# DevhubController

**Kind:** Controller

**Source:** [`atloria-monorepo/apps/api/src/reader-account/devhub.controller.ts`](https://github.com/sherkety/atloria/blob/main/atloria-monorepo/apps/api/src/reader-account/devhub.controller.ts#L17)

C3 owner "Developers" dashboard (PRO+). Org-member plane ONLY: JwtAuthGuard
rejects reader tokens by audience, ResourceOrgGuard pins :id to the caller's
org (fail-closed), PlanGuard enforces

`DevhubController` serves the C3 owner “Developers” dashboard for PRO+ organizations. It operates exclusively in the organization-member plane, using JWT audience validation, organization resource authorization, and plan enforcement before returning developer dashboard data.

## Diagram

```mermaid
graph LR
  Client[Organization Member Client]
  JWT[JwtAuthGuard<br/>Validates org-member JWT audience]
  Org[ResourceOrgGuard<br/>Pins :id to caller organization]
  Plan[PlanGuard<br/>Requires PRO+ plan]
  Controller[DevhubController]
  Service[Developer Dashboard Service]
  Response[Developer Dashboard Response]

  Client --> JWT
  JWT --> Org
  Org --> Plan
  Plan --> Controller
  Controller --> Service
  Service --> Response
```

## Usage

```ts
import request from 'supertest';
import { INestApplication } from '@nestjs/common';

async function getDeveloperDashboard(
  app: INestApplication,
  organizationId: string,
  accessToken: string,
) {
  return request(app.getHttpServer())
    .get(`/reader-account/${organizationId}/devhub`)
    .set('Authorization', `Bearer ${accessToken}`)
    .expect(200);
}

// The token must be an organization-member token for the same organization
// referenced by :id, and the organization must have a PRO+ plan.
const response = await getDeveloperDashboard(
  app,
  'org_123',
  process.env.ORG_MEMBER_JWT!,
);

console.log(response.body);
```

## AI Coding Instructions

- Keep this controller in the organization-member security plane; do not add support for reader-token audiences.
- Preserve guard ordering and behavior: JWT validation must occur before organization resource checks and plan enforcement.
- Any route containing `:id` must continue to rely on `ResourceOrgGuard` to ensure the requested organization matches the caller’s organization.
- Treat PRO+ access as a guard concern; avoid duplicating plan-validation logic inside controller handlers or services.

## Relationships

- MODULE_DECLARES → `summary`
- MODULE_DECLARES → `readers`
- DEPENDS_ON → `DevhubService`

## Referenced By

- `ReaderAccountModule` (MODULE_DECLARES)