title: Superadmin control surface spec and access matrix

description: Define the minimal superadmin control surface, permissions, and mapping to tenant/guest responsibilities. Document scope and non-goals.

status: tombstone

issue_type: task

close_reason: Duplicate of fotospiel-app-ihd after beads re-init

deleted_by: soeren

delete_reason: Remove stray stealth issue id

original_type: task


title: Tenant announcements / release notes

description: Broadcast announcements to tenants/admins with targeting and scheduling.

status: closed

issue_type: feature

close_reason: Closed


title: SEC-BILL-02 Signature freshness + retry policies for Paddle webhooks

status: open

created_by: soeren


title: Tenant admin onboarding: inline checkout integration in welcome flow

close_reason: Completed in codebase (verified)


title: Paddle migration: design Paddle data mappings for packages/products/prices


title: Coupon ops: expand fraud tooling with IP/device reputation


title: Paddle catalog sync: SyncPackageToPaddle job create/update


title: Security review: payments/webhooks code audit (signatures, idempotency, linkage)


title: Paddle catalog sync: PackageResource sync status badges + timestamp


title: Security review: marketing/API controller+validation review


title: Security review checklist: Guest PWA dynamic tests


title: Paddle catalog sync: surface last sync error/log context in admin

close_reason: Completed


title: SEC-API-03 Synthetic monitoring + alert config


title: Security review: event admin code audit (policies, PKCE, file handling)


title: SEC-BILL-03 Failed capture notifications + ledger hook


title: Security review: map roles/data


title: SEC-IO-02 Refresh-token management UI + audit logs

close_reason: Obsolete: authentication now uses Sanctum PATs; OAuth/refresh-token tables removed and no refresh-token flow remains. See docs/archive/prp/13-backend-authentication.md and docs/archive/prp/marketing-checkout-payment-architecture.md.


title: Tenant admin onboarding: add Paddle error UX + test coverage


title: Paddle catalog sync: extend PaddleClient tests/mocks for catalog endpoints

close_reason: Deprioritized


title: Tenant admin onboarding: legacy asset audit + component inventory


title: Paddle catalog sync: PaddleCatalogService scaffold


title: Fix staging coupon seed 500 for E2E


title: Security review: confirm env/header defaults


title: Localized SEO: canonical/hreflang tags + localized navigation


title: Ensure checkout step 3 requires login for Paddle checkout

description: Problem: Paddle checkout on step 3 fails when user is not logged in. Step 3 must enforce authentication before initializing Paddle checkout.\n\nSuggestions:\n- Protect step 3 route/controller with auth middleware and redirect to login with intended return URL.\n- Gate step 3 UI/CTA on auth state; show inline login prompt and disable Paddle until authenticated.\n- Require auth in backend endpoint that creates Paddle transaction/session; return 401 and send user to login.\n- Optionally preflight at end of step 2 to prompt login before advancing.


title: SEC-FE-01 CSP nonce/hashing rollout

close_reason: Completed in codebase (verified) - duplicate of fotospiel-app-zli


title: Coupon ops enhancements (redemption service, preview endpoint, widget, export)


title: Security review: media pipeline code audit (AV/EXIF, signed URLs, storage separation)


title: Paddle migration: register sandbox webhooks + document events consumed


title: Paddle migration: extend config/env handling for Paddle keys/webhook secrets


title: Paddle catalog sync: PaddlePackagePull job


title: Paddle migration: admin catalog sync UI for packages


title: Paddle migration: marketing checkout uses Paddle-hosted checkout


title: Fix German welcome phrasing with article-safe app_name


title: Security review checklist: Marketing/API dynamic tests


title: Paddle migration: review current billing implementation


title: SEC-API-02 Public API incident response playbook


title: SEC-FE-02 Consent-gated analytics loader


title: Ops mail default + withdrawal legal routes


title: Paddle migration: define mobile/native billing strategy (RevenueCat vs Paddle)


title: Tenant admin onboarding: update PRP/docs + handoff notes


title: Guest policy settings (toggles, rate limits, retention defaults)

description: Global guest feature toggles, rate limits, and retention defaults. Settings page + persistence.

notes: Fix: WatermarkSettingsPage now defines form(Schema ) to register . Ran vendor/bin/pint --dirty and php artisan test tests/Unit/SuperAdminNavigationGroupsTest.php.


