ساختار مالکیت پلتفرم: یک مالک، مدیرانِ ساختهٔ مالک، سازمان‌های مدیریت‌شده

- users.is_platform_owner → users.platform_role (owner|manager|user) با مهاجرت
  d4e5f6a7b8c9 و backfill. ایندکس یکتای جزئی uq_single_platform_owner تضمین
  می‌کند دقیقاً یک مالک وجود داشته باشد — در سطح دیتابیس، نه فقط در کد.
- ثبت‌نام عمومی حذف شد (POST /auth/signup). حساب‌ها فقط با POST /admin/users
  (فقط مالک، با رمز موقت یک‌بارمصرف) یا با پذیرش لینک دعوت ساخته می‌شوند.
  در مسیر دعوت، اگر حساب وجود نداشته باشد خودِ دعوت‌شده رمز تعیین می‌کند؛ اگر
  وجود داشته باشد لینک هرگز جای reset رمز را نمی‌گیرد.
- ساخت سازمان فقط برای مالک و مدیران؛ کاربر عادی با دعوت عضو می‌شود.
- تنزل یا حذف مدیر، سازمان‌هایش را به مالک سامانه منتقل می‌کند (مالکیت + عضویت،
  با audit). حساب مالک از API تغییرناپذیر است؛ جابه‌جایی صندلی فقط با
  POST /admin/transfer-ownership و در یک تراکنش انجام می‌شود.
- افزودن POST /auth/change-password برای تبدیل رمز موقت به رمز خصوصی.
- فرانت: صفحهٔ /admin/users، صفحهٔ /account، بازنویسی /accept-invite، حذف /signup،
  گارد /onboarding برای کاربر عادی، و نشان نقش پلتفرم در پوستهٔ اپ.
- PRAGMA foreign_keys=ON برای SQLite تا ON DELETE CASCADE در dev و prod یکسان
  رفتار کند (پیش‌تر حذف کاربر، عضویت‌هایش را یتیم می‌گذاشت).
- تست: ۳۰۰ تست بک‌اند (شامل tests/test_platform_hierarchy.py با ۲۲ تست) و ۶۴ تست
  فرانت‌اند؛ ruff، mypy، tsc، eslint و build تمیز.

apps/api/alembic/versions/d4e5f6a7b8c9_single_platform_owner.py

@@ -0,0 +1,87 @@
+"""Single platform owner; users gain a platform role
+
+The old schema had ``users.is_platform_owner`` as a plain boolean with no
+uniqueness guard, so nothing stopped a second (or tenth) platform owner from
+appearing. This migration replaces the boolean with ``platform_role``
+(``owner`` | ``manager`` | ``user``) and makes "exactly one owner" a *database*
+invariant through a partial unique index — a second ``owner`` INSERT now fails
+even if some future code path forgets to check.
+
+Backfill rules:
+
+- any row that was ``is_platform_owner = true`` becomes ``owner``;
+- if a legacy database somehow had several owners, only the earliest (by
+  ``created_at``) keeps the role and the rest are demoted to ``manager``;
+- everything else becomes ``user``.
+
+Revision ID: d4e5f6a7b8c9
+Revises: c2d3e4f5b6a7
+Create Date: 2026-10-13 18:20:00.000000
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+
+
+revision: str = "d4e5f6a7b8c9"
+down_revision: str | None = "c2d3e4f5b6a7"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+_OWNER_WHERE = sa.text("platform_role = 'owner'")
+
+
+def upgrade() -> None:
+    op.add_column(
+        "users",
+        sa.Column(
+            "platform_role",
+            sa.String(length=16),
+            nullable=False,
+            server_default="user",
+        ),
+    )
+    # Defensive backfill: keep only the earliest owner, demote any others.
+    # Written with the boolean literal ``FALSE`` because both SQLite (>=3.23)
+    # and PostgreSQL accept it, while ``0`` would be a type error on Postgres.
+    op.execute(
+        "UPDATE users SET is_platform_owner = FALSE "
+        "WHERE is_platform_owner AND id NOT IN "
+        "(SELECT id FROM users WHERE is_platform_owner ORDER BY created_at LIMIT 1)"
+    )
+    op.execute("UPDATE users SET platform_role = 'owner' WHERE is_platform_owner")
+    op.create_index(
+        "ix_user_platform_role",
+        "users",
+        ["platform_role"],
+        unique=False,
+    )
+    op.create_index(
+        "uq_single_platform_owner",
+        "users",
+        ["platform_role"],
+        unique=True,
+        sqlite_where=_OWNER_WHERE,
+        postgresql_where=_OWNER_WHERE,
+    )
+    op.drop_column("users", "is_platform_owner")
+
+
+def downgrade() -> None:
+    op.add_column(
+        "users",
+        sa.Column(
+            "is_platform_owner",
+            sa.Boolean(),
+            nullable=False,
+            server_default=sa.false(),
+        ),
+    )
+    op.execute("UPDATE users SET is_platform_owner = TRUE WHERE platform_role = 'owner'")
+    op.drop_index("uq_single_platform_owner", table_name="users")
+    op.drop_index("ix_user_platform_role", table_name="users")
+    op.drop_column("users", "platform_role")

apps/api/app/application/services/platform_users.py

@@ -0,0 +1,86 @@
+"""Platform user administration — the owner-side account lifecycle.
+
+Only the platform owner may call into this module; the HTTP layer enforces that
+with ``require_platform_owner``. It owns three rules that are easy to get wrong
+and expensive to get wrong:
+
+1. **Exactly one ``OWNER`` exists.** Creating a second owner is refused;
+   moving the seat is the single transactional :func:`transfer_ownership`,
+   which demotes the previous owner in the same step.
+2. **The owner account is immutable from here** — it cannot be demoted,
+   deactivated or deleted through the API. An owner who lost access is fixed
+   by the other owner-seat holder or at the database, never by a quiet API
+   call.
+3. **A departing manager's organizations move to the platform owner.** Both
+   ``organizations.owner_user_id`` *and* the membership table are updated: an
+   organization whose owner has no membership is invisible to its own owner,
+   and a leftover ``owner`` membership would contradict the new
+   ``owner_user_id``.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.domain.identity.models import (
+    Membership,
+    MembershipStatus,
+    Role,
+    User,
+)
+from app.infrastructure.repositories.identity import (
+    MembershipRepository,
+    OrganizationRepository,
+)
+
+
+@dataclass(slots=True)
+class OrganizationTransfer:
+    """One organization that changed hands, for the audit trail."""
+
+    organization_id: str
+    organization_name: str
+
+
+async def transfer_owned_organizations(
+    session: AsyncSession, *, from_user_id: str, to_user: User
+) -> list[OrganizationTransfer]:
+    """Move every organization owned by ``from_user_id`` to ``to_user``.
+
+    The departing user keeps an ``admin`` membership where they had ``owner``:
+    they built the tenant, and silently losing all access would be a bigger
+    surprise than keeping working access without ownership.
+    """
+    orgs = OrganizationRepository(session)
+    memberships = MembershipRepository(session)
+    transferred: list[OrganizationTransfer] = []
+
+    for org in await orgs.list_owned_by(from_user_id):
+        await orgs.reassign_owner(org.id, to_user.id)
+        if await memberships.get(org.id, to_user.id) is None:
+            await memberships.add(
+                Membership(
+                    organization_id=org.id,
+                    user_id=to_user.id,
+                    role=Role.OWNER,
+                    status=MembershipStatus.ACTIVE,
+                )
+            )
+        previous = await memberships.get(org.id, from_user_id)
+        if previous is not None and previous.role == Role.OWNER:
+            await memberships.set_role(previous.id, Role.ADMIN)
+        transferred.append(
+            OrganizationTransfer(organization_id=org.id, organization_name=org.name)
+        )
+    return transferred
+
+
+async def demote_manager_accounts_organizations(
+    session: AsyncSession, *, manager: User, owner: User
+) -> list[OrganizationTransfer]:
+    """Convenience wrapper used when a manager leaves the manager tier."""
+    return await transfer_owned_organizations(
+        session, from_user_id=manager.id, to_user=owner
+    )

apps/api/app/core/database.py

@@ -7,7 +7,13 @@ from __future__ import annotations
 
 from collections.abc import AsyncGenerator
 
-from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+from sqlalchemy import event
+from sqlalchemy.ext.asyncio import (
+    AsyncEngine,
+    AsyncSession,
+    async_sessionmaker,
+    create_async_engine,
+)
 from sqlalchemy.orm import DeclarativeBase
 
 from app.core.config import settings
@@ -17,6 +23,25 @@ class Base(DeclarativeBase):
     """Declarative base for every ORM table."""
 
 
+def enable_sqlite_foreign_keys(engine: AsyncEngine) -> None:
+    """Turn on ``PRAGMA foreign_keys`` for every connection of a SQLite engine.
+
+    SQLite defaults to ``foreign_keys=OFF``, which silently turns every
+    ``ondelete="CASCADE"`` in the schema into a no-op — a dev database then
+    keeps orphaned children (memberships of a deleted user, documents of a
+    deleted source) that production Postgres would have removed. One pragma
+    per connection keeps the two backends behaving the same.
+    """
+
+    @event.listens_for(engine.sync_engine, "connect")
+    def _set_pragma(dbapi_connection, _connection_record) -> None:  # noqa: ANN001
+        cursor = dbapi_connection.cursor()
+        try:
+            cursor.execute("PRAGMA foreign_keys=ON")
+        finally:
+            cursor.close()
+
+
 def _engine_kwargs() -> dict:
     url = settings.database_url
     if url.startswith("sqlite"):
@@ -32,6 +57,9 @@ def _engine_kwargs() -> dict:
 
 engine = create_async_engine(settings.database_url, **_engine_kwargs())
 
+if settings.database_url.startswith("sqlite"):
+    enable_sqlite_foreign_keys(engine)
+
 SessionFactory = async_sessionmaker(
     bind=engine,
     class_=AsyncSession,

apps/api/app/domain/audit/models.py

@@ -15,13 +15,31 @@ class AuditAction:
     LOGIN = "auth.login"
     LOGOUT = "auth.logout"
     SIGNUP = "auth.signup"
+    #: A user changed their own password (or an owner-forced temp password was
+    #: replaced). Auditable because it is the one action that can lock the
+    #: legitimate owner out.
+    PASSWORD_CHANGE = "auth.password_change"
     ORG_CREATE = "organization.create"
     ORG_DELETE = "organization.delete"
+    #: An organization changed hands because its owning manager was demoted or
+    #: deleted — the platform owner takes over. Never automatic for any other
+    #: reason.
+    ORG_OWNER_TRANSFER = "organization.owner_transfer"
     MEMBER_INVITE = "member.invite"
     #: An invited user redeemed their token and joined the organization.
     MEMBER_JOIN = "member.join"
     MEMBER_ROLE_CHANGE = "member.role_change"
     MEMBER_REMOVE = "member.remove"
+    #: The platform owner created an account (manager or plain user).
+    USER_CREATE = "user.create"
+    #: A user's platform role changed (user <-> manager, or manager -> user).
+    USER_PLATFORM_ROLE_CHANGE = "user.platform_role_change"
+    #: An account was activated or deactivated.
+    USER_ACTIVE_CHANGE = "user.active_change"
+    #: An account was deleted by the platform owner.
+    USER_DELETE = "user.delete"
+    #: The single platform-owner seat moved to another account.
+    OWNERSHIP_TRANSFER = "platform.ownership_transfer"
     EMPLOYEE_CREATE = "employee.create"
     EMPLOYEE_UPDATE = "employee.update"
     REPO_CREATE = "repo.create"

apps/api/app/domain/identity/models.py

@@ -17,6 +17,31 @@ class Role(StrEnum):
     VIEWER = "viewer"
 
 
+class PlatformRole(StrEnum):
+    """Platform-wide role — a different axis from the in-organization ``Role``.
+
+    The platform has exactly three levels, and exactly one ``OWNER`` account
+    exists (enforced by a partial unique index on ``users.platform_role``):
+
+    - ``OWNER`` — the single owner of the whole system. The only account that
+      may enter the admin console, create or demote managers, and transfer
+      ownership.
+    - ``MANAGER`` — an account created by the owner. A manager may create
+      their own organizations (becoming their organization owner) and join
+      other managers' organizations by invitation.
+    - ``USER`` — a plain account. Has no platform privileges: cannot create
+      organizations, only works inside organizations it was invited to.
+    """
+
+    OWNER = "owner"
+    MANAGER = "manager"
+    USER = "user"
+
+
+#: Roles that may create a new organization. Everyone else must be invited.
+PLATFORM_ROLES_CAN_CREATE_ORG = frozenset({PlatformRole.OWNER, PlatformRole.MANAGER})
+
+
 #: Higher rank implies every permission of the lower ranks.
 ROLE_RANK: dict[Role, int] = {
     Role.VIEWER: 10,
@@ -88,11 +113,26 @@ class User:
     name: str = ""
     id: str = field(default_factory=new_id)
     avatar_url: str | None = None
-    is_platform_owner: bool = False
+    #: Platform-wide role. ``is_platform_owner`` / ``is_manager`` are derived
+    #: from it; only one ``OWNER`` may exist (see the partial unique index on
+    #: ``users.platform_role``).
+    platform_role: PlatformRole = PlatformRole.USER
     is_active: bool = True
     created_at: datetime = field(default_factory=utcnow)
     updated_at: datetime = field(default_factory=utcnow)
 
