feat(auth): add DEVELOPER + PARK_OPERATOR roles with owner scoping (B2B accounts)

Two new B2B roles for CĐT (project developers) and KCN operators, provisioned by
admin. Each account owns a subset of ProjectDevelopment / IndustrialPark records
and can CRUD them from the dashboard; admin retains full access.

Phase 1 — Schema
- Extend UserRole enum with DEVELOPER + PARK_OPERATOR (before ADMIN)
- ProjectDevelopment.ownerId FK (User, ON DELETE SET NULL) + index
- IndustrialPark.ownerId FK + index
- Migration 20260420030000

Phase 2a — Backend authorization
- CreateProjectCommand + CreateIndustrialParkCommand accept ownerId; controllers
  auto-set it to the caller's user id when role=DEVELOPER / PARK_OPERATOR
- Update + Delete commands gain (requesterUserId, requesterRole) and enforce
  ADMIN-or-owner via ForbiddenException; reassigning ownerId is admin-only
- Search params gain optional ownerId filter wired through Prisma repos
- New endpoints: GET /projects/mine/list, GET /industrial/parks/mine/list
- user-rate-limit guard: add DEVELOPER + PARK_OPERATOR entries (300/window)

Phase 2b — Admin provision
- ProvisionDeveloperCommand/Handler: create user (role=DEVELOPER), pre-validate
  target projects have no existing owner, batch-assign ownerId
- ProvisionParkOperatorCommand/Handler: same for PARK_OPERATOR + IndustrialPark
- POST /admin/accounts/developers, POST /admin/accounts/park-operators (admin-only)
- DTOs with phone/password/fullName/email + optional {project,park}Ids[]

Phase 2c — Project stats for developer dashboard
- GetProjectStatsQuery + handler: aggregates linkedListingCount, activeListingCount,
  totalInquiries, unreadInquiries, savedByUsers via Property → Listing → Inquiry chain
- GET /projects/:id/stats — admin sees all, DEVELOPER only their own (403 otherwise)

Phase 3 — Frontend
- Dashboard layout role-aware: DEVELOPER sees "Dự án của tôi" + CRM + Profile (hides
  listings/analytics/subscription); PARK_OPERATOR sees "KCN của tôi" equivalent
- /projects dashboard page switches to duAnApi.searchMine() when role=DEVELOPER
- /industrial-parks page switches to industrialApi.searchMine() when role=PARK_OPERATOR
- Admin nav gains "Tài khoản CĐT" + "Tài khoản KCN" entries
- New pages /admin/accounts/developers + /admin/accounts/park-operators with
  checkbox-based multi-select for linking entities
- adminApi.provisionDeveloper + provisionParkOperator + types
- duAnApi.searchMine + getStats; industrialApi.searchMine
- Login demo accounts list includes CĐT Vingroup + KCN VSIP

Phase 4 — Seed (prisma/seed-b2b-accounts.ts)
- DEVELOPER "CĐT Vingroup" (+84912000001) owns 4 projects
- DEVELOPER "CĐT Masterise Homes" (+84912000003) owns 2 projects
- PARK_OPERATOR "Vận hành KCN VSIP" (+84912000002) owns 2 seeded KCN
- Password Velik@2026 for all

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/app/[locale]/(dashboard)/industrial-parks/page.tsx

@@ -9,6 +9,7 @@ import { Button } from '@/components/ui/button';
 import { Card, CardContent } from '@/components/ui/card';
 import { Input } from '@/components/ui/input';
 import { Select } from '@/components/ui/select';
+import { useAuthStore } from '@/lib/auth-store';
 import {
   industrialApi,
   PARK_STATUS_COLORS,
@@ -46,6 +47,8 @@ const INITIAL_FILTERS: FiltersState = {
 
 export default function IndustrialParksListPage() {
   const [filters, setFilters] = React.useState<FiltersState>(INITIAL_FILTERS);
+  const role = useAuthStore((s) => s.user?.role);
+  const isOperator = role === 'PARK_OPERATOR';
 