title: Security review checklist: Media pipeline/storage dynamic tests


title: Security review: trust boundaries/entrypoints mapped


title: SEC-IO-01 Document PAT revocation/rotation playbook


title: Superadmin control surface roadmap

description: Roadmap to implement practical superadmin control over tenant admin + guest experience. Tracks lifecycle, moderation, policies, ops health, compliance, audit, announcements, integrations.

issue_type: epic

issue_id: fotospiel-app-bit

depends_on_id: fotospiel-app-ihd

type: blocks

depends_on_id: fotospiel-app-wde

depends_on_id: fotospiel-app-hbt

depends_on_id: fotospiel-app-arp

depends_on_id: fotospiel-app-tym

depends_on_id: fotospiel-app-sbs

depends_on_id: fotospiel-app-iyc

depends_on_id: fotospiel-app-lqp


title: Checkout refactor: auth/login/register flow alignment


title: Paddle catalog sync: unit tests for service + jobs


title: Checkout refactor: Stripe/Paddle payment integration + webhooks


title: Paddle catalog sync: migration for paddle sync columns


title: Paddle catalog sync: configure log channel/Slack hook for sync outcomes


title: Integrations health: unified Paddle/RevenueCat/webhook status dashboard

description:
Add a superadmin integrations health dashboard for Paddle/RevenueCat/webhooks.
Scope: show latest webhook processing status/lag, recent failures, retry backlog, and config presence (env set) without exposing secrets.
Include per-provider status badges and time-window filters, plus links to related logs/actions.


title: Superadmin control surface spec and access matrix


title: SEC-API-01 Signed URL middleware + asset migration


title: SEC-BILL-01 Checkout session linkage + idempotency locks


title: Security review checklist: Event Admin dynamic tests


title: SEC-IO-03 Subnet/device matching config + tests

close_reason: Obsolete: subnet/device matching was tied to legacy OAuth/refresh-token approach; current auth is Sanctum PAT-only with no device/subnet binding in code/config.


title: SEC-MS-03 Checksum validation + alert thresholds


title: Tenant admin onboarding: welcome flow + routing guard + UI steps


title: Security review: guest PWA code audit (join tokens, uploads, SW cache)


title: SEC-MS-04 Storage health widget in Super Admin


title: Paddle migration: automated tests for checkout/webhooks/sync


title: Localized SEO: validate hreflang via Search Console/Lighthouse


title: Moderation queue for guest content

description: Queue for flagged guest content (photos, feedback). Bulk actions to hide/delete/resolve with audit.

notes: Land the plane: tests run (FilamentPanelNavigationTest, PhotoModerationQueueTest, TenantFeedbackModerationQueueTest, TenantLifecycle*), migrations added for photo + feedback moderation, no follow-up blockers.


notes: Added superadmin control surface + access matrix to docs/ops/operations-manual.md (Section 1.1), including non-goals and role scope.


title: Legal: disclose checkout/coupon fraud IP/device signals

description: Update Legal Pages (privacy policy) to disclose IP/device capture for coupon fraud signals and retention window.


title: Superadmin audit log for admin actions

description: Audit trail for superadmin actions without PII payloads.


title: Security review follow-ups: signed URL TTLs, guest asset throttles, CORS allowlist, logging hygiene


title: Checkout refactor: CheckoutController + marketing route alignment


title: Tenant admin onboarding: Playwright skeleton for welcome flow


title: Security review checklist: Webhooks/Billing dynamic tests


title: Paddle catalog sync: add DTO helpers for Paddle product/price responses


title: SEC-MS-02 Streaming upload refactor + tests

description:
Current state (code scan)
- Guest uploads: App\\Http\\Controllers\\Api\\EventPublicController@upload uses Storage::disk()->putFile (stream-friendly) but still does watermark/thumbnail work inline.
- Tenant admin uploads: App\\Http\\Controllers\\Api\\Tenant\\PhotoController@store and @uploadDirect use Storage::disk()->put($path, file_get_contents(...)) which loads entire file into memory.
- Photobooth ingest already streams from import disk via readStream -> Storage::disk()->put($path, $stream).
- Presigned upload flow is stubbed to a local upload-direct endpoint; no true presigned S3 handling yet.
- No tenant upload feature tests exist; guest upload tests exist and cover limits/security.