+    @property
+    def is_platform_owner(self) -> bool:
+        return self.platform_role == PlatformRole.OWNER
+
+    @property
+    def is_manager(self) -> bool:
+        return self.platform_role == PlatformRole.MANAGER
+
+    @property
+    def can_create_organization(self) -> bool:
+        return self.platform_role in PLATFORM_ROLES_CAN_CREATE_ORG
+
     @property
     def display_name(self) -> str:
         return self.name.strip() or self.email.split("@")[0]

apps/api/app/infrastructure/db/models.py

@@ -21,6 +21,7 @@ from sqlalchemy import (
     String,
     Text,
     UniqueConstraint,
+    text,
 )
 from sqlalchemy.orm import Mapped, mapped_column
 
@@ -43,13 +44,29 @@ def _created() -> Mapped[datetime]:
 
 class UserRow(Base):
     __tablename__ = "users"
+    __table_args__ = (
+        # Exactly one platform owner may exist — ever. A partial unique index
+        # makes that a *database* invariant, not just an application habit: a
+        # second INSERT with platform_role='owner' fails even if some future
+        # code path forgets to check. Both dialects support partial indexes.
+        Index(
+            "uq_single_platform_owner",
+            "platform_role",
+            unique=True,
+            sqlite_where=text("platform_role = 'owner'"),
+            postgresql_where=text("platform_role = 'owner'"),
+        ),
+        Index("ix_user_platform_role", "platform_role"),
+    )
 
     id: Mapped[str] = _pk()
     email: Mapped[str] = mapped_column(String(320), unique=True, index=True, nullable=False)
     password_hash: Mapped[str] = mapped_column(String(255), nullable=False)
     name: Mapped[str] = mapped_column(String(160), default="", nullable=False)
     avatar_url: Mapped[str | None] = mapped_column(String(512), nullable=True)
-    is_platform_owner: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
+    #: Platform-wide role: ``owner`` | ``manager`` | ``user`` (see
+    #: ``PlatformRole``). Exactly one row may hold ``owner``.
+    platform_role: Mapped[str] = mapped_column(String(16), default="user", nullable=False)
     is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
     created_at: Mapped[datetime] = _created()
     updated_at: Mapped[datetime] = mapped_column(

apps/api/app/infrastructure/repositories/identity.py

@@ -16,6 +16,7 @@ from app.domain.identity.models import (
     Membership,
     MembershipStatus,
     Organization,
+    PlatformRole,
     Role,
     User,
 )
@@ -48,7 +49,7 @@ def _user_to_domain(row: UserRow) -> User:
         password_hash=row.password_hash,
         name=row.name,
         avatar_url=row.avatar_url,
-        is_platform_owner=row.is_platform_owner,
+        platform_role=PlatformRole(row.platform_role),
         is_active=row.is_active,
         created_at=row.created_at,
         updated_at=row.updated_at,
@@ -107,7 +108,7 @@ class UserRepository:
             password_hash=user.password_hash,
             name=user.name,
             avatar_url=user.avatar_url,
-            is_platform_owner=user.is_platform_owner,
+            platform_role=user.platform_role.value,
             is_active=user.is_active,
             created_at=user.created_at,
             updated_at=user.updated_at,
@@ -122,6 +123,41 @@ class UserRepository:
             row.password_hash = password_hash
             await self.session.flush()
 
+    async def set_platform_role(self, user_id: str, role: PlatformRole) -> None:
+        row = await self.session.get(UserRow, user_id)
+        if row:
+            row.platform_role = role.value
+            await self.session.flush()
+
+    async def set_active(self, user_id: str, active: bool) -> None:
+        row = await self.session.get(UserRow, user_id)
+        if row:
+            row.is_active = active
+            await self.session.flush()
+
+    async def delete(self, user_id: str) -> None:
+        """Remove the account. Memberships cascade via the FK."""
+        row = await self.session.get(UserRow, user_id)
+        if row:
+            await self.session.delete(row)
+            await self.session.flush()
+
+    async def get_platform_owner(self) -> User | None:
+        """The single platform owner. ``None`` on a system that never had one."""
+        stmt = select(UserRow).where(
+            UserRow.platform_role == PlatformRole.OWNER.value
+        )
+        row = (await self.session.execute(stmt)).scalars().first()
+        return _user_to_domain(row) if row else None
+
+    async def list_all(self) -> list[User]:
+        """Every account. Platform-owner console only — never expose this
+        through a tenant-scoped endpoint."""
+        stmt = select(UserRow).order_by(UserRow.created_at)
+        return [
+            _user_to_domain(r) for r in (await self.session.execute(stmt)).scalars()
+        ]
+
     async def count(self) -> int:
         return int((await self.session.execute(select(func.count(UserRow.id)))).scalar_one())
 
@@ -168,6 +204,24 @@ class OrganizationRepository:
         stmt = select(OrganizationRow).order_by(OrganizationRow.created_at)
         return [_org_to_domain(r) for r in (await self.session.execute(stmt)).scalars()]
 
+    async def list_owned_by(self, user_id: str) -> list[Organization]:
+        """Organizations whose ``owner_user_id`` is this user — the set that
+        must move when a manager is demoted or deleted."""
+        stmt = (
+            select(OrganizationRow)
+            .where(OrganizationRow.owner_user_id == user_id)
+            .order_by(OrganizationRow.created_at)
+        )
+        return [
+            _org_to_domain(r) for r in (await self.session.execute(stmt)).scalars()
+        ]
+
+    async def reassign_owner(self, org_id: str, new_owner_user_id: str) -> None:
+        row = await self.session.get(OrganizationRow, org_id)
+        if row:
+            row.owner_user_id = new_owner_user_id
+            await self.session.flush()
+
     async def delete(self, org_id: str) -> None:
         row = await self.session.get(OrganizationRow, org_id)
         if row:

apps/api/app/interfaces/http/routers/admin_users.py

@@ -0,0 +1,404 @@
+"""Platform owner console: the account lifecycle (managers and users).
+
+Everything in this router is owner-only, guarded at the *router* level like the
+rest of the console — an endpoint added later is protected without its author
+having to remember. The rules encoded here:
+
+- The owner creates every manager account directly, with a temporary password
+  shown exactly once. There is no public signup.
+- Platform role changes are limited to ``user`` <-> ``manager``; the owner seat
+  moves only through ``POST /admin/transfer-ownership``.
+- The owner account itself cannot be demoted, deactivated or deleted here.
+- When a manager is demoted or deleted, the organizations they own move to the
+  platform owner (see ``application/services/platform_users.py``).
+"""
+
+from __future__ import annotations
+
+import secrets
+from datetime import datetime
+
+from fastapi import APIRouter, Depends, Request, status
+from pydantic import BaseModel, ConfigDict, EmailStr, Field
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.application.services.audit_service import record_audit
+from app.application.services.platform_users import (
+    transfer_owned_organizations,
+)
+from app.core.database import get_session
+from app.core.errors import ConflictError, NotFoundError, PermissionDeniedError, ValidationError
+from app.core.security import hash_password
+from app.domain.audit.models import AuditAction
+from app.domain.identity.models import PlatformRole, User
+from app.infrastructure.repositories.identity import (
+    OrganizationRepository,
+    UserRepository,
+)
+from app.interfaces.http.deps import client_meta, require_platform_owner
+
+router = APIRouter(
+    prefix="/admin",
+    tags=["admin"],
+    # Deny-by-default for the whole console — see ``routers/admin.py`` for why
+    # this is a router-level dependency and not per-endpoint checks.
+    dependencies=[Depends(require_platform_owner)],
+)
+
+#: Length of the one-time password the owner hands to a new account. Twelve
+#: URL-safe characters is ~71 bits — brute-force proof at any login attempt
+#: rate this API permits, and short enough to read over a chat message.
+TEMP_PASSWORD_BYTES = 9
+
+
+def _temp_password() -> str:
+    return secrets.token_urlsafe(TEMP_PASSWORD_BYTES)
+
+
+# ---------------------------------------------------------------------------
+# Schemas
+# ---------------------------------------------------------------------------
+
+
+class AdminUserOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: str
+    email: str
+    name: str
+    platform_role: str
+    is_manager: bool
+    is_platform_owner: bool
+    is_active: bool
+    created_at: datetime
+    #: How many organizations this account owns — the number that decides what
+    #: happens to them if the account is demoted or deleted.
+    owned_organizations: int
+
+
+class AdminUserCreatedOut(BaseModel):
+    user: AdminUserOut
+    #: Shown exactly once, at creation. Never stored in plaintext and never
+    #: retrievable afterwards — a reset issues a new one.
+    temp_password: str
+
+
+class CreateUserRequest(BaseModel):
+    email: EmailStr
+    name: str = Field(default="", max_length=160)
+    #: ``owner`` is refused: the seat moves only via transfer-ownership.
+    platform_role: PlatformRole = PlatformRole.USER
+
+
+class UpdateUserRequest(BaseModel):
+    #: ``owner`` is refused here for the same reason.
+    platform_role: PlatformRole | None = None
+    is_active: bool | None = None
+
+
+class TransferOwnershipRequest(BaseModel):
+    #: Must be an existing, active, non-owner account.
+    user_id: str = Field(min_length=1, max_length=64)
+
+
+class OrganizationTransferOut(BaseModel):
+    organization_id: str
+    organization_name: str
+
+
+class DeleteUserResult(BaseModel):
+    deleted_user_id: str
+    transferred_organizations: list[OrganizationTransferOut]
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+async def _get_owner(session: AsyncSession) -> User:
+    owner = await UserRepository(session).get_platform_owner()
+    if owner is None:  # pragma: no cover - seed guarantees one exists
+        raise NotFoundError("مالک سامانه یافت نشد.")
+    return owner
+
+
+async def _load_target(session: AsyncSession, user_id: str) -> User:
+    target = await UserRepository(session).get(user_id)
+    if target is None:
+        raise NotFoundError("کاربر یافت نشد.")
+    return target
+
+
+def _assert_mutable_target(target: User) -> None:
+    """The single owner seat is not mutable through this router."""
+    if target.is_platform_owner:
+        raise PermissionDeniedError(
+            "حساب مالک سامانه از این مسیر قابل تغییر نیست؛ "
+            "برای جابه‌جایی مالکیت از «انتقال مالکیت سامانه» استفاده کنید."
+        )
+
+
+async def _owned_org_count(session: AsyncSession, user_id: str) -> int:
+    return len(await OrganizationRepository(session).list_owned_by(user_id))
+
+
+async def _to_out(session: AsyncSession, user: User) -> AdminUserOut:
+    return AdminUserOut(
+        id=user.id,
+        email=user.email,
+        name=user.display_name,
+        platform_role=user.platform_role.value,
+        is_manager=user.is_manager,
+        is_platform_owner=user.is_platform_owner,
+        is_active=user.is_active,
+        created_at=user.created_at,
+        owned_organizations=await _owned_org_count(session, user.id),
+    )
+
+
+# ---------------------------------------------------------------------------
+# Endpoints
+# ---------------------------------------------------------------------------
+
+
+@router.get("/users", response_model=list[AdminUserOut])
+async def list_users(
+    session: AsyncSession = Depends(get_session),
+) -> list[AdminUserOut]:
+    users = await UserRepository(session).list_all()
+    return [await _to_out(session, user) for user in users]
+
+
+@router.post("/users", response_model=AdminUserCreatedOut, status_code=status.HTTP_201_CREATED)
+async def create_user(
+    payload: CreateUserRequest,
+    request: Request,
+    owner: User = Depends(require_platform_owner),
+    session: AsyncSession = Depends(get_session),
+) -> AdminUserCreatedOut:
+    """Create a manager or plain account. The temp password is returned once.
+
+    Every account in the system is created here or through an invite link; the
+    owner is the only one who can mint a ``manager`` (the tier that may create
+    organizations). Creating a second ``owner`` is refused by the schema — the
+    seat moves through the transfer-ownership endpoint only.
+    """
+    if payload.platform_role == PlatformRole.OWNER:
+        raise ValidationError(
+            "مالک سامانه از این مسیر ساخته نمی‌شود؛ برای جابه‌جایی مالکیت "
+            "از «انتقال مالکیت سامانه» استفاده کنید."
+        )
+    users = UserRepository(session)
+    if await users.get_by_email(payload.email) is not None:
+        raise ConflictError("این ایمیل قبلاً ثبت شده است.")
+
+    temp_password = _temp_password()
+    user = await users.create(
+        User(
+            email=payload.email,
+            password_hash=hash_password(temp_password),
+            name=payload.name.strip(),
+            platform_role=payload.platform_role,
+        )
+    )
+    ip, ua = client_meta(request)
+    await record_audit(
+        session,
+        action=AuditAction.USER_CREATE,
+        actor_user_id=owner.id,
+        target_type="user",
+        target_id=user.id,
+        metadata={"email": user.email, "platform_role": user.platform_role.value},
+        ip=ip,
+        user_agent=ua,
+    )
+    return AdminUserCreatedOut(user=await _to_out(session, user), temp_password=temp_password)
+
+
+@router.patch("/users/{user_id}", response_model=AdminUserOut)
+async def update_user(
+    user_id: str,
+    payload: UpdateUserRequest,
+    request: Request,
+    owner: User = Depends(require_platform_owner),
+    session: AsyncSession = Depends(get_session),
+) -> AdminUserOut:
+    """Change a platform role (user <-> manager) or activate/deactivate.
+
+    Demoting a manager to a plain user hands every organization they own to the
+    platform owner first — a demoted manager with a tenant still under their
+    name would quietly keep the capacity to create tenants, which is what the
+    demotion was meant to revoke.
+    """
+    target = await _load_target(session, user_id)
+    _assert_mutable_target(target)
+    users = UserRepository(session)
+
+    transferred: list = []
+    if payload.platform_role is not None and payload.platform_role != target.platform_role:
+        if payload.platform_role == PlatformRole.OWNER:
+            raise ValidationError(
+                "ارتقا به مالک سامانه فقط از مسیر «انتقال مالکیت سامانه» ممکن است."
+            )
+        if target.is_manager and payload.platform_role == PlatformRole.USER:
+            transferred = await transfer_owned_organizations(
+                session, from_user_id=target.id, to_user=owner
+            )
+        await users.set_platform_role(target.id, payload.platform_role)
+        target.platform_role = payload.platform_role
+
+    if payload.is_active is not None and payload.is_active != target.is_active:
+        await users.set_active(target.id, payload.is_active)
+        target.is_active = payload.is_active
+
+    ip, ua = client_meta(request)
+    if payload.platform_role is not None:
+        await record_audit(
+            session,
+            action=AuditAction.USER_PLATFORM_ROLE_CHANGE,
+            actor_user_id=owner.id,
+            target_type="user",
+            target_id=target.id,
+            metadata={
+                "platform_role": payload.platform_role.value,
+                "transferred_organizations": [t.organization_id for t in transferred],
+            },
+            ip=ip,
+            user_agent=ua,
+        )
+    if payload.is_active is not None:
+        await record_audit(
+            session,
+            action=AuditAction.USER_ACTIVE_CHANGE,
+            actor_user_id=owner.id,
+            target_type="user",
+            target_id=target.id,
+            metadata={"is_active": payload.is_active},
+            ip=ip,
+            user_agent=ua,
+        )
+    return await _to_out(session, target)
+
+
+@router.delete("/users/{user_id}", response_model=DeleteUserResult)
+async def delete_user(
+    user_id: str,
+    request: Request,
+    owner: User = Depends(require_platform_owner),
+    session: AsyncSession = Depends(get_session),
+) -> DeleteUserResult:
+    """Delete an account, moving its owned organizations to the platform owner.
+
+    Memberships cascade with the user row, so the deleted account disappears
+    from every organization it was a member of — the organizations it *owned*
+    survive under the platform owner instead of being orphaned or deleted with
+    their data.
+    """
+    target = await _load_target(session, user_id)
+    _assert_mutable_target(target)
+
+    transferred = await transfer_owned_organizations(
+        session, from_user_id=target.id, to_user=owner
+    )
+    await UserRepository(session).delete(target.id)
+
+    ip, ua = client_meta(request)
+    await record_audit(
+        session,
+        action=AuditAction.USER_DELETE,
+        actor_user_id=owner.id,
+        target_type="user",
+        target_id=target.id,
+        metadata={
+            "email": target.email,
+            "transferred_organizations": [t.organization_id for t in transferred],
+        },
+        ip=ip,
+        user_agent=ua,
+    )
+    return DeleteUserResult(
+        deleted_user_id=target.id,
+        transferred_organizations=[
+            OrganizationTransferOut(
+                organization_id=t.organization_id, organization_name=t.organization_name
+            )
+            for t in transferred
+        ],
+    )
+
+
+@router.post("/users/{user_id}/reset-password", response_model=AdminUserCreatedOut)
+async def reset_user_password(
+    user_id: str,
+    request: Request,
+    owner: User = Depends(require_platform_owner),
+    session: AsyncSession = Depends(get_session),
+) -> AdminUserCreatedOut:
+    """Issue a new temp password for an account. Shown once, never stored raw."""
+    target = await _load_target(session, user_id)
+
+    temp_password = _temp_password()
+    await UserRepository(session).update_password(
+        target.id, hash_password(temp_password)
+    )
+    ip, ua = client_meta(request)
+    await record_audit(
+        session,
+        action=AuditAction.PASSWORD_CHANGE,
+        actor_user_id=owner.id,
+        target_type="user",
+        target_id=target.id,
+        metadata={"via": "owner_reset"},
+        ip=ip,
+        user_agent=ua,
+    )
+    return AdminUserCreatedOut(user=await _to_out(session, target), temp_password=temp_password)
+
+
+@router.post("/transfer-ownership", response_model=AdminUserOut)
+async def transfer_ownership(
+    payload: TransferOwnershipRequest,
+    request: Request,
+    owner: User = Depends(require_platform_owner),
+    session: AsyncSession = Depends(get_session),
+) -> AdminUserOut:
+    """Move the single owner seat to another active account.
+
+    The requester is demoted to ``manager`` in the same step, so the invariant
+    "exactly one owner" holds throughout — there is no window in which two
+    accounts own the platform, and no window in which none does. This is the
+    safety valve for a lost owner account; everything else about the owner
+    seat is immutable.
+    """
+    successor = await _load_target(session, payload.user_id)
+    if successor.is_platform_owner:
+        raise ConflictError("این کاربر همین حالا مالک سامانه است.")
+    if not successor.is_active:
+        raise ValidationError("حساب غیرفعال را نمی‌توان مالک سامانه کرد.")
+
+    users = UserRepository(session)
+    # The requester keeps every organization they own; only the platform seat
+    # moves. The successor is usually a manager, and their organizations stay
+    # with them.
+    #
+    # Order matters: demote the current owner *before* promoting the successor,
+    # so the partial unique index on platform_role='owner' never sees two rows
+    # at once. Both writes land in the same transaction.
+    await users.set_platform_role(owner.id, PlatformRole.MANAGER)
+    await users.set_platform_role(successor.id, PlatformRole.OWNER)
+
+    ip, ua = client_meta(request)
+    await record_audit(
+        session,
+        action=AuditAction.OWNERSHIP_TRANSFER,
+        actor_user_id=owner.id,
+        target_type="user",
+        target_id=successor.id,
+        metadata={"from_user_id": owner.id, "to_user_id": successor.id},
+        ip=ip,
+        user_agent=ua,
+    )
+    updated = await users.get(successor.id)
+    assert updated is not None
+    return await _to_out(session, updated)

