fix blocker 1 - super admin

mvp/test-flows.md

@@ -32,8 +32,8 @@ need to touch that directly except for one step below).
 | `09120000003` | Nurse — مریم احمدی (f) | **Not verified yet** — should never appear in customer search |
 | `09120000010` | Customer — سارا محمدی (f) | 2 people in her care circle, 1 saved address, owns most seeded bookings |
 | `09120000011` | Customer — رضا حسینی (m) | 1 infant patient, owns the installment-plan bookings |
-| `09120000020` | Admin (full) — نگار مدیری (f) | Can log in, but admin actions don't work yet — see [blockers.md](blockers.md) |
-| `09120000021` | Admin (finance) — کامران مالی (m) | Same admin caveat as above |
+| `09120000020` | Admin (super_admin) — نگار مدیری (f) | Real actions now work in review moderation and the support ticket queue; most other admin consoles are still client-side sample data — see [blockers.md](blockers.md) |
+| `09120000021` | Admin (finance) — کامران مالی (m) | Scoped to refunds/payouts/platform-settings consoles; same "most consoles still sample data" caveat as above |
 | `09120000030` | Customer who owns a partner business center — بهنام رستگار (m) | Logs in as a normal customer, then opens the partner section by typing its address directly — nothing in the app links to it |
 
 ---
@@ -49,12 +49,12 @@ need to touch that directly except for one step below).
 3. Read the code as described above and type it in. Expect it to auto-submit and take you to the family home screen (not the nurse page you originally tried).
 4. Repeat with `09120000001` (زهرا عزیزی, nurse). This time you should land on the nurse's "Today's Visits" screen instead.
 5. Try entering a wrong code five times in a row. Expect a lockout message; requesting a new code should still work.
-6. Log in as `09120000020` (نگار مدیری, admin). Login itself succeeds, but admin features don't work (known blocker).
+6. Log in as `09120000020` (نگار مدیری, admin). Login succeeds and lands on the admin home; most admin consoles still show sample data (client-side mock, unrelated to login).
 
 **What you should see:** each account type lands on its correct home screen after login, and a page you tried to reach before logging in is remembered and opened afterward.
 
 **Known issues:**
-- Admin accounts can log in but can't actually do anything yet (known blocker — see [blockers.md](blockers.md))
+- Most admin consoles still show client-side sample data regardless of login (see "Admin backoffice" below)
 - After too many wrong codes, the "try again later" message is wrongly shown as "wrong code"
 - Logging out on one device signs that account out everywhere, with no option to choose just one device
 
@@ -344,19 +344,21 @@ The screens you'll see show fake numbers, not what you would actually get back.
 - Think twice before pressing the final "confirm cancellation" button on a demo account's only remaining bookings — it permanently cancels them for everyone testing with that account
 
 ### Rating and reviewing a nurse after a visit
-**Who tests this:** customers (write a review); admins (approve reviews — currently broken); anyone (reads published reviews)
+**Who tests this:** customers (write a review); admins (approve reviews); anyone (reads published reviews)
 **Status today:** ⚠️ Works, but has known issues
 
 1. Log in as سارا محمدی (`09120000010`).
 2. Go to Bookings — only one completed booking shows a "write a review" (ثبت نظر) button; the others already have a review or aren't eligible.
 3. Tap it, give a 1–5 star rating, optionally add a note and pick some tags, then submit — a notice warns it must be approved before anyone else can see it.
 4. The screen then shows your review as "pending review" (در انتظار بررسی) — this part is genuinely real and saved.
-5. Check a nurse's profile "Reviews" tab — only already-approved reviews show up; yours won't appear, because it's stuck waiting on approval.
+5. Check a nurse's profile "Reviews" tab — only already-approved reviews show up; yours won't appear yet.
+6. Log in as `09120000020` (نگار مدیری, super_admin) and open the review moderation queue (`/fa/admin/reviews`). Expect your pending review to show up for real, with approve/reject actions that now actually work.
+7. Approve it, then re-check the nurse's profile "Reviews" tab — it should now appear.
 
-**What you should see:** submitting a review actually works for real, but it never becomes publicly visible in this demo because the approval step is broken.
+**What you should see:** submitting a review, approving it as admin, and seeing it go live are all genuinely real and connected end-to-end.
 
