feat(auth): add DEVELOPER + PARK_OPERATOR roles with owner scoping (B2B accounts)

Two new B2B roles for CĐT (project developers) and KCN operators, provisioned by
admin. Each account owns a subset of ProjectDevelopment / IndustrialPark records
and can CRUD them from the dashboard; admin retains full access.

Phase 1 — Schema
- Extend UserRole enum with DEVELOPER + PARK_OPERATOR (before ADMIN)
- ProjectDevelopment.ownerId FK (User, ON DELETE SET NULL) + index
- IndustrialPark.ownerId FK + index
- Migration 20260420030000

Phase 2a — Backend authorization
- CreateProjectCommand + CreateIndustrialParkCommand accept ownerId; controllers
  auto-set it to the caller's user id when role=DEVELOPER / PARK_OPERATOR
- Update + Delete commands gain (requesterUserId, requesterRole) and enforce
  ADMIN-or-owner via ForbiddenException; reassigning ownerId is admin-only
- Search params gain optional ownerId filter wired through Prisma repos
- New endpoints: GET /projects/mine/list, GET /industrial/parks/mine/list
- user-rate-limit guard: add DEVELOPER + PARK_OPERATOR entries (300/window)

Phase 2b — Admin provision
- ProvisionDeveloperCommand/Handler: create user (role=DEVELOPER), pre-validate
  target projects have no existing owner, batch-assign ownerId
- ProvisionParkOperatorCommand/Handler: same for PARK_OPERATOR + IndustrialPark
- POST /admin/accounts/developers, POST /admin/accounts/park-operators (admin-only)
- DTOs with phone/password/fullName/email + optional {project,park}Ids[]

Phase 2c — Project stats for developer dashboard
- GetProjectStatsQuery + handler: aggregates linkedListingCount, activeListingCount,
  totalInquiries, unreadInquiries, savedByUsers via Property → Listing → Inquiry chain
- GET /projects/:id/stats — admin sees all, DEVELOPER only their own (403 otherwise)

Phase 3 — Frontend
- Dashboard layout role-aware: DEVELOPER sees "Dự án của tôi" + CRM + Profile (hides
  listings/analytics/subscription); PARK_OPERATOR sees "KCN của tôi" equivalent
- /projects dashboard page switches to duAnApi.searchMine() when role=DEVELOPER
- /industrial-parks page switches to industrialApi.searchMine() when role=PARK_OPERATOR
- Admin nav gains "Tài khoản CĐT" + "Tài khoản KCN" entries
- New pages /admin/accounts/developers + /admin/accounts/park-operators with
  checkbox-based multi-select for linking entities
- adminApi.provisionDeveloper + provisionParkOperator + types
- duAnApi.searchMine + getStats; industrialApi.searchMine
- Login demo accounts list includes CĐT Vingroup + KCN VSIP

Phase 4 — Seed (prisma/seed-b2b-accounts.ts)
- DEVELOPER "CĐT Vingroup" (+84912000001) owns 4 projects
- DEVELOPER "CĐT Masterise Homes" (+84912000003) owns 2 projects
- PARK_OPERATOR "Vận hành KCN VSIP" (+84912000002) owns 2 seeded KCN
- Password Velik@2026 for all

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/src/modules/projects/application/commands/create-project/create-project.command.ts

@@ -29,5 +29,11 @@ export class CreateProjectCommand {
     public readonly completionDate: Date | null,
     public readonly suitableFor: string[] = [],
     public readonly whyThisLocation: string | null = null,
+    /**
+     * Owner of the new project. Admin can pass any user id (e.g. when
+     * provisioning a project on behalf of a CĐT). DEVELOPER callers are
+     * forced to their own id. Null = unassigned (admin-managed).
+     */
+    public readonly ownerId: string | null = null,
   ) {}
 }

apps/api/src/modules/projects/application/commands/create-project/create-project.handler.ts

@@ -57,6 +57,7 @@ export class CreateProjectHandler implements ICommandHandler<CreateProjectComman
         suitableFor: cmd.suitableFor ?? [],
         whyThisLocation: cmd.whyThisLocation ?? null,
         isVerified: false,
+        ownerId: cmd.ownerId ?? null,
       },
       now,
       now,

apps/api/src/modules/projects/application/commands/delete-project/delete-project.command.ts