apps/api/app/interfaces/http/routers/auth.py

@@ -1,4 +1,10 @@
-"""Authentication endpoints."""
+"""Authentication endpoints.
+
+There is deliberately **no public signup**: accounts are created either by the
+platform owner (``POST /admin/users`` — managers and plain users) or by
+redeeming an organization invite (``POST /invites/accept`` with a password).
+Login, the profile view and self-service password change live here.
+"""
 
 from __future__ import annotations
 
@@ -8,8 +14,12 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.application.services.audit_service import record_audit
 from app.core.database import get_session
-from app.core.errors import AuthenticationError, ConflictError
-from app.core.security import create_access_token, hash_password, verify_password
+from app.core.errors import AuthenticationError, ValidationError
+from app.core.security import (
+    create_access_token,
+    hash_password,
+    verify_password,
+)
 from app.domain.audit.models import AuditAction
 from app.domain.identity.models import User
 from app.infrastructure.repositories.identity import (
@@ -22,12 +32,6 @@ from app.interfaces.http.deps import client_meta, get_current_user
 router = APIRouter(prefix="/auth", tags=["auth"])
 
 
-class SignupRequest(BaseModel):
-    email: EmailStr
-    password: str = Field(min_length=8, max_length=128)
-    name: str = Field(default="", max_length=160)
-
-
 class LoginRequest(BaseModel):
     email: EmailStr
     password: str
@@ -40,9 +44,19 @@ class UserOut(BaseModel):
     email: str
     name: str
     avatar_url: str | None = None
+    #: Platform-wide role — ``owner`` | ``manager`` | ``user``. Exactly one
+    #: account is ``owner``; only ``owner`` and ``manager`` may create
+    #: organizations.
+    platform_role: str = "user"
+    is_manager: bool = False
     is_platform_owner: bool = False
 
 
+class ChangePasswordRequest(BaseModel):
+    current_password: str = Field(min_length=1, max_length=128)
+    new_password: str = Field(min_length=8, max_length=128)
+
+
 class OrganizationSummary(BaseModel):
     id: str
     name: str
@@ -67,40 +81,12 @@ def _to_user_out(user: User) -> UserOut:
         email=user.email,
         name=user.display_name,
         avatar_url=user.avatar_url,
+        platform_role=user.platform_role.value,
+        is_manager=user.is_manager,
         is_platform_owner=user.is_platform_owner,
     )
 
 
-@router.post("/signup", response_model=TokenResponse, status_code=status.HTTP_201_CREATED)
-async def signup(
-    payload: SignupRequest,
-    request: Request,
-    session: AsyncSession = Depends(get_session),
-) -> TokenResponse:
-    users = UserRepository(session)
-    if await users.get_by_email(payload.email) is not None:
-        raise ConflictError("این ایمیل قبلاً ثبت شده است.")
-
-    user = await users.create(
-        User(
-            email=payload.email,
-            password_hash=hash_password(payload.password),
-            name=payload.name.strip(),
-        )
-    )
-    ip, ua = client_meta(request)
-    await record_audit(
-        session,
-        action=AuditAction.SIGNUP,
-        actor_user_id=user.id,
-        target_type="user",
-        target_id=user.id,
-        ip=ip,
-        user_agent=ua,
-    )
-    return TokenResponse(access_token=create_access_token(user.id), user=_to_user_out(user))
-
-
 @router.post("/login", response_model=TokenResponse)
 async def login(
     payload: LoginRequest,
@@ -146,6 +132,38 @@ async def logout(
     )
 
 
+@router.post("/change-password", status_code=status.HTTP_204_NO_CONTENT)
+async def change_password(
+    payload: ChangePasswordRequest,
+    request: Request,
+    user: User = Depends(get_current_user),
+    session: AsyncSession = Depends(get_session),
+) -> None:
+    """Replace the caller's own password.
+
+    This is how a temp password handed out by the platform owner (or by an
+    invite) becomes a private one — without it, every account created by
+    someone else would live on a shared secret forever.
+    """
+    users = UserRepository(session)
+    if not verify_password(payload.current_password, user.password_hash):
+        raise AuthenticationError("رمز عبور فعلی نادرست است.")
+    if payload.new_password == payload.current_password:
+        raise ValidationError("رمز عبور جدید باید با رمز فعلی متفاوت باشد.")
+    await users.update_password(user.id, hash_password(payload.new_password))
+
+    ip, ua = client_meta(request)
+    await record_audit(
+        session,
+        action=AuditAction.PASSWORD_CHANGE,
+        actor_user_id=user.id,
+        target_type="user",
+        target_id=user.id,
+        ip=ip,
+        user_agent=ua,
+    )
+
+
 @router.get("/me", response_model=MeResponse)
 async def me(
     user: User = Depends(get_current_user),

apps/api/app/interfaces/http/routers/invites.py

@@ -3,8 +3,14 @@
 Deliberately *not* nested under ``/organizations/{org_id}``: the person
 accepting an invite is by definition not yet a member, so ``get_org_context``
 would (correctly) refuse them. Here the invite token itself is the
-authorization. It is stored only as a hash, matched to the signed-in user's
-email, and single-use — see ``_load_pending_invite``.
+authorization. It is stored only as a hash and is single-use.
+
+Because signup is closed (accounts come from the owner or from an invite), the
+token doubles as an account-creation capability: a brand-new invitee redeems
+it **with a password**, which creates their account bound to the invited email
+and joins the organization in one step. The token can never reset the password
+of an *existing* account — those must authenticate first, which keeps a leaked
+link from taking over an account that already exists.
 """
 
 from __future__ import annotations
@@ -12,7 +18,7 @@ from __future__ import annotations
 from datetime import UTC, datetime
 
 from fastapi import APIRouter, Depends, Request, status
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.application.services.audit_service import record_audit
@@ -23,21 +29,23 @@ from app.core.errors import (
     PermissionDeniedError,
     ValidationError,
 )
-from app.core.security import hash_token
+from app.core.security import hash_password, hash_token
 from app.domain.audit.models import AuditAction
 from app.domain.identity.models import (
     Invite,
     Membership,
     MembershipStatus,
     Organization,
+    PlatformRole,
     User,
 )
 from app.infrastructure.repositories.identity import (
     InviteRepository,
     MembershipRepository,
     OrganizationRepository,
+    UserRepository,
 )
-from app.interfaces.http.deps import client_meta, get_current_user
+from app.interfaces.http.deps import client_meta, get_optional_user
 
 router = APIRouter(prefix="/invites", tags=["invites"])
 
@@ -51,10 +59,18 @@ class InvitePreview(BaseModel):
     #: True when the caller is already a member, so the UI can say "open it"
     #: instead of "join".
     already_member: bool
+    #: True when an account exists for the invited email. The invitee then logs
+    #: in first; anonymous redemption with a password is only for brand-new
+    #: accounts (a token must never be able to reset an existing password).
+    has_account: bool
 
 
 class AcceptInviteRequest(BaseModel):
     token: str
+    #: Required only when redeeming anonymously — it becomes the password of
+    #: the account the invite creates. Ignored for a signed-in user, who has
+    #: already proven ownership of the email.
+    password: str | None = Field(default=None, min_length=8, max_length=128)
 
 
 class AcceptInviteResult(BaseModel):
@@ -64,22 +80,26 @@ class AcceptInviteResult(BaseModel):
 
 
 async def _load_pending_invite(
-    token: str, user: User, session: AsyncSession
+    token: str, user: User | None, session: AsyncSession
 ) -> tuple[Invite, Organization]:
     """Resolve a raw token into a redeemable invite, or raise.
 
