ ] Verify foreign keys: 
  ```sql
  SELECT CONSTRAINT_NAME FROM INFORMATION_SCHEMA.KEY_COLUMN_USAGE WHERE TABLE_NAME='banned_accounts';
  ```

### Authentication Issues
- [ ] Check `is_system_admin` field exists in users table
- [ ] Verify token generation works
- [ ] Check middleware error messages in server logs
- [ ] Ensure auth config file includes new middleware

### Frontend Issues
- [ ] Verify CSS loads (check browser console)
- [ ] Check component initialization in browser console
- [ ] Verify API calls return 200/201 status codes
- [ ] Check CORS if frontend/backend on different origins

### Promo Code Issues
- [ ] Verify batch creation generates correct number of codes
- [ ] Check code format in database: `XXX-XXX-XXX-XXX`
- [ ] Verify unique constraint on code column
- [ ] Check redemption logic in billing system

## Files Modified/Created

### Created Files
- ✅ `backend/src/controllers/systemAdminController.js`
- ✅ `backend/src/routes/systemAdmin.js`
- ✅ `backend/scripts/initSystemAdmin.js`
- ✅ `frontend/js/components/systemAdminConsole.js`
- ✅ `frontend/css/systemAdmin.css`
- ✅ `docs/system-admin.md`
- ✅ `docs/SYSTEM_ADMIN_QUICK_REF.md`
- ✅ `IMPLEMENTATION_CHECKLIST.md` (this file)

### Updated Files
- ✅ `database/schema.sql` (3 new tables added)
- ✅ `backend/src/routes/index.js` (added system-admin route)

### May Need Updates
- [ ] `backend/src/middleware/auth.js` (add requireSystemAdmin if missing)
- [ ] `frontend/index.html` (import systemAdmin.css)
- [ ] `frontend/js/app.js` (add route to /admin page)
- [ ] `docs/setup.md` (add system admin section)
- [ ] `docs/api.md` (add new endpoints)

## Sign-Off

- [ ] All checklist items completed
- [ ] Testing passed
- [ ] Documentation updated
- [ ] Ready for production deployment

**Date Completed**: _______________

**Completed By**: _______________

**Notes**: 

---

For questions or issues, refer to the comprehensive guide in `docs/system-admin.md`.