   const queryParams = React.useMemo<SearchIndustrialParksParams>(() => {
     const p: SearchIndustrialParksParams = { page: filters.page, limit: 12 };
@@ -57,8 +60,9 @@ export default function IndustrialParksListPage() {
   }, [filters]);
 
   const { data: result, isLoading } = useQuery({
-    queryKey: ['admin-industrial-parks', queryParams],
-    queryFn: () => industrialApi.search(queryParams),
+    queryKey: ['admin-industrial-parks', { mine: isOperator, ...queryParams }],
+    queryFn: () =>
+      isOperator ? industrialApi.searchMine(queryParams) : industrialApi.search(queryParams),
     staleTime: 30_000,
   });
 

apps/web/app/[locale]/(dashboard)/layout.tsx

@@ -75,56 +75,115 @@ export default function DashboardLayout({ children }: { children: React.ReactNod
     );
   }
 
+  const role = user?.role;
+  const isDeveloper = role === 'DEVELOPER';
+  const isParkOperator = role === 'PARK_OPERATOR';
+  // B2B roles get a focused nav: dashboard + their owned catalog + CRM + profile.
+  // ADMIN / AGENT / SELLER / BUYER keep the full nav.
+  const showListings = !isDeveloper && !isParkOperator;
+  const showProjects = !isParkOperator;
+  const showParks = !isDeveloper;
+
   const navGroups: NavGroup[] = [
     {
       label: t('dashboard.title'),
       items: [
         { href: '/dashboard', label: t('dashboard.title'), icon: Home },
-        { href: '/listings', label: t('dashboard.listings'), icon: List },
-        { href: '/listings/new', label: t('dashboard.createListing'), icon: Plus },
+        ...(showListings
+          ? [
+              { href: '/listings', label: t('dashboard.listings'), icon: List },
+              { href: '/listings/new', label: t('dashboard.createListing'), icon: Plus },
+            ]
+          : []),
       ],
     },
     {
       label: t('dashboard.catalogs'),
       items: [
-        { href: '/projects', label: t('dashboard.manageProjects'), icon: Building2 },
-        { href: '/industrial-parks', label: t('dashboard.manageIndustrialParks'), icon: Factory },
+        ...(showProjects
+          ? [
+              {
+                href: '/projects',
+                label: isDeveloper ? 'Dự án của tôi' : t('dashboard.manageProjects'),
+                icon: Building2,
+              },
+            ]
+          : []),
+        ...(showParks
+          ? [
+              {
+                href: '/industrial-parks',
+                label: isParkOperator
+                  ? 'KCN của tôi'
+                  : t('dashboard.manageIndustrialParks'),
+                icon: Factory,
+              },
+            ]
+          : []),
       ],
     },
     {
       label: 'CRM',
       items: [
         { href: '/inquiries', label: t('dashboard.inquiries'), icon: MessageSquare },
-        { href: '/leads', label: t('dashboard.leads'), icon: Target },
-      ],
-    },
-    {
-      label: t('dashboard.analytics'),
-      items: [
-        { href: '/analytics', label: t('dashboard.analytics'), icon: BarChart3 },
-        { href: '/dashboard/reports', label: t('dashboard.reports'), icon: FileText },
-        { href: '/dashboard/saved-searches', label: t('dashboard.savedSearches'), icon: Bookmark },
-        { href: '/dashboard/valuation', label: t('dashboard.aiValuation'), icon: Bot },
+        ...(showListings
+          ? [{ href: '/leads', label: t('dashboard.leads'), icon: Target }]
+          : []),
       ],
     },
+    ...(showListings
+      ? [
+          {
+            label: t('dashboard.analytics'),
+            items: [
+              { href: '/analytics', label: t('dashboard.analytics'), icon: BarChart3 },
+              { href: '/dashboard/reports', label: t('dashboard.reports'), icon: FileText },
+              { href: '/dashboard/saved-searches', label: t('dashboard.savedSearches'), icon: Bookmark },
+              { href: '/dashboard/valuation', label: t('dashboard.aiValuation'), icon: Bot },
+            ],
+          },
+        ]
+      : []),
     {
       label: t('dashboard.profile'),
       items: [
         { href: '/dashboard/profile', label: t('dashboard.profile'), icon: User },
-        { href: '/dashboard/subscription', label: t('dashboard.subscription'), icon: Gem },
-        { href: '/dashboard/payments', label: t('dashboard.payments'), icon: CreditCard },
+        ...(showListings
+          ? [
+              { href: '/dashboard/subscription', label: t('dashboard.subscription'), icon: Gem },
+              { href: '/dashboard/payments', label: t('dashboard.payments'), icon: CreditCard },
+            ]
+          : []),
       ],
     },
-  ];
+  ].filter((g) => g.items.length > 0);
 
