Sales Trainer v0.1: corporate sales-training simulator (Flask+Vue, 15 personas, chat simulator, judge, analytics)

- Auth/roles (no self-reg), admin user provision, JWT
- Analyze: sales kit + initial pain-fit from form/upload
- Persona generator: 15 personas (5/tier) w/ pain variety, negotiation, init mode, channel, latent/revealable, wrong_text special
- Chat simulator: per-mode initiation, one-shot, hidden signals, judge-LLM debrief+coaching
- Trainee loop: win/lose board, weak-areas, user-generated personas
- Admin analytics; EN+TH Vue SPA served by Flask
- Deploy: Dockerfile, docker-compose, README, eng-log + HANDOFF
- Tests (mock LLM): m0/m1/routes/e2e all pass

backend/app/api/admin_routes.py

@@ -0,0 +1,88 @@
+"""Admin routes: user provisioning + role management (no self-registration)."""
+from __future__ import annotations
+
+from flask import Blueprint, jsonify, request
+
+from ..auth.users import AuthError
+from ..config import Config
+from .helpers import ApiError, current_user, require_auth, require_roles
+
+admin_bp = Blueprint("admin", __name__)
+
+
+def _store():
+    from flask import current_app
+
+    return current_app.extensions["user_store"]
+
+
+@admin_bp.post("/users")
+@require_auth
+@require_roles("admin")
+def create_user():
+    """Create a user + provision a password (invite). Admin or super-admin only."""
+    data = request.get_json(silent=True) or {}
+    name = (data.get("name") or "").strip()
+    email = (data.get("email") or "").strip().lower()
+    password = data.get("password") or ""
+    role = (data.get("role") or "user").strip()
+    org_id = (data.get("org_id") or current_user().get("org_id") or "org-default").strip()
+
+    if not email or not password:
+        raise ApiError("email and password are required")
+    if role not in Config.ROLES:
+        raise ApiError(f"invalid role: {role}")
+    # Only super_admin can create another admin/super_admin
+    actor_role = current_user().get("role")
+    if role in ("admin", "super_admin") and actor_role != "super_admin":
+        raise ApiError("only super_admin can grant admin roles", 403)
+    try:
+        user = _store().create_user(
+            org_id=org_id, email=email, password=password, name=name, role=role
+        )
+    except AuthError as exc:
+        raise ApiError(str(exc))
+    return jsonify({"user": _store().public_user(user)}), 201
+
+
+@admin_bp.get("/users")
+@require_auth
+@require_roles("admin")
+def list_users():
+    actor = current_user()
+    if actor.get("role") == "super_admin":
+        users = _store().list_users()
+    else:
+        users = _store().list_users(org_id=actor.get("org_id"))
+    return jsonify({"users": users})
+
+
+@admin_bp.put("/users/<email>")
+@require_auth
+@require_roles("admin")
+def update_user(email: str):
+    data = request.get_json(silent=True) or {}
+    email = email.strip().lower()
+    actor = current_user()
+    target = _store().get_user_or_none(email)
+    if not target:
+        raise ApiError("user not found", 404)
+
+    # Role changes / admin-modification restricted to super_admin
+    if "role" in data:
+        role = (data.get("role") or "").strip()
+        if role not in Config.ROLES:
+            raise ApiError(f"invalid role: {role}")
+        if actor.get("role") != "super_admin":
+            raise ApiError("only super_admin can change roles")
+        _store().set_role(email, role)
+
+    if "active" in data:
+        if actor.get("role") != "super_admin":
+            raise ApiError("only super_admin can activate/deactivate users")
+        _store().set_active(email, bool(data.get("active")))
+
+    if "password" in data and data.get("password"):
+        _store().set_password(email, data.get("password"))
+
+    return jsonify({"user": _store().public_user(_store().get_user(email))})