     Every rejection is a distinct, user-actionable error rather than a generic
-    "invalid link": the three real failure modes (already used, expired, wrong
+    "invalid link": the real failure modes (already used, expired, wrong
     account) each need a different response from the person holding the link.
+
+    The email binding is only enforced when a user is signed in: an anonymous
+    holder of the token sees the preview but must create an account for exactly
+    the invited email, which the accept path checks.
     """
     invite = await InviteRepository(session).get_by_token_hash(hash_token(token))
     if invite is None:
         raise NotFoundError("این لینک دعوت معتبر نیست.")
     if invite.accepted_at is not None:
-        raise ConflictError("این دعوت‌نامه قبلاً پذیرفته شده است.")
+        raise ConflictError("این دعوت‌نامه قبلاً پذیرافته شده است.")
     if invite.is_expired():
         raise ValidationError("این دعوت‌نامه منقضی شده است؛ از مدیر بخواهید دوباره دعوت کند.")
-    if invite.email.strip().lower() != user.email.strip().lower():
+    if user is not None and invite.email.strip().lower() != user.email.strip().lower():
         raise PermissionDeniedError(
             "این دعوت‌نامه برای ایمیل دیگری صادر شده است؛ با همان ایمیل وارد شوید.",
             details={"invite_email": invite.email},
@@ -94,19 +114,30 @@ async def _load_pending_invite(
 @router.get("/{token}", response_model=InvitePreview)
 async def preview_invite(
     token: str,
-    user: User = Depends(get_current_user),
+    user: User | None = Depends(get_optional_user),
     session: AsyncSession = Depends(get_session),
 ) -> InvitePreview:
-    """Show the invitee what they are about to join, without joining yet."""
+    """Show the invitee what they are about to join, without joining yet.
+
+    Works without a session on purpose: a brand-new invitee must be able to
+    see which organization invited them (and whether they already have an
+    account) *before* deciding to sign in or create one.
+    """
     invite, organization = await _load_pending_invite(token, user, session)
-    existing = await MembershipRepository(session).get(organization.id, user.id)
+    existing_user = await UserRepository(session).get_by_email(invite.email)
+    membership = (
+        await MembershipRepository(session).get(organization.id, user.id)
+        if user is not None
+        else None
+    )
     return InvitePreview(
         organization_id=organization.id,
         organization_name=organization.name,
         email=invite.email,
         role=invite.role.value,
         expires_at=invite.expires_at,
-        already_member=existing is not None,
+        already_member=membership is not None,
+        has_account=existing_user is not None,
     )
 
 
@@ -114,17 +145,46 @@ async def preview_invite(
 async def accept_invite(
     payload: AcceptInviteRequest,
     request: Request,
-    user: User = Depends(get_current_user),
+    user: User | None = Depends(get_optional_user),
     session: AsyncSession = Depends(get_session),
 ) -> AcceptInviteResult:
-    """Redeem an invite: create the membership and burn the token.
+    """Redeem an invite: create the account if needed, join, and burn the token.
 
-    Idempotent by construction — accepting twice is a no-op the second time, so
-    a double-click or a retried request cannot create two memberships.
+    Two redemption paths, one outcome:
+
+    - **Signed in** — the account already exists and has proven ownership of
+      the invited email; no password is needed.
+    - **Anonymous** — the invite itself is the capability: a *new* account is
+      created for the invited email with the supplied password and joins the
+      organization. If an account for that email already exists, the caller
+      must authenticate first — a link can never become a password reset.
+
+    Idempotent by construction — accepting twice is a no-op the second time,
+    so a double-click or a retried request cannot create two memberships.
     """
     invite, organization = await _load_pending_invite(payload.token, user, session)
-
+    users = UserRepository(session)
     memberships = MembershipRepository(session)
+
+    created_account = False
+    if user is None:
+        existing = await users.get_by_email(invite.email)
+        if existing is not None:
+            raise PermissionDeniedError(
+                "برای این ایمیل قبلاً حساب ساخته شده است؛ وارد شوید و سپس دعوت را بپذیرید."
+            )
+        if not payload.password:
+            raise ValidationError("برای ساخت حساب جدید، تعیین رمز عبور الزامی است.")
+        user = await users.create(
+            User(
+                email=invite.email,
+                password_hash=hash_password(payload.password),
+                name="",
+                platform_role=PlatformRole.USER,
+            )
+        )
+        created_account = True
+
     if await memberships.get(organization.id, user.id) is None:
         await memberships.add(
             Membership(
@@ -146,6 +206,20 @@ async def accept_invite(
             ip=ip,
             user_agent=ua,
         )
+        if created_account:
+            # Account creation is audited separately from the join: one is a
+            # platform identity event, the other a tenant event.
+            ip, ua = client_meta(request)
+            await record_audit(
+                session,
+                action=AuditAction.SIGNUP,
+                actor_user_id=user.id,
+                target_type="user",
+                target_id=user.id,
+                metadata={"via": "invite", "organization_id": organization.id},
+                ip=ip,
+                user_agent=ua,
+            )
 
     # Burn the token regardless: whether the membership was just created or
     # already existed, this invite must not be redeemable a second time.

apps/api/app/interfaces/http/routers/organizations.py

@@ -114,6 +114,15 @@ async def create_organization(
     user: User = Depends(get_current_user),
     session: AsyncSession = Depends(get_session),
 ) -> OrganizationWithRole:
+    # The platform has exactly one owner and the managers the owner creates.
+    # Everyone else works *inside* organizations they were invited to — if
+    # plain users could create organizations, the owner's control over the
+    # tenant map would mean nothing.
+    if not user.can_create_organization:
+        raise PermissionDeniedError(
+            "ساخت سازمان فقط برای مالک سامانه و مدیران امکان‌پذیر است. "
+            "برای عضویت در یک سازمان از لینک دعوت استفاده کنید."
+        )
     orgs = OrganizationRepository(session)
     base = slugify(payload.name)
     slug = ensure_unique_slug(base, await orgs.list_all_slugs())

apps/api/app/interfaces/realtime/manager.py

@@ -49,8 +49,8 @@ ChannelAuthorizer = Callable[["Connection", str], Awaitable[bool]]
 @dataclass(slots=True, eq=False)
 class Connection:
     """One browser socket. ``user_id`` is ``None`` for an anonymous (pre-login)
-    connection: it may only call the bootstrap RPCs (login/signup) and may not
-    subscribe to live channels."""
+    connection: it may only call the bootstrap RPCs (login and invite
+    redemption) and may not subscribe to live channels."""
 
     user_id: str | None
     is_platform_owner: bool

apps/api/app/interfaces/realtime/router.py

@@ -25,7 +25,7 @@ share the ``type`` discriminator; client->server frames use ``action``::
     server -> {"type": "error",       "message": "…"}
 
 A connection may be **anonymous** (no token): that is the bootstrap state that
-lets a brand-new visitor call ``/api/auth/login`` and ``/api/auth/signup`` over
+lets a brand-new visitor call ``/api/auth/login`` and redeem an invite over
 RPC. Every other RPC and every ``subscribe`` requires an authenticated
 connection; the token presented at connect time is re-injected as a bearer
 header when the RPC is dispatched into the internal app, so the handlers' own
@@ -67,9 +67,17 @@ def realtime_manager() -> ConnectionManager:
     return _manager
 
 
-#: Paths an anonymous (not-yet-logged-in) connection is allowed to call. These are
-#: the only two calls a visitor can make; everything else needs a session.
-_ANONYMOUS_RPC_PATHS = frozenset({"/api/auth/login", "/api/auth/signup"})
+#: What an anonymous (not-yet-logged-in) connection may call: login — the only
+#: way in now that signup is closed — plus the invite redemption endpoints,
+#: which authorize themselves with the invite token. Previewing an invite and
+#: creating the account it names must both be possible before the visitor has
+#: a session, so a fresh invitee is never stuck at the login screen.
+_ANONYMOUS_RPC_PATHS = frozenset({"/api/auth/login"})
+_ANONYMOUS_RPC_PREFIXES = ("/api/invites/",)
+
+
+def _is_anonymous_rpc_allowed(path: str) -> bool:
+    return path in _ANONYMOUS_RPC_PATHS or path.startswith(_ANONYMOUS_RPC_PREFIXES)
 
 #: One in-process HTTP client that dispatches RPCs into the internal app. Built
 #: lazily so importing this module never pulls the app into existence.
@@ -216,8 +224,8 @@ async def _handle_rpc(connection: Connection, message: dict) -> None:
         )
         return
 
-    # Gate unauthenticated callers to login/signup only.
-    if connection.user_id is None and path not in _ANONYMOUS_RPC_PATHS:
+    # Gate unauthenticated callers to the bootstrap RPCs only.
+    if connection.user_id is None and not _is_anonymous_rpc_allowed(path):
         _send_rpc_result(
             connection,
             req_id,

apps/api/app/interfaces/realtime/rpc_app.py

@@ -23,6 +23,7 @@ from app.interfaces.http.errors import register_exception_handlers
 from app.interfaces.http.request_context import RequestContextMiddleware
 from app.interfaces.http.routers import (
     admin,
+    admin_users,
     agy,
     auth,
     billing,
@@ -68,6 +69,7 @@ def build_rpc_app() -> FastAPI:
     application.include_router(knowledge.router, prefix="/api")
     application.include_router(sandbox.router, prefix="/api")
     application.include_router(admin.router, prefix="/api")
+    application.include_router(admin_users.router, prefix="/api")
     application.include_router(agy.router, prefix="/api")
     application.include_router(realtime_router, prefix="/api")
     return application

apps/api/app/seed.py

@@ -1,7 +1,7 @@
 """Idempotent development seed.
 
-Run with ``pnpm db:seed``. Creates a platform owner, a demo user, a sample
-organization that both of them own, the system agent templates, routing
+Run with ``pnpm db:seed``. Creates the platform owner, a demo *manager* with a
+sample organization that manager owns, the system agent templates, routing
 policies, rate cards and the agy (Google Antigravity) provider with its model
 catalog. agy is the only model provider the platform talks to; accounts are
 added from the admin console.
@@ -11,6 +11,16 @@ Safe to run repeatedly: every step checks for existing rows first.
 The two accounts it prints at the end are meant to be usable immediately —
 ``tests/test_seed.py`` asserts exactly that, because a seed whose credentials the
 login endpoint rejects is worse than no seed at all.
+
+Platform hierarchy this seed models (there is deliberately no public signup):
+
+- exactly one ``owner`` — the account that owns the whole system and is the
+  only one allowed into the admin console;
+- the demo account is a ``manager`` — the tier that may create organizations
+  and join other managers' organizations by invitation;
+- the platform owner is *not* auto-joined to any organization: the product
+  rule is that the owner observes tenants from the console, rather than
+  silently sitting inside their data.
 """
 
 from __future__ import annotations
@@ -18,7 +28,7 @@ from __future__ import annotations
 import asyncio
 import logging
 