@@ -1,3 +1,9 @@
+import type { UserRole } from '@prisma/client';
+
 export class DeleteProjectCommand {
-  constructor(public readonly id: string) {}
+  constructor(
+    public readonly id: string,
+    public readonly requesterUserId: string,
+    public readonly requesterRole: UserRole,
+  ) {}
 }

apps/api/src/modules/projects/application/commands/delete-project/delete-project.handler.ts

@@ -1,4 +1,4 @@
-import { Inject } from '@nestjs/common';
+import { ForbiddenException, Inject } from '@nestjs/common';
 import { type ICommandHandler, CommandHandler } from '@nestjs/cqrs';
 import { NotFoundException } from '@modules/shared';
 import {
@@ -20,6 +20,14 @@ export class DeleteProjectHandler implements ICommandHandler<DeleteProjectComman
       throw new NotFoundException('Dự án', cmd.id);
     }
 
+    // Authorisation: ADMIN may delete anything; DEVELOPER may delete only
+    // projects they own.
+    if (cmd.requesterRole !== 'ADMIN') {
+      if (cmd.requesterRole !== 'DEVELOPER' || entity.ownerId !== cmd.requesterUserId) {
+        throw new ForbiddenException('Bạn không có quyền xoá dự án này');
+      }
+    }
+
     await this.repo.delete(cmd.id);
   }
 }

apps/api/src/modules/projects/application/commands/update-project/update-project.command.ts

@@ -1,8 +1,11 @@
-import type { ProjectDevelopmentStatus } from '@prisma/client';
+import type { ProjectDevelopmentStatus, UserRole } from '@prisma/client';
 
 export class UpdateProjectCommand {
   constructor(
     public readonly id: string,
+    /** User performing the update. Used to enforce ownership for DEVELOPER role. */
+    public readonly requesterUserId: string,
+    public readonly requesterRole: UserRole,
     public readonly name?: string,
     public readonly developer?: string,
     public readonly developerLogo?: string | null,
@@ -27,5 +30,7 @@ export class UpdateProjectCommand {
     public readonly completionDate?: Date | null,
     public readonly suitableFor?: string[],
     public readonly whyThisLocation?: string | null,
+    /** Admin-only: reassign the owning DEVELOPER user. Null to unassign. */
+    public readonly ownerId?: string | null,
   ) {}
 }

apps/api/src/modules/projects/application/commands/update-project/update-project.handler.ts

@@ -1,4 +1,4 @@
-import { Inject } from '@nestjs/common';
+import { ForbiddenException, Inject } from '@nestjs/common';
 import { type ICommandHandler, CommandHandler } from '@nestjs/cqrs';
 import { NotFoundException } from '@modules/shared';
 import {
@@ -20,6 +20,17 @@ export class UpdateProjectHandler implements ICommandHandler<UpdateProjectComman
       throw new NotFoundException('Dự án', cmd.id);
     }
 
+    // Authorisation: ADMIN may edit anything. DEVELOPER may edit only projects
+    // they own. Reassigning `ownerId` is admin-only.
+    if (cmd.requesterRole !== 'ADMIN') {
+      if (cmd.requesterRole !== 'DEVELOPER' || entity.ownerId !== cmd.requesterUserId) {
+        throw new ForbiddenException('Bạn không có quyền chỉnh sửa dự án này');
+      }
+      if (cmd.ownerId !== undefined) {
+        throw new ForbiddenException('Chỉ admin có thể chuyển quyền sở hữu dự án');
+      }
+    }
+
     entity.updateDetails({
       ...(cmd.name !== undefined && { name: cmd.name }),
       ...(cmd.developer !== undefined && { developer: cmd.developer }),
@@ -45,6 +56,7 @@ export class UpdateProjectHandler implements ICommandHandler<UpdateProjectComman
       ...(cmd.isVerified !== undefined && { isVerified: cmd.isVerified }),
       ...(cmd.startDate !== undefined && { startDate: cmd.startDate }),
       ...(cmd.completionDate !== undefined && { completionDate: cmd.completionDate }),
+      ...(cmd.ownerId !== undefined && { ownerId: cmd.ownerId }),
     });
 
     await this.repo.update(entity);

apps/api/src/modules/projects/application/queries/get-project-stats/get-project-stats.handler.ts