 **Known issues:**
-- Reviews can never actually get published yet — stuck waiting on admin approval, which is broken (known blocker — see [blockers.md](blockers.md))
+- `ReviewModerationStatus.Rejected` is reachable only through this admin action — the submit-time banned-word filter maps to "hidden," not "rejected"
 - A nurse has no screen yet to see reviews written about them
 
 ### Nurse earnings and payouts
@@ -390,12 +392,11 @@ Everything on these screens is fake, even though real payout numbers do exist be
 3. Open the support conversation. Expect just the customer/staff messages — any internal staff-only notes never appear here.
 4. Type a reply and send it. Expect it to appear immediately, then confirm as sent.
 5. Log in as the nurse, `09120000001` (زهرا عزیزی), and open her support/messages page — same kind of list, nurse's own threads.
-6. Log in as an admin (`09120000020`) and try the admin support-queue page. Expect it to fail with an access-denied error (known blocker).
+6. Log in as an admin (`09120000020`, super_admin) and open the admin support-queue page. Expect the real ticket list to load and a conversation to open.
 
-**What you should see:** customers and nurses can view and reply to their own threads normally; the admin/staff side of messaging is currently unreachable.
+**What you should see:** customers, nurses, and now the admin/staff side all view and reply to threads for real.
 
 **Known issues:**
-- Admin ticket queue and admin view of a conversation are broken (access denied) (known blocker — see [blockers.md](blockers.md))
 - The little unread-messages counter in the header never lights up
 - The inbox list doesn't show a preview of the latest message
 - Auto-created booking conversations start completely empty, with nothing explaining what they're for
@@ -425,22 +426,22 @@ Everything on these screens is fake, even though real payout numbers do exist be
 
 ### Admin backoffice
 **Who tests this:** admin accounts (super_admin and finance)
-**Status today:** ❌ Mostly fake/broken — not really testable yet
+**Status today:** ⚠️ Two consoles are real; the rest is still a client-side mock
 
-Right now every admin account gets an "access denied" error on essentially every real admin action on the
-server — this is one of the biggest known blockers. The admin screens in the app look fully populated and
-functional, but that's because almost all of them are showing made-up sample data built into the app, not
-real information. If that fake layer weren't there, clicking any real action would fail with access denied.
+The server-side permission bug that blocked every admin action is fixed. Two consoles were already wired to
+a real (non-admin-mock) domain and now work end-to-end: review moderation and the support ticket queue. The
+other admin sections still render from `client/src/services/admin`'s built-in sample data regardless of who's
+logged in — that's a separate, larger de-mock effort tracked per-console in
+[fix-plan.md](fix-plan.md) (phases 09–14 touch the ones that matter most).
 
 1. Log in as an admin, either `09120000020` (نگار مدیری, super_admin) or `09120000021` (کامران مالی, finance).
-2. Browse the admin sections: nurse verification, review moderation, payouts, refunds, support tickets/alerts, platform settings, holidays, audit log, and partner centers.
-3. Expect most sections to show full, editable-looking data, and "saving" a change to appear to work — but this is all fake, local sample data, not connected to the real system.
-4. Two sections (the ticket queue and review moderation) actually try to reach the server, and both show a visible error instead of data.
+2. Open review moderation (`/fa/admin/reviews`) and the support ticket queue (`/fa/admin/tickets`) — both load real data and their actions (approve/reject a review, reply to/close a ticket) actually work.
+3. Browse the rest: nurse verification, payouts, refunds, support alerts, platform settings, holidays, audit log, and partner centers. Expect full, editable-looking data, and "saving" a change to appear to work — but this is still fake, local sample data, not connected to the real system.
 
-**What you should see:** a good-looking dashboard that mostly isn't real. Only two screens honestly show that something is broken; the rest hide it.
+**What you should see:** review moderation and the ticket queue behave like a normal, working admin tool; every other section still looks real but isn't connected yet.
 
 **Known issues:**
-- Admin accounts can't do anything for real yet (known blocker — see [blockers.md](blockers.md))
+- 19 of 21 admin consoles still show client-side sample data, not the real system (see [fix-plan.md](fix-plan.md))
 - The "user directory" and "roles" admin screens have no real data behind them at all
 
 ### Partner center
@@ -473,7 +474,7 @@ This section is 100% fake demo data — there's no real business-center account
 5. Edit your personal info (e.g. last name) and save. Expect a "saved" confirmation and the name to update on screen.
 6. Tap sign out («خروج از حساب») and confirm. Expect to land on the login screen, with that account fully signed out everywhere, not just this device.
 7. Log in as the nurse, `09120000001` (زهرا عزیزی), and open her account/settings menu. Expect similar settings, but sign-out here happens on a single tap with no confirmation — be careful.
-8. As an admin, the account page shows a broken, untranslated label for the admin's role, and every admin section link on it leads to an access-denied error (known blocker).
+8. As an admin, the account page shows a broken, untranslated label for the admin's role. Admin section links now open normally (most render sample data rather than erroring — see "Admin backoffice" above).
 9. The partner account page is only reachable by typing its address manually and shows a fake business name (known blocker).
 
 **What you should see:** appearance, language switching, editing personal info, and sign-out all genuinely work for a customer and nurse; admin and partner settings inherit the blockers from those areas.