-from sqlalchemy import select
+from sqlalchemy import select, update
 
 from app.core.database import Base, SessionFactory, engine
 from app.core.security import hash_password
@@ -32,7 +42,14 @@ from app.domain.ai_control.models import (
     RoutingMode,
     RoutingPolicy,
 )
-from app.domain.identity.models import Membership, MembershipStatus, Organization, Role, User
+from app.domain.identity.models import (
+    Membership,
+    MembershipStatus,
+    Organization,
+    PlatformRole,
+    Role,
+    User,
+)
 from app.domain.sandbox.models import SandboxProviderKind, SandboxTemplate
 from app.domain.workforce.models import AgentTemplate, RoleKey
 from app.infrastructure.db.models import (
@@ -45,6 +62,7 @@ from app.infrastructure.db.models import (
     SandboxTemplateRow,
     UserRow,
 )
+from app.infrastructure.repositories.identity import UserRepository
 
 logging.basicConfig(level=logging.INFO, format="%(levelname)-7s %(message)s")
 logger = logging.getLogger("agy.seed")
@@ -61,7 +79,6 @@ DEMO_PASSWORD = "demo12345"
 #: the seed to be idempotent — see ``_ensure_org``.
 DEMO_ORG_NAME = "سازمان نمونه"
 DEMO_ORG_SLUG = "sample-org"
-
 #: The agy (Google Antigravity) model catalog. ``internal_name`` is the model id
 #: the Antigravity backend expects; the display name is admin-only. The 4th
 #: element is the reasoning effort (empty = provider default) — the console can
@@ -185,36 +202,66 @@ SANDBOX_TEMPLATES: list[tuple[str, str, str, float, int, int]] = [
 
 
 async def _ensure_user(
-    session, *, email: str, password: str, name: str, platform_owner: bool
+    session, *, email: str, password: str, name: str, platform_role: PlatformRole
 ) -> User:
+    """Get or create one seeded account, converging its platform role.
+
+    The reconciliation matters for installs seeded *before* the single-owner
+    model: the migration already mapped the old boolean onto
+    ``platform_role``, and this pass fixes everything the migration could not
+    know (for example which of several legacy owners the seed intended).
+    Exactly one row may hold ``owner`` — the partial unique index enforces it —
+    so promoting this account first demotes any other owner to ``manager``.
+    """
     existing = (
         await session.execute(select(UserRow).where(UserRow.email == email))
     ).scalar_one_or_none()
-    if existing:
+    if existing is not None:
+        if existing.platform_role != platform_role.value:
+            if platform_role == PlatformRole.OWNER:
+                # Demote the current seat holder before taking it, so the
+                # unique index never sees two owners.
+                await session.execute(
+                    update(UserRow)
+                    .where(
+                        UserRow.platform_role == PlatformRole.OWNER.value,
+                        UserRow.id != existing.id,
+                    )
+                    .values(platform_role=PlatformRole.MANAGER.value)
+                )
+            existing.platform_role = platform_role.value
+            await session.flush()
         return User(
-            id=existing.id, email=existing.email, password_hash=existing.password_hash,
-            name=existing.name, is_platform_owner=existing.is_platform_owner,
+            id=existing.id,
+            email=existing.email,
+            password_hash=existing.password_hash,
+            name=existing.name,
+            platform_role=PlatformRole(existing.platform_role),
         )
-    from app.infrastructure.repositories.identity import UserRepository
 
     user = await UserRepository(session).create(
         User(
             email=email,
             password_hash=hash_password(password),
             name=name,
-            is_platform_owner=platform_owner,
+            platform_role=platform_role,
         )
     )
-    logger.info("created user %s", email)
+    logger.info("created user %s (%s)", email, platform_role.value)
     return user
 
 
-async def _ensure_org(session, *, members: list[User]) -> Organization:
-    """Get or create the sample organization, with every given user in it.
+async def _ensure_org(session, *, owner: User) -> Organization:
+    """Get or create the sample organization, owned by ``owner``.
 
-    Idempotent in all three parts: the organization, its memberships and its
-    credit wallet. A developer who runs ``pnpm db:seed`` twice must end up with
-    exactly one organization and no duplicate rows.
+    Idempotent in all three parts: the organization, the owner's membership and
+    the credit wallet. A developer who runs ``pnpm db:seed`` twice must end up
+    with exactly one organization and no duplicate rows.
+
+    The platform owner is deliberately *not* a member — see the module
+    docstring. Any membership a platform owner picked up in an older database
+    (the seed used to join both accounts) is removed here so the model stays
+    honest after a re-seed.
     """
     from app.infrastructure.repositories.identity import (
         MembershipRepository,
@@ -232,22 +279,46 @@ async def _ensure_org(session, *, members: list[User]) -> Organization:
     org = await orgs.get_by_slug(DEMO_ORG_SLUG)
     if org is None:
         org = await orgs.create(
-            Organization(name=DEMO_ORG_NAME, slug=DEMO_ORG_SLUG, owner_user_id=members[0].id)
+            Organization(name=DEMO_ORG_NAME, slug=DEMO_ORG_SLUG, owner_user_id=owner.id)
         )
         logger.info("created organization %s", org.slug)
+    elif org.owner_user_id != owner.id:
+        await orgs.reassign_owner(org.id, owner.id)
+        org = await orgs.get(org.id)
+        assert org is not None
 
-    # Every listed user becomes an owner of the sample org. Without this the
-    # demo account can log in but belongs to no organization, so every screen
+    # The org owner is always an active OWNER member. Without this the demo
+    # account can log in but belongs to no organization, so every screen
     # renders empty and the account looks broken.
-    for user in members:
-        if await memberships.get(org.id, user.id) is None:
-            await memberships.add(
-                Membership(
-                    organization_id=org.id, user_id=user.id,
-                    role=Role.OWNER, status=MembershipStatus.ACTIVE,
-                )
+    membership = await memberships.get(org.id, owner.id)
+    if membership is None:
+        await memberships.add(
+            Membership(
+                organization_id=org.id, user_id=owner.id,
+                role=Role.OWNER, status=MembershipStatus.ACTIVE,
+            )
+        )
+        logger.info("added %s to %s as owner", owner.email, org.slug)
+    elif membership.role != Role.OWNER or not membership.is_active:
+        await memberships.set_role(membership.id, Role.OWNER)
+        await memberships.set_status(membership.id, MembershipStatus.ACTIVE)
+
+    # Platform owners observe tenants from the console; they do not sit inside
+    # them. Remove any such membership left by an older seed.
+    platform_owners = (
+        await session.execute(
+            select(UserRow).where(UserRow.platform_role == PlatformRole.OWNER.value)
+        )
+    ).scalars().all()
+    for platform_owner in platform_owners:
+        stale = await memberships.get(org.id, platform_owner.id)
+        if stale is not None:
+            await memberships.remove(stale.id)
+            logger.info(
+                "removed platform owner %s from %s (owner stays out of tenants)",
+                platform_owner.email,
+                org.slug,
             )
-            logger.info("added %s to %s as owner", user.email, org.slug)
 
     wallet = (
         await session.execute(
@@ -264,17 +335,19 @@ async def seed() -> None:
         await conn.run_sync(Base.metadata.create_all)
 
     async with SessionFactory() as session:
-        owner = await _ensure_user(
+        await _ensure_user(
             session, email=PLATFORM_OWNER_EMAIL, password=PLATFORM_OWNER_PASSWORD,
-            name="مالک سامانه", platform_owner=True,
+            name="مالک سامانه", platform_role=PlatformRole.OWNER,
         )
+        # The demo account is a *manager*: the tier the owner creates that can
+        # build its own organizations. It owns the sample organization, so
+        # logging in with it lands on a populated dashboard rather than an
+        # empty one.
         demo = await _ensure_user(
             session, email=DEMO_EMAIL, password=DEMO_PASSWORD,
-            name="کاربر نمونه", platform_owner=False,
+            name="کاربر نمونه", platform_role=PlatformRole.MANAGER,
         )
-        # Both accounts join the sample organization, so a developer who logs in
-        # as either one lands on a populated dashboard rather than an empty one.
-        await _ensure_org(session, members=[owner, demo])
+        await _ensure_org(session, owner=demo)
 
         # The agy catalog (Google Antigravity). agy is the only model provider,
         # so the provider row and its models are created on a first run and

apps/api/tests/conftest.py

@@ -12,7 +12,6 @@ from __future__ import annotations
 import pytest
 import pytest_asyncio
 from httpx import ASGITransport, AsyncClient
-from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
 from sqlalchemy.pool import StaticPool
 
@@ -21,9 +20,12 @@ from sqlalchemy.pool import StaticPool
 # and binding the package to the same name would shadow it.
 import app.infrastructure.db.models as _orm_models  # noqa: F401
 from app.core.config import settings
-from app.core.database import Base, get_session
+from app.core.database import Base, enable_sqlite_foreign_keys, get_session
+from app.core.security import create_access_token, hash_password
 from app.domain.base import new_id
-from app.infrastructure.db.models import UserRow
+from app.domain.identity.models import PlatformRole, User
+from app.infrastructure.repositories.identity import UserRepository
+
 # The internal "full" app holds every HTTP handler; the public app (app.main.app)
 # now serves only /health + /api/ws, so REST tests must target the full app.
 from app.interfaces.realtime.rpc_app import get_rpc_app
@@ -64,6 +66,9 @@ async def engine():
         connect_args={"check_same_thread": False},
         poolclass=StaticPool,
     )
+    # Same pragma the app engine gets, so ON DELETE CASCADE behaves here the
+    # way it does on Postgres.
+    enable_sqlite_foreign_keys(test_engine)
     async with test_engine.begin() as conn:
         await conn.run_sync(Base.metadata.create_all)
     yield test_engine
@@ -109,12 +114,20 @@ async def client(engine, session_factory):
                 await session.rollback()
                 raise
 
+    # Publish the factory for the module-level ``signup`` helper below. The
+    # in-memory engine each test builds is private to its fixtures; a helper
+    # that needs the same database has to reach it through this door.
+    _session_factory_holder["factory"] = session_factory
     app.dependency_overrides[get_session] = _override_session
     async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as test_client:
         yield test_client
     app.dependency_overrides.clear()
 
 
+#: Set by the ``client`` fixture; read by :func:`signup`.
+_session_factory_holder: dict[str, async_sessionmaker] = {}
+
+
 # ---------------------------------------------------------------------------
 # Fake model provider — the only sanctioned stand-in for agy in tests
 # ---------------------------------------------------------------------------
@@ -186,13 +199,45 @@ def _fake_model_provider(monkeypatch):
 
 
 async def signup(
-    client: AsyncClient, email: str, password: str = "password123", name: str = ""
+    client: AsyncClient,
+    email: str,
+    password: str = "password123",
+    name: str = "",
+    platform_role: PlatformRole = PlatformRole.MANAGER,
 ) -> dict:
-    response = await client.post(
-        "/api/auth/signup", json={"email": email, "password": password, "name": name}
-    )
-    assert response.status_code == 201, response.text
-    return response.json()
+    """Create an account directly in the database and mint a token for it.
+
+    There is no public signup endpoint anymore — accounts are created by the
+    platform owner or by redeeming an invite — so this helper writes the row
+    those flows would and returns the same shape ``POST /auth/signup`` used to.
+    The ``client`` argument is kept for the historical call signature.
+
+    The default platform role is ``manager`` because most tests exercise the
+    tenant surface, and creating an organization requires that tier. Tests
+    that model a plain invited user pass ``platform_role=PlatformRole.USER``.
+    """
+    factory = _session_factory_holder["factory"]
+    async with factory() as session:
+        user = await UserRepository(session).create(
+            User(
+                email=email,
+                password_hash=hash_password(password),
+                name=name,
+                platform_role=platform_role,
+            )
+        )
+        await session.commit()
+    return {
+        "access_token": create_access_token(user.id),
+        "user": {
+            "id": user.id,
+            "email": user.email,
+            "name": user.display_name,
+            "platform_role": user.platform_role.value,
+            "is_manager": user.is_manager,
+            "is_platform_owner": user.is_platform_owner,
+        },
+    }
 
 
 def auth_header(token: str) -> dict[str, str]:
@@ -201,22 +246,30 @@ def auth_header(token: str) -> dict[str, str]:
 
 @pytest_asyncio.fixture
 async def platform_owner_token(client: AsyncClient, session_factory) -> str:
-    """A signed-up user promoted to platform owner.
+    """A token for the one and only platform owner.
 
-    The promotion is done directly in the database because there is deliberately
-    no API that can grant platform-owner status.
+    Owner seats are not grantable through the API by design (a manager must
+    not be able to mint themselves an owner), so the fixture creates the
+    account with the owner role directly — the same seat the seed installs.
     """
-    # ``example.com`` is a documentation domain and passes email validation.
-    # Do NOT use ``.local``/``.test``: those are special-use TLDs and newer
-    # ``email-validator`` releases reject them, which fails the fixture.
     email = "platform-owner@example.com"
-    body = await signup(client, email, name="مالک سامانه")
-    async with session_factory() as session:
-        row = (
-            await session.execute(select(UserRow).where(UserRow.email == email))
-        ).scalar_one()
-        row.is_platform_owner = True
-        await session.commit()
+    body = await signup(client, email, name="مالک سامانه", platform_role=PlatformRole.OWNER)
+    return body["access_token"]
+
+
+@pytest_asyncio.fixture
+async def manager_token(client: AsyncClient) -> str:
+    """A token for a plain manager account (the org-creating tier)."""
+    body = await signup(client, "manager@example.com", name="مدیر")
+    return body["access_token"]
+
+
+@pytest_asyncio.fixture
+async def plain_user_token(client: AsyncClient) -> str:
+    """A token for a plain user — the tier that may not create organizations."""
+    body = await signup(
+        client, "plain-user@example.com", name="کاربر عادی", platform_role=PlatformRole.USER
+    )
     return body["access_token"]
 
 
@@ -328,6 +381,10 @@ async def seeded(session_factory):
                 id=provider_id, name="agy", type="agy", base_url="", is_active=True
             )
         )
+        # Flush the provider before its models: with foreign keys enforced the
+        # batched model INSERT must not run before the row it references
+        # exists.
+        await session.flush()
         for internal, display, capabilities, effort in SYSTEM_MODELS:
             session.add(
                 AiModelRow(

apps/api/tests/test_auth.py

@@ -13,37 +13,36 @@ async def test_health_is_public(client: AsyncClient):
     assert response.json()["status"] == "ok"
 