@@ -0,0 +1,89 @@
+import { ForbiddenException, Inject } from '@nestjs/common';
+import { type IQueryHandler, QueryHandler } from '@nestjs/cqrs';
+import { NotFoundException, PrismaService } from '@modules/shared';
+import {
+  PROJECT_REPOSITORY,
+  type IProjectRepository,
+} from '../../../domain/repositories/project-development.repository';
+import { GetProjectStatsQuery } from './get-project-stats.query';
+
+export interface ProjectStats {
+  projectId: string;
+  linkedListingCount: number;
+  activeListingCount: number;
+  totalInquiries: number;
+  unreadInquiries: number;
+  savedByUsers: number;
+}
+
+interface StatsRow {
+  linked: bigint;
+  active: bigint;
+  inquiries: bigint;
+  unread: bigint;
+  saves: bigint;
+}
+
+/**
+ * Aggregates project-level metrics for the "Dự án của tôi" dashboard.
+ * Visible to ADMIN (any project) and DEVELOPER (only projects they own).
+ */
+@QueryHandler(GetProjectStatsQuery)
+export class GetProjectStatsHandler
+  implements IQueryHandler<GetProjectStatsQuery, ProjectStats>
+{
+  constructor(
+    @Inject(PROJECT_REPOSITORY)
+    private readonly projectRepo: IProjectRepository,
+    private readonly prisma: PrismaService,
+  ) {}
+
+  async execute(query: GetProjectStatsQuery): Promise<ProjectStats> {
+    const project = await this.projectRepo.findById(query.projectId);
+    if (!project) {
+      throw new NotFoundException('Dự án', query.projectId);
+    }
+
+    if (query.requesterRole !== 'ADMIN') {
+      if (
+        query.requesterRole !== 'DEVELOPER' ||
+        project.ownerId !== query.requesterUserId
+      ) {
+        throw new ForbiddenException('Bạn không có quyền xem thống kê dự án này');
+      }
+    }
+
+    // Single-round-trip aggregate pulling listing + inquiry + savedListing
+    // counts via the Property link.
+    const rows = await this.prisma.$queryRaw<StatsRow[]>`
+      SELECT
+        COUNT(DISTINCT l.id) FILTER (WHERE l.id IS NOT NULL) AS linked,
+        COUNT(DISTINCT l.id) FILTER (WHERE l.status = 'APPROVED') AS active,
+        COUNT(DISTINCT i.id) FILTER (WHERE i.id IS NOT NULL) AS inquiries,
+        COUNT(DISTINCT i.id) FILTER (WHERE i.id IS NOT NULL AND i."isRead" = FALSE) AS unread,
+        COUNT(DISTINCT sl."userId") FILTER (WHERE sl."userId" IS NOT NULL) AS saves
+      FROM "Property" p
+      LEFT JOIN "Listing" l ON l."propertyId" = p.id
+      LEFT JOIN "Inquiry" i ON i."listingId" = l.id
+      LEFT JOIN "SavedListing" sl ON sl."listingId" = l.id
+      WHERE p."projectDevelopmentId" = ${query.projectId}
+    `;
+
+    const row = rows[0] ?? {
+      linked: BigInt(0),
+      active: BigInt(0),
+      inquiries: BigInt(0),
+      unread: BigInt(0),
+      saves: BigInt(0),
+    };
+
+    return {
+      projectId: query.projectId,
+      linkedListingCount: Number(row.linked),
+      activeListingCount: Number(row.active),
+      totalInquiries: Number(row.inquiries),
+      unreadInquiries: Number(row.unread),
+      savedByUsers: Number(row.saves),
+    };
+  }
+}

apps/api/src/modules/projects/application/queries/get-project-stats/get-project-stats.query.ts

@@ -0,0 +1,9 @@
+import type { UserRole } from '@prisma/client';
+
+export class GetProjectStatsQuery {
+  constructor(
+    public readonly projectId: string,
+    public readonly requesterUserId: string,
+    public readonly requesterRole: UserRole,
+  ) {}
+}

apps/api/src/modules/projects/application/queries/list-projects/list-projects.handler.ts

@@ -23,6 +23,7 @@ export class ListProjectsHandler implements IQueryHandler<ListProjectsQuery> {
       district: query.district,
       developer: query.developer,
       isVerified: query.isVerified,
+      ownerId: query.ownerId,
       page: query.page,
       limit: query.limit,
     });

apps/api/src/modules/projects/application/queries/list-projects/list-projects.query.ts