   // Flat list for desktop nav (only primary items shown inline)
   const primaryNav: NavItem[] = [
     { href: '/dashboard', label: t('dashboard.title'), icon: Home },
-    { href: '/listings', label: t('dashboard.listings'), icon: List },
-    { href: '/projects', label: t('dashboard.manageProjects'), icon: Building2 },
-    { href: '/industrial-parks', label: t('dashboard.manageIndustrialParks'), icon: Factory },
+    ...(showListings ? [{ href: '/listings', label: t('dashboard.listings'), icon: List }] : []),
+    ...(showProjects
+      ? [
+          {
+            href: '/projects',
+            label: isDeveloper ? 'Dự án của tôi' : t('dashboard.manageProjects'),
+            icon: Building2,
+          },
+        ]
+      : []),
+    ...(showParks
+      ? [
+          {
+            href: '/industrial-parks',
+            label: isParkOperator ? 'KCN của tôi' : t('dashboard.manageIndustrialParks'),
+            icon: Factory,
+          },
+        ]
+      : []),
     { href: '/inquiries', label: t('dashboard.inquiries'), icon: MessageSquare },
-    { href: '/analytics', label: t('dashboard.analytics'), icon: BarChart3 },
+    ...(showListings
+      ? [{ href: '/analytics', label: t('dashboard.analytics'), icon: BarChart3 }]
+      : []),
   ];
 
   const secondaryNav: NavItem[] = [

apps/web/app/[locale]/(dashboard)/projects/page.tsx

@@ -10,6 +10,7 @@ import { Button } from '@/components/ui/button';
 import { Card, CardContent } from '@/components/ui/card';
 import { Input } from '@/components/ui/input';
 import { Select } from '@/components/ui/select';
+import { useAuthStore } from '@/lib/auth-store';
 import { formatPrice } from '@/lib/currency';
 import {
   duAnApi,
@@ -36,6 +37,8 @@ const INITIAL_FILTERS = {
 
 export default function ProjectsAdminPage() {
   const [filters, setFilters] = React.useState(INITIAL_FILTERS);
+  const role = useAuthStore((s) => s.user?.role);
+  const isDeveloper = role === 'DEVELOPER';
 
   const queryParams = React.useMemo<SearchProjectsParams>(() => {
     const params: SearchProjectsParams = { page: filters.page, limit: 12 };
@@ -46,8 +49,9 @@ export default function ProjectsAdminPage() {
   }, [filters]);
 
   const { data: result, isLoading } = useQuery({
-    queryKey: ['admin-projects', queryParams],
-    queryFn: () => duAnApi.search(queryParams),
+    queryKey: ['admin-projects', { mine: isDeveloper, ...queryParams }],
+    // DEVELOPER sees only their own projects; ADMIN sees all.
+    queryFn: () => (isDeveloper ? duAnApi.searchMine(queryParams) : duAnApi.search(queryParams)),
     staleTime: 30_000,
   });