 
-async def test_signup_returns_token_and_user(client: AsyncClient):
+async def test_signup_helper_returns_token_and_user(client: AsyncClient):
+    """There is no public signup endpoint — the test helper is the owner-side
+    creation path — and what it returns must carry the platform role."""
     body = await signup(client, "alice@example.com", name="آلیس")
     assert body["access_token"]
     assert body["user"]["email"] == "alice@example.com"
     assert body["user"]["name"] == "آلیس"
+    assert body["user"]["platform_role"] == "manager"
+    assert body["user"]["is_manager"] is True
     assert body["user"]["is_platform_owner"] is False
     assert "password" not in str(body).lower() or "password_hash" not in str(body)
 
 
-async def test_signup_never_returns_password_hash(client: AsyncClient):
+async def test_signup_helper_never_returns_password_hash(client: AsyncClient):
     body = await signup(client, "hashcheck@example.com")
     assert "password_hash" not in body["user"]
     assert "password" not in body["user"]
 
 
-async def test_signup_rejects_duplicate_email(client: AsyncClient):
-    await signup(client, "dup@example.com")
+async def test_public_signup_endpoint_is_gone(client: AsyncClient):
+    """Signup is closed: accounts come from the owner or from an invite link.
+
+    A stray old client must not silently succeed — the route simply does not
+    exist anymore.
+    """
     response = await client.post(
         "/api/auth/signup",
-        json={"email": "dup@example.com", "password": "password123", "name": ""},
+        json={"email": "nope@example.com", "password": "password123", "name": ""},
     )
-    assert response.status_code == 409
-    assert response.json()["error"]["code"] == "conflict"
-
-
-async def test_signup_rejects_short_password(client: AsyncClient):
-    response = await client.post(
-        "/api/auth/signup",
-        json={"email": "short@example.com", "password": "123", "name": ""},
-    )
-    assert response.status_code == 422
+    assert response.status_code == 404
 
 
 async def test_login_succeeds_with_correct_password(client: AsyncClient):
@@ -53,6 +52,9 @@ async def test_login_succeeds_with_correct_password(client: AsyncClient):
     )
     assert response.status_code == 200
     assert response.json()["access_token"]
+    payload = response.json()["user"]
+    assert payload["platform_role"] == "manager"
+    assert payload["is_platform_owner"] is False
 
 
 async def test_login_fails_with_wrong_password(client: AsyncClient):
@@ -96,3 +98,49 @@ async def test_logout_is_recorded_and_returns_204(client: AsyncClient):
     body = await signup(client, "frank@example.com")
     response = await client.post("/api/auth/logout", headers=auth_header(body["access_token"]))
     assert response.status_code == 204
+
+
+async def test_change_password_replaces_the_old_one(client: AsyncClient):
+    """A temp password handed out by the owner must become a private one.
+
+    Without this, every account created by someone else would live forever on
+    a secret two people know.
+    """
+    body = await signup(client, "grace@example.com", password="password123")
+    headers = auth_header(body["access_token"])
+
+    response = await client.post(
+        "/api/auth/change-password",
+        json={"current_password": "password123", "new_password": "newpassword456"},
+        headers=headers,
+    )
+    assert response.status_code == 204, response.text
+
+    stale = await client.post(
+        "/api/auth/login", json={"email": "grace@example.com", "password": "password123"}
+    )
+    assert stale.status_code == 401
+    fresh = await client.post(
+        "/api/auth/login", json={"email": "grace@example.com", "password": "newpassword456"}
+    )
+    assert fresh.status_code == 200
+
+
+async def test_change_password_rejects_a_wrong_current_password(client: AsyncClient):
+    body = await signup(client, "heidi@example.com", password="password123")
+    response = await client.post(
+        "/api/auth/change-password",
+        json={"current_password": "not-my-password", "new_password": "newpassword456"},
+        headers=auth_header(body["access_token"]),
+    )
+    assert response.status_code == 401
+
+
+async def test_change_password_rejects_a_short_new_password(client: AsyncClient):
+    body = await signup(client, "ivan@example.com", password="password123")
+    response = await client.post(
+        "/api/auth/change-password",
+        json={"current_password": "password123", "new_password": "123"},
+        headers=auth_header(body["access_token"]),
+    )
+    assert response.status_code == 422

apps/api/tests/test_error_log.py

@@ -22,12 +22,13 @@ from app.core.errors import ProviderUnavailableError
 from app.infrastructure.db.models import ErrorEventRow
 from app.interfaces.http.deps import OrgContext, get_org_context
 from app.interfaces.http.request_context import REQUEST_ID_HEADER
+
 # The internal "full" app holds every HTTP handler; the public app serves only
 # /health + /api/ws, so this module's REST exercises must target the full app.
 from app.interfaces.realtime.rpc_app import get_rpc_app
+from tests.conftest import auth_header, signup
 
 app = get_rpc_app()
-from tests.conftest import auth_header, signup
 
 #: The password in this DSN must never reach the database.
 LEAKY_DSN = "postgresql://agy:sup3rs3cret@db.internal:5432/agy"
@@ -55,6 +56,11 @@ async def client(engine, session_factory):
                 await session.rollback()
                 raise
 
+    # The shared ``signup`` helper reads the factory from the conftest holder;
+    # this module shadows ``client``, so publish it here too.
+    from tests import conftest as _conftest
+
+    _conftest._session_factory_holder["factory"] = session_factory
     app.dependency_overrides[get_session] = _override_session
     async with AsyncClient(
         transport=ASGITransport(app=app, raise_app_exceptions=False),

apps/api/tests/test_invites.py

@@ -1,8 +1,13 @@
 """Invite redemption: the link an admin hands out must actually work.
 
 Covers the full loop — create the invite, preview it as the invitee, redeem it,
-and the three ways redemption can legitimately fail. Also pins the absolute
-invite URL, since a bare path is not clickable for the person receiving it.
+and the ways redemption can legitimately fail. Also pins the absolute invite
+URL, since a bare path is not clickable for the person receiving it.
+
+Because signup is closed, the invite link doubles as the account-creation
+path: a brand-new invitee redeems it with a password and gets an account bound
+to the invited email. The token can never reset an existing account's password
+— that is what the "account already exists" rejection guards.
 """
 
 from __future__ import annotations
@@ -13,7 +18,7 @@ from tests.conftest import auth_header, signup
 
 
 async def _owner_with_org(client: AsyncClient, name: str = "Acme") -> tuple[str, str]:
-    """``(token, org_id)`` for a freshly signed-up owner."""
+    """``(token, org_id)`` for a freshly created manager and their organization."""
     body = await signup(client, "owner@example.com", name="Owner")
     headers = auth_header(body["access_token"])
     org = await client.post("/api/organizations", json={"name": name}, headers=headers)
@@ -104,19 +109,121 @@ async def test_invite_cannot_be_redeemed_by_a_different_account(client: AsyncCli
 
 
 async def test_unknown_invite_token_is_not_found(client: AsyncClient):
-    user = await signup(client, "nobody@example.com")
-    response = await client.get(
-        "/api/invites/definitely-not-a-real-token",
-        headers=auth_header(user["access_token"]),
-    )
+    response = await client.get("/api/invites/definitely-not-a-real-token")
     assert response.status_code == 404
 
 
-async def test_accepting_an_invite_requires_authentication(client: AsyncClient):
+async def test_invite_preview_works_without_a_session(client: AsyncClient):
+    """A brand-new invitee must see what they were invited to *before* they can
+    log in — otherwise the login button on the accept screen is a dead end."""
+    owner_token, org_id = await _owner_with_org(client)
+    raw = (await _invite(client, owner_token, org_id, "newbie@example.com", "member"))[
+        "invite_token"
+    ]
+
+    preview = await client.get(f"/api/invites/{raw}")
+    assert preview.status_code == 200, preview.text
+    body = preview.json()
+    assert body["organization_name"] == "Acme"
+    assert body["email"] == "newbie@example.com"
+    assert body["role"] == "member"
+    # No account exists for the invited email yet, so the UI offers to create
+    # one instead of demanding a login.
+    assert body["has_account"] is False
+    assert body["already_member"] is False
+
+
+async def test_invite_preview_reports_an_existing_account(client: AsyncClient):
+    owner_token, org_id = await _owner_with_org(client)
+    raw = (await _invite(client, owner_token, org_id, "existing@example.com", "member"))[
+        "invite_token"
+    ]
+    await signup(client, "existing@example.com", name="Existing")
+
+    preview = await client.get(f"/api/invites/{raw}")
+    assert preview.status_code == 200, preview.text
+    assert preview.json()["has_account"] is True
+
+
+async def test_anonymous_redemption_creates_the_account_and_joins(client: AsyncClient):
+    """The closed-signup flow: the link is the capability, the password makes
+    the account private, and the org membership is created in one step."""
+    owner_token, org_id = await _owner_with_org(client)
+    raw = (await _invite(client, owner_token, org_id, "newbie@example.com", "member"))[
+        "invite_token"
+    ]
+
+    accepted = await client.post(
+        "/api/invites/accept", json={"token": raw, "password": "password123"}
+    )
+    assert accepted.status_code == 200, accepted.text
+    assert accepted.json()["organization_id"] == org_id
+    assert accepted.json()["role"] == "member"
+
+    # The account exists for exactly the invited email, with that password, as
+    # a plain platform user — an invite must never mint a manager.
+    login = await client.post(
+        "/api/auth/login", json={"email": "newbie@example.com", "password": "password123"}
+    )
+    assert login.status_code == 200, login.text
+    token = login.json()["access_token"]
+    assert login.json()["user"]["platform_role"] == "user"
+
+    me = await client.get("/api/auth/me", headers=auth_header(token))
+    joined = [o for o in me.json()["organizations"] if o["id"] == org_id]
+    assert joined and joined[0]["role"] == "member"
+
+
+async def test_anonymous_redemption_without_a_password_is_rejected(client: AsyncClient):
     owner_token, org_id = await _owner_with_org(client)
     raw = (await _invite(client, owner_token, org_id, "newbie@example.com", "member"))[
         "invite_token"
     ]
 
     response = await client.post("/api/invites/accept", json={"token": raw})
-    assert response.status_code == 401
+    assert response.status_code == 422
+    assert response.json()["error"]["code"] == "validation_error"
+
+
+async def test_anonymous_redemption_rejects_a_short_password(client: AsyncClient):
+    owner_token, org_id = await _owner_with_org(client)
+    raw = (await _invite(client, owner_token, org_id, "newbie@example.com", "member"))[
+        "invite_token"
+    ]
+
+    response = await client.post(
+        "/api/invites/accept", json={"token": raw, "password": "123"}
+    )
+    assert response.status_code == 422
+
+
+async def test_a_link_cannot_reset_an_existing_account(client: AsyncClient):
+    """A leaked invite must not become a password reset for the real account.
+
+    Whoever holds the link can create an account *only if none exists* for the
+    invited email; otherwise they must authenticate first.
+    """
+    owner_token, org_id = await _owner_with_org(client)
+    raw = (await _invite(client, owner_token, org_id, "taken@example.com", "member"))[
+        "invite_token"
+    ]
+    await signup(client, "taken@example.com", password="password123")
+
+    response = await client.post(
+        "/api/invites/accept", json={"token": raw, "password": "attacker-password"}
+    )
+    assert response.status_code == 403
+    assert "وارد شوید" in response.json()["error"]["message"]
+
+    # The real account's password is untouched, and the invite is not burned:
+    # the invitee can still redeem it after signing in.
+    login = await client.post(
+        "/api/auth/login", json={"email": "taken@example.com", "password": "password123"}
+    )
+    assert login.status_code == 200
+    accepted = await client.post(
+        "/api/invites/accept",
+        json={"token": raw},
+        headers=auth_header(login.json()["access_token"]),
+    )
+    assert accepted.status_code == 200, accepted.text