@@ -10,5 +10,7 @@ export class ListProjectsQuery {
     public readonly isVerified: boolean | undefined,
     public readonly page: number,
     public readonly limit: number,
+    /** When set, restrict results to projects owned by this user id. */
+    public readonly ownerId?: string,
   ) {}
 }

apps/api/src/modules/projects/domain/entities/project-development.entity.ts

@@ -33,6 +33,8 @@ export interface ProjectDevelopmentProps {
   suitableFor: string[];
   whyThisLocation: string | null;
   isVerified: boolean;
+  /** Owning DEVELOPER user id; null when not yet assigned (admin-managed). */
+  ownerId: string | null;
 }
 
 export class ProjectDevelopmentEntity extends AggregateRoot<string> {
@@ -67,6 +69,7 @@ export class ProjectDevelopmentEntity extends AggregateRoot<string> {
   private _suitableFor: string[];
   private _whyThisLocation: string | null;
   private _isVerified: boolean;
+  private _ownerId: string | null;
 
   constructor(id: string, props: ProjectDevelopmentProps, createdAt: Date, updatedAt: Date) {
     super(id, createdAt, updatedAt);
@@ -101,6 +104,7 @@ export class ProjectDevelopmentEntity extends AggregateRoot<string> {
     this._suitableFor = props.suitableFor;
     this._whyThisLocation = props.whyThisLocation;
     this._isVerified = props.isVerified;
+    this._ownerId = props.ownerId;
   }
 
   get name() { return this._name; }
@@ -134,6 +138,7 @@ export class ProjectDevelopmentEntity extends AggregateRoot<string> {
   get suitableFor() { return this._suitableFor; }
   get whyThisLocation() { return this._whyThisLocation; }
   get isVerified() { return this._isVerified; }
+  get ownerId() { return this._ownerId; }
 
   updateDetails(props: Partial<ProjectDevelopmentProps>): void {
     if (props.name !== undefined) this._name = props.name;
@@ -160,6 +165,7 @@ export class ProjectDevelopmentEntity extends AggregateRoot<string> {
     if (props.suitableFor !== undefined) this._suitableFor = props.suitableFor;
     if (props.whyThisLocation !== undefined) this._whyThisLocation = props.whyThisLocation;
     if (props.isVerified !== undefined) this._isVerified = props.isVerified;
+    if (props.ownerId !== undefined) this._ownerId = props.ownerId;
     this.updatedAt = new Date();
   }
 }

apps/api/src/modules/projects/domain/repositories/project-development.repository.ts

@@ -10,6 +10,8 @@ export interface ProjectSearchParams {
   district?: string;
   developer?: string;
   isVerified?: boolean;
+  /** When set, restrict results to projects owned by this user id. */
+  ownerId?: string;
   page?: number;
   limit?: number;
 }
@@ -42,6 +44,7 @@ export interface ProjectListItem {
   suitableFor: string[];
   whyThisLocation: string | null;
   isVerified: boolean;
+  ownerId: string | null;
   latitude: number;
   longitude: number;
   propertyCount: number;

apps/api/src/modules/projects/infrastructure/repositories/prisma-project-development.repository.ts

