# Tenant & Admin Module Permissions

The tenant administration features expose API endpoints under `tenants` and `admins`. To secure these routes, populate the new JSON keys in the `roles_permissions` table.

## Recommended Permissions

| Role | Permissions |
|------|-------------|
| **Super Admin** | `tenants.*`, `admins.*` |
| **Admin** | `tenants.*`, `admins.*` |

Run SQL updates similar to:

```sql
UPDATE roles_permissions
SET permissions = JSON_SET(
  permissions,
  '$.tenants', JSON_ARRAY('getAll','create','update','delete','reassign'),
  '$.admins',  JSON_ARRAY('getAll','create','update','delete','reassign')
)
WHERE role = 'Admin';

UPDATE roles_permissions
SET permissions = JSON_SET(
  permissions,
  '$.tenants', JSON_ARRAY('*'),
  '$.admins',  JSON_ARRAY('*')
)
WHERE role = 'Super Admin';
```

Adjust the statements if your JSON column already contains these keys.

## Initial Super Admin

A clean installation seeds a global administrator account:

- `users` table has an entry with `id` **1**.
- `user_group_memberships` links this user to group `1` with role **Super Admin**.
- `roles_permissions` grants role **Super Admin** the wildcard permissions `{ "*": ["*"] }` for all tenants.

These defaults ensure the first login can manage tenants and admins without loading the demo data.

## Admin Role Assignment

Admins created through the `AdminsController` are automatically inserted into
`user_group_memberships` with role **Admin** (group ID `1`).  They also receive
the permissions configured for the **Admin** role in the `roles_permissions`
table.