apps/api/tests/test_platform_hierarchy.py

@@ -0,0 +1,519 @@
+"""The platform hierarchy: one owner, owner-created managers, invited tenants.
+
+This is the security core of the identity model, so every rule gets both sides
+tested — the allow and the deny:
+
+1. **Exactly one owner.** The database refuses a second owner row outright;
+   the API refuses to mint or demote one. The seat moves only through a
+   transactional transfer that demotes the previous owner in the same step.
+2. **Only the owner and managers create organizations.** A plain user may not.
+3. **Only the owner creates managers.** No manager can mint another manager,
+   and no manager can enter the admin console.
+4. **A departing manager's organizations move to the owner** — never orphaned,
+   never deleted with their data.
+"""
+
+from __future__ import annotations
+
+import pytest
+from httpx import AsyncClient
+from sqlalchemy import select
+
+from app.domain.identity.models import Role
+from app.infrastructure.db.models import MembershipRow, OrganizationRow, UserRow
+from tests.conftest import auth_header
+
+
+async def _create_org(client: AsyncClient, token: str, name: str) -> dict:
+    response = await client.post(
+        "/api/organizations", json={"name": name}, headers=auth_header(token)
+    )
+    assert response.status_code == 201, response.text
+    return response.json()
+
+
+async def _login(client: AsyncClient, email: str, password: str) -> str:
+    response = await client.post(
+        "/api/auth/login", json={"email": email, "password": password}
+    )
+    assert response.status_code == 200, response.text
+    return response.json()["access_token"]
+
+
+async def _owner_creates_user(
+    client: AsyncClient,
+    owner_token: str,
+    email: str,
+    *,
+    platform_role: str = "manager",
+    name: str = "",
+) -> dict:
+    response = await client.post(
+        "/api/admin/users",
+        json={"email": email, "name": name, "platform_role": platform_role},
+        headers=auth_header(owner_token),
+    )
+    assert response.status_code == 201, response.text
+    return response.json()
+
+
+# ---------------------------------------------------------------------------
+# Exactly one owner
+# ---------------------------------------------------------------------------
+
+
+async def test_only_one_platform_owner_may_exist(
+    client: AsyncClient, platform_owner_token: str, session_factory
+):
+    """The invariant is enforced by the database, not by habit.
+
+    Even a direct INSERT — the kind a future code path or a migration would
+    perform — cannot produce a second owner row.
+    """
+    from sqlalchemy.exc import IntegrityError as _IntegrityError
+
+    async with session_factory() as session:
+        session.add(
+            UserRow(
+                id="second-owner-row",
+                email="second-owner@example.com",
+                password_hash="x",
+                platform_role="owner",
+            )
+        )
+        with pytest.raises(_IntegrityError):
+            await session.flush()
+        await session.rollback()
+
+
+async def test_owner_cannot_be_created_through_the_api(
+    client: AsyncClient, platform_owner_token: str
+):
+    response = await client.post(
+        "/api/admin/users",
+        json={"email": "wannabe@example.com", "platform_role": "owner"},
+        headers=auth_header(platform_owner_token),
+    )
+    assert response.status_code == 422
+    assert "مالکیت" in response.json()["error"]["message"]
+
+
+async def test_owner_account_is_immutable_from_the_api(
+    client: AsyncClient, platform_owner_token: str
+):
+    """No API path may demote, deactivate or delete the single owner seat."""
+    me = await client.get("/api/auth/me", headers=auth_header(platform_owner_token))
+    owner_id = me.json()["user"]["id"]
+
+    demote = await client.patch(
+        f"/api/admin/users/{owner_id}",
+        json={"platform_role": "manager"},
+        headers=auth_header(platform_owner_token),
+    )
+    assert demote.status_code == 403
+
+    deactivate = await client.patch(
+        f"/api/admin/users/{owner_id}",
+        json={"is_active": False},
+        headers=auth_header(platform_owner_token),
+    )
+    assert deactivate.status_code == 403
+
+    delete = await client.delete(
+        f"/api/admin/users/{owner_id}", headers=auth_header(platform_owner_token)
+    )
+    assert delete.status_code == 403
+
+
+async def test_transfer_ownership_moves_the_seat_and_keeps_exactly_one(
+    client: AsyncClient, platform_owner_token: str, session_factory
+):
+    """The safety valve for a lost owner account — transactional by design."""
+    manager = await _owner_creates_user(
+        client, platform_owner_token, "successor@example.com", name="جانشین"
+    )
+    successor_token = await _login(
+        client, "successor@example.com", manager["temp_password"]
+    )
+
+    response = await client.post(
+        "/api/admin/transfer-ownership",
+        json={"user_id": manager["user"]["id"]},
+        headers=auth_header(platform_owner_token),
+    )
+    assert response.status_code == 200, response.text
+    assert response.json()["platform_role"] == "owner"
+
+    async with session_factory() as session:
+        owners = (
+            (await session.execute(select(UserRow).where(UserRow.platform_role == "owner")))
+            .scalars()
+            .all()
+        )
+    assert [o.email for o in owners] == ["successor@example.com"]
+
+    # The previous owner is demoted to manager in the same step — a manager,
+    # not a powerless user, so they keep the ability to run organizations.
+    previous = await client.get("/api/auth/me", headers=auth_header(platform_owner_token))
+    assert previous.json()["user"]["platform_role"] == "manager"
+
+    # And the successor really is the owner: the console opens for them.
+    console = await client.get("/api/admin/users", headers=auth_header(successor_token))
+    assert console.status_code == 200
+
+
+# ---------------------------------------------------------------------------
+# Organization creation is gated by platform role
+# ---------------------------------------------------------------------------
+
+
+async def test_plain_user_cannot_create_an_organization(
+    client: AsyncClient, platform_owner_token: str, plain_user_token: str
+):
+    response = await client.post(
+        "/api/organizations",
+        json={"name": "سازمان ممنوعه"},
+        headers=auth_header(plain_user_token),
+    )
+    assert response.status_code == 403
+    assert "دعوت" in response.json()["error"]["message"]
+
+
+async def test_manager_can_create_an_organization(client: AsyncClient, manager_token: str):
+    org = await _create_org(client, manager_token, "سازمان مدیر")
+    assert org["owner_user_id"] == (
+        await client.get("/api/auth/me", headers=auth_header(manager_token))
+    ).json()["user"]["id"]
+
+
+async def test_owner_can_create_an_organization(client: AsyncClient, platform_owner_token: str):
+    org = await _create_org(client, platform_owner_token, "سازمان مالک")
+    assert org["name"] == "سازمان مالک"
+
+
+# ---------------------------------------------------------------------------
+# Only the owner creates managers
+# ---------------------------------------------------------------------------
+
+
+async def test_manager_cannot_create_accounts(client: AsyncClient, manager_token: str):
+    response = await client.post(
+        "/api/admin/users",
+        json={"email": "sneaky@example.com", "platform_role": "manager"},
+        headers=auth_header(manager_token),
+    )
+    assert response.status_code == 403
+
+
+async def test_plain_user_cannot_create_accounts(client: AsyncClient, plain_user_token: str):
+    response = await client.post(
+        "/api/admin/users",
+        json={"email": "sneaky2@example.com", "platform_role": "manager"},
+        headers=auth_header(plain_user_token),
+    )
+    assert response.status_code == 403
+
+
+async def test_manager_cannot_reach_the_admin_console(client: AsyncClient, manager_token: str):
+    for path in ("/api/admin/users", "/api/admin/models", "/api/admin/organizations"):
+        response = await client.get(path, headers=auth_header(manager_token))
+        assert response.status_code == 403, path
+
+
+async def test_owner_creates_a_manager_whose_temp_password_works(
+    client: AsyncClient, platform_owner_token: str
+):
+    created = await _owner_creates_user(
+        client, platform_owner_token, "manager1@example.com", name="مدیر یک"
+    )
+    assert created["user"]["platform_role"] == "manager"
+    assert created["user"]["is_manager"] is True
+    assert created["user"]["owned_organizations"] == 0
+    temp = created["temp_password"]
+    assert temp
+
+    login = await client.post(
+        "/api/auth/login",
+        json={"email": "manager1@example.com", "password": temp},
+    )
+    assert login.status_code == 200, login.text
+    assert login.json()["user"]["platform_role"] == "manager"
+
+
+async def test_duplicate_email_is_rejected(client: AsyncClient, platform_owner_token: str):
+    await _owner_creates_user(client, platform_owner_token, "twin@example.com")
+    response = await client.post(
+        "/api/admin/users",
+        json={"email": "twin@example.com", "platform_role": "manager"},
+        headers=auth_header(platform_owner_token),
+    )
+    assert response.status_code == 409
+
+
+async def test_owner_can_create_plain_users(client: AsyncClient, platform_owner_token: str):
+    created = await _owner_creates_user(
+        client,
+        platform_owner_token,
+        "plain@example.com",
+        platform_role="user",
+        name="کاربر عادی",
+    )
+    assert created["user"]["platform_role"] == "user"
+    assert created["user"]["is_manager"] is False
+
+
+async def test_owner_resets_a_forgotten_temp_password(
+    client: AsyncClient, platform_owner_token: str
+):
+    created = await _owner_creates_user(
+        client, platform_owner_token, "forgetful@example.com", name="فراموشکار"
+    )
+    first = created["temp_password"]
+
+    reset = await client.post(
+        f"/api/admin/users/{created['user']['id']}/reset-password",
+        headers=auth_header(platform_owner_token),
+    )
+    assert reset.status_code == 200, reset.text
+    second = reset.json()["temp_password"]
+    assert second and second != first
+
+    stale = await client.post(
+        "/api/auth/login", json={"email": "forgetful@example.com", "password": first}
+    )
+    assert stale.status_code == 401
+    fresh = await client.post(
+        "/api/auth/login", json={"email": "forgetful@example.com", "password": second}
+    )
+    assert fresh.status_code == 200
+
+
+# ---------------------------------------------------------------------------
+# A departing manager's organizations move to the owner
+# ---------------------------------------------------------------------------
+
+
+async def test_demoting_a_manager_transfers_organizations_to_the_owner(
+    client: AsyncClient, platform_owner_token: str, session_factory
+):
+    manager = await _owner_creates_user(
+        client, platform_owner_token, "leaving@example.com", name="خداحافظ"
+    )
+    manager_token = await _login(
+        client, "leaving@example.com", manager["temp_password"]
+    )
+    org = await _create_org(client, manager_token, "سازمان خداحافظ")
+
+    demote = await client.patch(
+        f"/api/admin/users/{manager['user']['id']}",
+        json={"platform_role": "user"},
+        headers=auth_header(platform_owner_token),
+    )
+    assert demote.status_code == 200, demote.text
+    assert demote.json()["platform_role"] == "user"
+    assert demote.json()["owned_organizations"] == 0
+
+    async with session_factory() as session:
+        row = await session.get(OrganizationRow, org["id"])
+        assert row is not None
+        owner_id = (
+            await client.get("/api/auth/me", headers=auth_header(platform_owner_token))
+        ).json()["user"]["id"]
+        assert row.owner_user_id == owner_id
+
+        memberships = (
+            (
+                await session.execute(
+                    select(MembershipRow).where(MembershipRow.organization_id == org["id"])
+                )
+            )
+            .scalars()
+            .all()
+        )
+        by_user = {m.user_id: m for m in memberships}
+        # The new owner can actually see the tenant...
+        assert by_user[owner_id].role == Role.OWNER.value
+        # ...and the demoted manager keeps working access without ownership.
+        assert by_user[manager["user"]["id"]].role == Role.ADMIN.value
+
+
+async def test_deleting_a_manager_transfers_organizations_and_memberships(
+    client: AsyncClient, platform_owner_token: str, session_factory
+):
+    manager = await _owner_creates_user(
+        client, platform_owner_token, "doomed@example.com", name="حذف‌شونده"
+    )
+    manager_token = await _login(client, "doomed@example.com", manager["temp_password"])
+    org = await _create_org(client, manager_token, "سازمان حذف‌شونده")
+
+    response = await client.delete(
+        f"/api/admin/users/{manager['user']['id']}", headers=auth_header(platform_owner_token)
+    )
+    assert response.status_code == 200, response.text
+    body = response.json()
+    assert body["deleted_user_id"] == manager["user"]["id"]
+    assert [t["organization_id"] for t in body["transferred_organizations"]] == [org["id"]]
+
+    async with session_factory() as session:
+        assert await session.get(UserRow, manager["user"]["id"]) is None
+        row = await session.get(OrganizationRow, org["id"])
+        assert row is not None, "the organization must survive its owner's deletion"
+        owner_id = (
+            await client.get("/api/auth/me", headers=auth_header(platform_owner_token))
+        ).json()["user"]["id"]
+        assert row.owner_user_id == owner_id
+        stale = (
+            await session.execute(
+                select(MembershipRow).where(
+                    MembershipRow.user_id == manager["user"]["id"]
+                )
+            )
+        ).scalars().all()
+        assert stale == [], "the deleted account's memberships must be gone"
+
+
+# ---------------------------------------------------------------------------
+# Managers create and join organizations
+# ---------------------------------------------------------------------------
+
+
+async def test_manager_can_join_another_managers_organization_by_invite(
+    client: AsyncClient, platform_owner_token: str
+):
+    """The invited manager keeps their own organization and gains a second."""
+    first = await _owner_creates_user(
+        client, platform_owner_token, "first@example.com", name="مدیر یکم"
+    )
+    second = await _owner_creates_user(
+        client, platform_owner_token, "second@example.com", name="مدیر دوم"
+    )
+    first_token = await _login(client, "first@example.com", first["temp_password"])
+    second_token = await _login(client, "second@example.com", second["temp_password"])
+
+    own_org = await _create_org(client, first_token, "سازمان مدیر یکم")
+    # The second manager has a tenant of their own before being invited.
+    second_own_org = await _create_org(client, second_token, "سازمان مدیر دوم")
+
+    invite = await client.post(
+        f"/api/organizations/{own_org['id']}/invites",
+        json={"email": "second@example.com", "role": "admin"},
+        headers=auth_header(first_token),
+    )
+    assert invite.status_code == 201, invite.text
+
+    accepted = await client.post(
+        "/api/invites/accept",
+        json={"token": invite.json()["invite_token"]},
+        headers=auth_header(second_token),
+    )
+    assert accepted.status_code == 200, accepted.text
+
+    me = await client.get("/api/auth/me", headers=auth_header(second_token))
+    roles = {o["id"]: o["role"] for o in me.json()["organizations"]}
+    # Joined the other manager's organization with the invited role...
+    assert roles[own_org["id"]] == "admin"
+    # ...and still owns their own, untouched.
+    assert roles[second_own_org["id"]] == "owner"
+    assert len(me.json()["organizations"]) == 2
+
+
+async def test_promoting_a_plain_user_to_manager_is_possible(
+    client: AsyncClient, platform_owner_token: str
+):
+    created = await _owner_creates_user(
+        client, platform_owner_token, "promoted@example.com", platform_role="user"
+    )
+    promoted = await client.patch(
+        f"/api/admin/users/{created['user']['id']}",
+        json={"platform_role": "manager"},
+        headers=auth_header(platform_owner_token),
+    )
+    assert promoted.status_code == 200, promoted.text
+    assert promoted.json()["platform_role"] == "manager"
+
+    # The new tier takes effect immediately: organizations are now allowed.
+    promoted_token = await _login(
+        client, "promoted@example.com", created["temp_password"]
+    )
+    org = await _create_org(client, promoted_token, "سازمان ارتقایافته")
+    assert org["name"] == "سازمان ارتقایافته"
+
+
+async def test_deactivating_an_account_blocks_login(
+    client: AsyncClient, platform_owner_token: str
+):
+    created = await _owner_creates_user(
+        client, platform_owner_token, "frozen@example.com", name="مسدود"
+    )
+    response = await client.patch(
+        f"/api/admin/users/{created['user']['id']}",
+        json={"is_active": False},
+        headers=auth_header(platform_owner_token),
+    )
+    assert response.status_code == 200, response.text
+    assert response.json()["is_active"] is False
+
+    login = await client.post(
+        "/api/auth/login",
+        json={"email": "frozen@example.com", "password": created["temp_password"]},
+    )
+    assert login.status_code == 401
+
+
+async def test_user_list_reports_roles_and_owned_organization_counts(
+    client: AsyncClient, platform_owner_token: str
+):
+    manager = await _owner_creates_user(
+        client, platform_owner_token, "listed@example.com", name="فهرست"
+    )
+    manager_token = await _login(client, "listed@example.com", manager["temp_password"])
+    await _create_org(client, manager_token, "سازمان فهرست")
+
+    listing = await client.get("/api/admin/users", headers=auth_header(platform_owner_token))
+    assert listing.status_code == 200
+    rows = {u["email"]: u for u in listing.json()}
+    assert rows["listed@example.com"]["platform_role"] == "manager"
+    assert rows["listed@example.com"]["owned_organizations"] == 1
+    me = await client.get("/api/auth/me", headers=auth_header(platform_owner_token))
+    owner_email = me.json()["user"]["email"]
+    assert rows[owner_email]["platform_role"] == "owner"
+    assert rows[owner_email]["is_platform_owner"] is True
+
+
+async def test_admin_user_endpoints_require_authentication(client: AsyncClient):
+    assert (await client.get("/api/admin/users")).status_code == 401
+    assert (
+        await client.post("/api/admin/users", json={"email": "x@example.com"})
+    ).status_code == 401
+
+
+async def test_every_seat_move_is_audited(
+    client: AsyncClient, platform_owner_token: str, session_factory
+):
+    """The transfer and the deletion are the two irreversible moves; both must
+    leave a trail that names the actor and the moved organizations."""
+    from app.domain.audit.models import AuditAction
+
+    manager = await _owner_creates_user(
+        client, platform_owner_token, "audited@example.com", name="ممیزی"
+    )
+    manager_token = await _login(client, "audited@example.com", manager["temp_password"])
+    org = await _create_org(client, manager_token, "سازمان ممیزی")
+
+    response = await client.delete(
+        f"/api/admin/users/{manager['user']['id']}", headers=auth_header(platform_owner_token)
+    )
+    assert response.status_code == 200
+
+    from app.infrastructure.repositories.audit import AuditRepository
+
+    async with session_factory() as session:
+        events = await AuditRepository(session).list_platform(limit=100)
+    actions = {e.action: e for e in events}
+    assert AuditAction.USER_CREATE in actions
+    assert AuditAction.USER_DELETE in actions
+    delete_event = actions[AuditAction.USER_DELETE]
+    assert delete_event.metadata_json["transferred_organizations"] == [org["id"]]
+    assert delete_event.actor_user_id == (
+        await client.get("/api/auth/me", headers=auth_header(platform_owner_token))
+    ).json()["user"]["id"]