@@ -68,7 +68,8 @@ export class PrismaProjectDevelopmentRepository implements IProjectRepository {
         location, address, ward, district, city,
         "minPrice", "maxPrice", "pricePerM2Range", "totalArea",
         "buildingCount", "floorCount", "unitTypes", media, documents,
-        tags, "suitableFor", "whyThisLocation", "isVerified", "createdAt", "updatedAt"
+        tags, "suitableFor", "whyThisLocation", "isVerified", "ownerId",
+        "createdAt", "updatedAt"
       ) VALUES (
         ${entity.id}, ${entity.name}, ${entity.slug}, ${entity.developer},
         ${entity.developerLogo}, ${entity.totalUnits}, ${entity.completedUnits},
@@ -88,7 +89,8 @@ export class PrismaProjectDevelopmentRepository implements IProjectRepository {
         ${entity.tags}::text[],
         ${entity.suitableFor}::text[],
         ${entity.whyThisLocation},
-        ${entity.isVerified}, ${entity.createdAt}, ${entity.updatedAt}
+        ${entity.isVerified}, ${entity.ownerId},
+        ${entity.createdAt}, ${entity.updatedAt}
       )
     `;
   }
@@ -119,6 +121,7 @@ export class PrismaProjectDevelopmentRepository implements IProjectRepository {
         "suitableFor" = ${entity.suitableFor}::text[],
         "whyThisLocation" = ${entity.whyThisLocation},
         "isVerified" = ${entity.isVerified},
+        "ownerId" = ${entity.ownerId},
         "updatedAt" = ${entity.updatedAt}
       WHERE id = ${entity.id}
     `;
@@ -153,6 +156,10 @@ export class PrismaProjectDevelopmentRepository implements IProjectRepository {
       conditions.push(`"isVerified" = $${paramIndex++}`);
       values.push(params.isVerified);
     }
+    if (params.ownerId) {
+      conditions.push(`"ownerId" = $${paramIndex++}`);
+      values.push(params.ownerId);
+    }
     if (params.query) {
       conditions.push(`(name ILIKE $${paramIndex} OR developer ILIKE $${paramIndex} OR district ILIKE $${paramIndex} OR city ILIKE $${paramIndex})`);
       values.push(`%${params.query}%`);
@@ -223,6 +230,7 @@ export class PrismaProjectDevelopmentRepository implements IProjectRepository {
         suitableFor: row.suitableFor ?? [],
         whyThisLocation: row.whyThisLocation,
         isVerified: row.isVerified,
+        ownerId: row.ownerId,
       },
       row.createdAt,
       row.updatedAt,
@@ -250,6 +258,7 @@ export class PrismaProjectDevelopmentRepository implements IProjectRepository {
       suitableFor: row.suitableFor ?? [],
       whyThisLocation: row.whyThisLocation,
       isVerified: row.isVerified,
+      ownerId: row.ownerId,
       latitude: Number(row.lat),
       longitude: Number(row.lng),
       propertyCount: row.propertyCount ?? 0,
@@ -309,6 +318,7 @@ interface RawProject {
   suitableFor: string[] | null;
   whyThisLocation: string | null;
   isVerified: boolean;
+  ownerId: string | null;
   createdAt: Date;
   updatedAt: Date;
 }

apps/api/src/modules/projects/presentation/controllers/projects.controller.ts

@@ -2,12 +2,15 @@ import { Body, Controller, Delete, Get, Param, Patch, Post, Query, UseGuards } f
 import { CommandBus, QueryBus } from '@nestjs/cqrs';
 import { ApiBearerAuth, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
 import { UserRole } from '@prisma/client';
-import { JwtAuthGuard, Roles, RolesGuard } from '@modules/auth';
+import { CurrentUser, JwtAuthGuard, Roles, RolesGuard } from '@modules/auth';
+import type { JwtPayload } from '@modules/auth';
 import { NotFoundException } from '@modules/shared';
 import { CreateProjectCommand } from '../../application/commands/create-project/create-project.command';
 import { DeleteProjectCommand } from '../../application/commands/delete-project/delete-project.command';
 import { UpdateProjectCommand } from '../../application/commands/update-project/update-project.command';
 import { GetProjectQuery } from '../../application/queries/get-project/get-project.query';
+import { type ProjectStats } from '../../application/queries/get-project-stats/get-project-stats.handler';
+import { GetProjectStatsQuery } from '../../application/queries/get-project-stats/get-project-stats.query';
 import { ListProjectsQuery } from '../../application/queries/list-projects/list-projects.query';
 import { CreateProjectDto } from '../dto/create-project.dto';
 import { SearchProjectsDto } from '../dto/search-projects.dto';
@@ -78,6 +81,64 @@ export class ProjectsController {
     return { ...result, data: result.data.map(shapeProject) };
   }
 
+  // ── Developer (CĐT) endpoints ─────────────────────────────────────
+
+  @ApiOperation({
+    summary: 'Dự án của tôi (CĐT)',
+    description: 'Danh sách dự án mà user hiện tại là chủ đầu tư. ADMIN dùng endpoint này để xem tất cả dự án mình đã được gán.',
+  })
+  @ApiResponse({ status: 200, description: 'Danh sách dự án đã lọc theo owner' })
+  @ApiResponse({ status: 401, description: 'Chưa xác thực' })
+  @ApiResponse({ status: 403, description: 'Không có quyền' })
+  @ApiBearerAuth('JWT')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles(UserRole.DEVELOPER, UserRole.ADMIN)
+  @Get('mine/list')
+  async listMyProjects(
+    @CurrentUser() user: JwtPayload,
+    @Query() dto: SearchProjectsDto,
+  ) {
+    const result = await this.queryBus.execute<
+      ListProjectsQuery,
+      { data: RawProjectListItem[]; total: number; page: number; limit: number; totalPages: number }
+    >(
+      new ListProjectsQuery(
+        dto.q,
+        dto.status,
+        dto.city,
+        dto.district,
+        dto.developer,
+        dto.isVerified,
+        dto.page ?? 1,
+        dto.limit ?? 20,
+        user.sub,
+      ),
+    );
+    return { ...result, data: result.data.map(shapeProject) };
+  }
+
+  @ApiOperation({
+    summary: 'Thống kê dự án (CĐT / admin)',
+    description:
+      'Trả về số listings, inquiries (chưa đọc), users đã lưu. Admin xem được mọi dự án; DEVELOPER chỉ xem được dự án của mình.',
+  })
+  @ApiResponse({ status: 200, description: 'Thống kê dự án' })
+  @ApiResponse({ status: 401, description: 'Chưa xác thực' })
+  @ApiResponse({ status: 403, description: 'Không có quyền' })
+  @ApiResponse({ status: 404, description: 'Không tìm thấy dự án' })
+  @ApiBearerAuth('JWT')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles(UserRole.DEVELOPER, UserRole.ADMIN)
+  @Get(':id/stats')
+  async getProjectStats(
+    @CurrentUser() user: JwtPayload,
+    @Param('id') id: string,
+  ): Promise<ProjectStats> {
+    return this.queryBus.execute(
+      new GetProjectStatsQuery(id, user.sub, user.role as UserRole),
+    );
+  }
+
   @ApiOperation({ summary: 'Chi tiết dự án', description: 'Xem chi tiết dự án theo slug hoặc ID' })
   @ApiResponse({ status: 200, description: 'Thông tin chi tiết dự án' })
   @ApiResponse({ status: 404, description: 'Không tìm thấy dự án' })
@@ -94,16 +155,22 @@ export class ProjectsController {
 
   // ── Admin endpoints ───────────────────────────────────────────────
 
-  @ApiOperation({ summary: 'Tạo dự án (admin)', description: 'Tạo mới dự án bất động sản' })
+  @ApiOperation({ summary: 'Tạo dự án', description: 'Admin tạo dự án tuỳ ý; CĐT (DEVELOPER) tạo dự án của mình (tự động gán ownerId).' })
   @ApiResponse({ status: 201, description: 'Dự án đã tạo' })
   @ApiResponse({ status: 400, description: 'Validation error' })
   @ApiResponse({ status: 401, description: 'Chưa xác thực' })
   @ApiResponse({ status: 403, description: 'Không có quyền' })
   @ApiBearerAuth('JWT')
   @UseGuards(JwtAuthGuard, RolesGuard)
-  @Roles(UserRole.ADMIN)
+  @Roles(UserRole.ADMIN, UserRole.DEVELOPER)
   @Post()
-  async createProject(@Body() dto: CreateProjectDto) {
+  async createProject(
+    @CurrentUser() user: JwtPayload,
+    @Body() dto: CreateProjectDto,
+  ) {
+    // DEVELOPER callers own what they create; admin may pass ownerId in DTO
+    // (not yet exposed — use PATCH to reassign) or leave unassigned.
+    const ownerId = user.role === UserRole.DEVELOPER ? user.sub : null;
     return this.commandBus.execute(
       new CreateProjectCommand(
         dto.name,
@@ -133,23 +200,30 @@ export class ProjectsController {
         dto.completionDate ? new Date(dto.completionDate) : null,
         dto.suitableFor ?? [],
         dto.whyThisLocation ?? null,
+        ownerId,
       ),
     );
   }
 