apps/api/tests/test_realtime.py

@@ -25,13 +25,14 @@ from sqlalchemy.pool import NullPool
 import app.infrastructure.db.models as _orm_models  # noqa: F401 - registers metadata
 from app.application.ports.realtime import RealtimeEvent, set_publisher
 from app.core.config import settings
-from app.core.database import Base, get_session
+from app.core.database import Base, enable_sqlite_foreign_keys, get_session
 from app.core.security import create_access_token
 from app.domain.base import new_id
 from app.infrastructure.db.models import UserRow
 from app.interfaces.realtime.authz import authorize_channel
 from app.interfaces.realtime.bus import get_bus
 from app.interfaces.realtime.manager import Connection, ConnectionManager
+
 # The internal "full" app holds every HTTP handler; the public app serves only
 # /health + /api/ws. The socket and the RPC surface both live on the full app.
 from app.interfaces.realtime.rpc_app import get_rpc_app
@@ -85,7 +86,7 @@ async def _user_with_org(session: AsyncSession, *, platform_owner: bool = False)
             id=user_id,
             email=f"{user_id}@example.com",
             password_hash="x",
-            is_platform_owner=platform_owner,
+            platform_role=("owner" if platform_owner else "user"),
         )
     )
     await session.flush()
@@ -277,6 +278,7 @@ class _NullPublisher:
 
 
 async def _create_schema(engine) -> None:
+    enable_sqlite_foreign_keys(engine)
     async with engine.begin() as conn:
         await conn.run_sync(Base.metadata.create_all)
 
@@ -299,6 +301,9 @@ def ws_client(monkeypatch):
     monkeypatch.setattr("app.main.engine", engine)
     monkeypatch.setattr("app.interfaces.realtime.router.SessionFactory", factory)
     monkeypatch.setattr(settings, "realtime_transport", "local")
+    # Published for ``_create_account`` below: signup is closed, so the socket
+    # tests that need an identity mint it directly against this database.
+    _ws_factory_holder["factory"] = factory
 
     async def _override_session():
         async with factory() as session:
@@ -335,11 +340,45 @@ def _frames_until(websocket, wanted_type: str, *, max_frames: int = 20) -> dict:
     raise AssertionError(f"no {wanted_type} event arrived")
 
 
-def test_socket_allows_anonymous_then_restricts_actions(ws_client):
-    """No token opens an anonymous socket, but only login/signup may be called.
+#: Set by the ``ws_client`` fixture; read by ``_create_account``.
+_ws_factory_holder: dict[str, async_sessionmaker] = {}
 
-    A visitor who has not logged in can reach ``/api/auth/login`` and
-    ``/api/auth/signup`` over RPC; every other RPC and any subscribe is refused.
+
+def _create_account(email: str, *, name: str = "", platform_role: str = "manager") -> str:
+    """Create an account directly in the throwaway database; return its token.
+
+    Signup is closed — accounts come from the platform owner or from an
+    invite — so a socket test that needs an identity writes the row the way
+    those flows would and signs a token for it.
+    """
+    from app.core.security import create_access_token, hash_password
+    from app.domain.identity.models import PlatformRole, User
+    from app.infrastructure.repositories.identity import UserRepository
+
+    factory = _ws_factory_holder["factory"]
+
+    async def _create():
+        async with factory() as session:
+            user = await UserRepository(session).create(
+                User(
+                    email=email,
+                    password_hash=hash_password("password123"),
+                    name=name,
+                    platform_role=PlatformRole(platform_role),
+                )
+            )
+            await session.commit()
+            return user
+
+    user = asyncio.run(_create())
+    return create_access_token(user.id)
+
+
+def test_socket_allows_anonymous_then_restricts_actions(ws_client):
+    """No token opens an anonymous socket, but only the bootstrap RPCs run.
+
+    A visitor who has not logged in can reach ``/api/auth/login`` and redeem an
+    invite over RPC; every other RPC and any subscribe is refused.
     """
     with ws_client.websocket_connect("/api/ws") as socket:
         hello = socket.receive_json()
@@ -347,7 +386,9 @@ def test_socket_allows_anonymous_then_restricts_actions(ws_client):
         assert hello["user_id"] is None
 
         # A protected RPC is refused for an anonymous connection.
-        socket.send_json({"action": "rpc", "id": "1", "method": "GET", "path": "/api/organizations"})
+        socket.send_json(
+            {"action": "rpc", "id": "1", "method": "GET", "path": "/api/organizations"}
+        )
         result = socket.receive_json()
         assert result["type"] == "rpc_result"
         assert result["status"] == 401
@@ -378,13 +419,9 @@ def test_anonymous_may_call_login_over_rpc(ws_client):
 
 
 def test_task_creation_is_pushed_live(ws_client):
-    # Sign up, create an organization — the tenant the socket subscribes to.
-    signup = ws_client.post(
-        "/api/auth/signup",
-        json={"email": "live@example.com", "password": "password123", "name": "زنده"},
-    )
-    assert signup.status_code == 201, signup.text
-    token = signup.json()["access_token"]
+    # Create a manager account and its organization — the tenant the socket
+    # subscribes to. (Signup is closed; this is the owner-created path.)
+    token = _create_account("live@example.com", name="زنده")
     org = ws_client.post(
         "/api/organizations",
         json={"name": "سازمان زنده"},
@@ -425,12 +462,7 @@ def test_second_user_cannot_read_another_org(ws_client):
     tokens = []
     org_ids = []
     for index in range(2):
-        signup = ws_client.post(
-            "/api/auth/signup",
-            json={"email": f"user{index}@example.com", "password": "password123"},
-        )
-        assert signup.status_code == 201, signup.text
-        token = signup.json()["access_token"]
+        token = _create_account(f"user{index}@example.com")
         org = ws_client.post(
             "/api/organizations",
             json={"name": f"org {index}"},

apps/api/tests/test_seed.py

@@ -71,28 +71,59 @@ async def test_seeded_platform_owner_can_log_in(client: AsyncClient, seeded_inst
     assert me.json()["user"]["is_platform_owner"] is True
 
 
-async def test_seeded_accounts_belong_to_the_sample_organization(
+async def test_seeded_demo_manager_owns_the_sample_organization(
     client: AsyncClient, seeded_install
 ):
     """A login that lands on an empty dashboard is a broken demo.
 
-    Both seeded accounts must see the sample organization, otherwise every
-    screen behind the login renders nothing.
+    The demo account is a *manager* — the tier that creates organizations — so
+    it must own the sample organization and land on a populated dashboard.
     """
-    for email, password in (
-        (seeded_install.DEMO_EMAIL, seeded_install.DEMO_PASSWORD),
-        (seeded_install.PLATFORM_OWNER_EMAIL, seeded_install.PLATFORM_OWNER_PASSWORD),
-    ):
-        login = await client.post("/api/auth/login", json={"email": email, "password": password})
-        assert login.status_code == 200, login.text
+    login = await client.post(
+        "/api/auth/login",
+        json={
+            "email": seeded_install.DEMO_EMAIL,
+            "password": seeded_install.DEMO_PASSWORD,
+        },
+    )
+    assert login.status_code == 200, login.text
+    assert login.json()["user"]["platform_role"] == "manager"
+    assert login.json()["user"]["is_manager"] is True
+    assert login.json()["user"]["is_platform_owner"] is False
 
-        me = await client.get(
-            "/api/auth/me", headers=auth_header(login.json()["access_token"])
-        )
-        organizations = me.json()["organizations"]
-        assert organizations, f"{email} belongs to no organization"
-        assert organizations[0]["name"] == seeded_install.DEMO_ORG_NAME
-        assert organizations[0]["role"] == "owner"
+    me = await client.get(
+        "/api/auth/me", headers=auth_header(login.json()["access_token"])
+    )
+    organizations = me.json()["organizations"]
+    assert organizations, "the demo manager belongs to no organization"
+    assert organizations[0]["name"] == seeded_install.DEMO_ORG_NAME
+    assert organizations[0]["role"] == "owner"
+
+
+async def test_platform_owner_is_not_joined_to_any_organization(
+    client: AsyncClient, seeded_install
+):
+    """The product rule: the owner observes tenants from the console.
+
+    Auto-joining the owner to a tenant would put the single owner seat inside
+    customer data, which is exactly what the hierarchy is designed to avoid.
+    """
+    login = await client.post(
+        "/api/auth/login",
+        json={
+            "email": seeded_install.PLATFORM_OWNER_EMAIL,
+            "password": seeded_install.PLATFORM_OWNER_PASSWORD,
+        },
+    )
+    assert login.status_code == 200, login.text
+
+    me = await client.get(
+        "/api/auth/me", headers=auth_header(login.json()["access_token"])
+    )
+    assert me.status_code == 200, me.text
+    assert me.json()["user"]["is_platform_owner"] is True
+    assert me.json()["user"]["platform_role"] == "owner"
+    assert me.json()["organizations"] == []
 
 
 async def test_seeded_install_can_use_the_product(
@@ -216,4 +247,5 @@ async def test_seed_is_idempotent(client: AsyncClient, seeded_install, session_f
 
     assert after == before, f"re-seeding changed row counts: {before} -> {after}"
     assert after["organizations"] == 1
-    assert after["memberships"] == 2, "one per seeded account, and no duplicates"
+    # Only the demo manager: the platform owner stays out of tenants.
+    assert after["memberships"] == 1