-  @ApiOperation({ summary: 'Cập nhật dự án (admin)', description: 'Cập nhật thông tin dự án' })
+  @ApiOperation({ summary: 'Cập nhật dự án', description: 'Admin cập nhật bất kỳ dự án nào; CĐT (DEVELOPER) chỉ cập nhật dự án mình làm chủ.' })
   @ApiResponse({ status: 200, description: 'Dự án đã cập nhật' })
   @ApiResponse({ status: 401, description: 'Chưa xác thực' })
   @ApiResponse({ status: 403, description: 'Không có quyền' })
   @ApiResponse({ status: 404, description: 'Không tìm thấy tài nguyên' })
   @ApiBearerAuth('JWT')
   @UseGuards(JwtAuthGuard, RolesGuard)
-  @Roles(UserRole.ADMIN)
+  @Roles(UserRole.ADMIN, UserRole.DEVELOPER)
   @Patch(':id')
-  async updateProject(@Param('id') id: string, @Body() dto: UpdateProjectDto) {
+  async updateProject(
+    @CurrentUser() user: JwtPayload,
+    @Param('id') id: string,
+    @Body() dto: UpdateProjectDto,
+  ) {
     return this.commandBus.execute(
       new UpdateProjectCommand(
         id,
+        user.sub,
+        user.role as UserRole,
         dto.name,
         dto.developer,
         dto.developerLogo,
@@ -174,21 +248,27 @@ export class ProjectsController {
         dto.completionDate !== undefined ? (dto.completionDate ? new Date(dto.completionDate) : null) : undefined,
         dto.suitableFor,
         dto.whyThisLocation,
+        dto.ownerId,
       ),
     );
   }
 
-  @ApiOperation({ summary: 'Xóa dự án (admin)', description: 'Xóa vĩnh viễn dự án bất động sản' })
-  @ApiResponse({ status: 200, description: 'Dự án đã xóa' })
+  @ApiOperation({ summary: 'Xoá dự án', description: 'Admin xoá bất kỳ dự án nào; CĐT (DEVELOPER) chỉ xoá dự án của mình.' })
+  @ApiResponse({ status: 200, description: 'Dự án đã xoá' })
   @ApiResponse({ status: 401, description: 'Chưa xác thực' })
   @ApiResponse({ status: 403, description: 'Không có quyền' })
   @ApiResponse({ status: 404, description: 'Không tìm thấy tài nguyên' })
   @ApiBearerAuth('JWT')
   @UseGuards(JwtAuthGuard, RolesGuard)
-  @Roles(UserRole.ADMIN)
+  @Roles(UserRole.ADMIN, UserRole.DEVELOPER)
   @Delete(':id')
-  async deleteProject(@Param('id') id: string): Promise<{ success: true }> {
-    await this.commandBus.execute(new DeleteProjectCommand(id));
+  async deleteProject(
+    @CurrentUser() user: JwtPayload,
+    @Param('id') id: string,
+  ): Promise<{ success: true }> {
+    await this.commandBus.execute(
+      new DeleteProjectCommand(id, user.sub, user.role as UserRole),
+    );
     return { success: true };
   }
 }

apps/api/src/modules/projects/presentation/dto/update-project.dto.ts

@@ -55,4 +55,10 @@ export class UpdateProjectDto {
   @ApiPropertyOptional() @IsOptional() @IsBoolean() isVerified?: boolean;
   @ApiPropertyOptional() @IsOptional() @IsDateString() startDate?: string | null;
   @ApiPropertyOptional() @IsOptional() @IsDateString() completionDate?: string | null;
+
+  @ApiPropertyOptional({
+    description:
+      'Gán / đổi / gỡ CĐT (DEVELOPER user id). Chỉ admin được đổi; null để gỡ.',
+  })
+  @IsOptional() @IsString() ownerId?: string | null;
 }

apps/api/src/modules/projects/projects.module.ts

@@ -4,13 +4,14 @@ import { CreateProjectHandler } from './application/commands/create-project/crea
 import { DeleteProjectHandler } from './application/commands/delete-project/delete-project.handler';
 import { UpdateProjectHandler } from './application/commands/update-project/update-project.handler';
 import { GetProjectHandler } from './application/queries/get-project/get-project.handler';
+import { GetProjectStatsHandler } from './application/queries/get-project-stats/get-project-stats.handler';
 import { ListProjectsHandler } from './application/queries/list-projects/list-projects.handler';
 import { PROJECT_REPOSITORY } from './domain/repositories/project-development.repository';
 import { PrismaProjectDevelopmentRepository } from './infrastructure/repositories/prisma-project-development.repository';
 import { ProjectsController } from './presentation/controllers/projects.controller';
 
 const CommandHandlers = [CreateProjectHandler, UpdateProjectHandler, DeleteProjectHandler];
-const QueryHandlers = [GetProjectHandler, ListProjectsHandler];
+const QueryHandlers = [GetProjectHandler, ListProjectsHandler, GetProjectStatsHandler];
 
 @Module({
   imports: [CqrsModule],