Goal
- Stream uploads to disk (avoid full in-memory buffers) for tenant-admin upload endpoints and keep behavior consistent across sources.

Plan
1) Introduce a small streaming upload helper/service
   - New service (e.g. App\\Services\\Storage\\UploadStreamService) that accepts UploadedFile + disk + destination path.
   - Use fopen on UploadedFile::getRealPath (or $file->getStream()) and Storage::disk($disk)->put($path, $stream) / writeStream.
   - Always close stream; return stored size and checksum (hash_file on stored path) for asset metadata.

2) Refactor tenant upload endpoints to use streaming
   - Update PhotoController@store and @uploadDirect to use the helper instead of file_get_contents.
   - Use Storage::disk()->putFileAs (or helper) to preserve deterministic paths without buffering.
   - Keep existing validation, watermark, thumbnail, asset recording, and package usage logic.

3) Optional consistency pass on guest upload
   - Consider routing EventPublicController@upload through the same helper for consistent storage + checksum handling, while keeping current validation/limits.

4) Tests
   - Add Feature tests for tenant upload endpoints:
     - /api/v1/tenant/events/{slug}/photos (store) uploads a fake image and persists Photo + EventMediaAsset with expected path/size.
     - /api/v1/tenant/events/{slug}/upload-direct (presigned) uploads a fake image and stores asset + thumbnail.
   - Ensure existing guest upload tests still pass (no behavioral changes).

5) Safety/ops
   - Verify streaming logic handles empty/invalid files gracefully and still reports errors via ApiError.
   - Keep request-time processing (thumb/watermark) unchanged for now; consider queuing in a follow-up if CPU spikes persist.


title: Paddle customer success metrics (tenant ↔ Paddle sync, sandbox seeding, rollout/rollback)


title: Session changes 2025-09-08 (PRP split, PWA scaffolding, Filament resources, API)


title: Registration flow fixes: JSON redirect, error clearing, role handling


title: SEC-GT-02 Join-token analytics dashboard (Grafana)

description: Logging + Filament summaries exist; Grafana dashboard still missing.


title: Paddle catalog sync: announce workflow change to admin users


title: SEC-GT-01 Hash join tokens + data migration


title: Integrations health (Paddle/RevenueCat/webhooks)

description: Health/status dashboard for payment and webhook integrations.


title: SEC-GT-03 Tighten gallery/photo rate limits + alerting


title: Coupon ops: wire analytics into Matomo dashboard


title: Checkout refactor: test coverage + rollout notes


title: Localized SEO: sitemap updated with locale alternates


title: Security review: configure env assumptions for dynamic testing


title: Paddle migration: draft production cutover procedure


title: Paddle catalog sync: add Link existing Paddle entity action in admin


title: Paddle catalog sync: Package model casts/fillable + factory


title: Audit PayPal SDK migration doc vs code (PayPal integration missing)


title: Paddle catalog sync: seed sandbox catalog via MCP

close_reason: Not needed


title: Paddle catalog sync: Playwright smoke for admin sync action


title: Paddle migration: tenant admin billing pages (Paddle transactions/portal)


title: Security review: seed test identities/fixtures


title: Security review: route/middleware inventory for marketing/API


title: Security review checklist: Cross-cutting headers/CSRF/rate limits


title: Checkout refactor: wizard foundations + updated steps


title: Legal: disclose checkout/coupon fraud IP/device signals


title: Paddle catalog sync: verify legacy packages mapped before auto-sync


title: Security review kickoff mitigations (CORS allowlist, headers, upload hardening, signed URLs)


title: Compliance tools: data export + retention overrides

description: GDPR-compliant export requests and retention override workflows for tenants/events.


title: Security review: replace public asset URLs with signed routes


title: Tenant admin onboarding: staging E2E validation


title: Security review: data classes & retention baseline


title: Ops health dashboard (queues, storage, upload pipeline)

description: Superadmin ops dashboard showing queue backlog, failed jobs, storage thresholds, and upload pipeline health.

notes: Implemented Ops Health dashboard with storage+queue widgets, new translations, and navigation wiring.


title: Paddle catalog sync: feature test for artisan command


title: Paddle migration: build Paddle API service layer


title: SEC-MS-01 AV + EXIF scrubber worker integration


title: Localized SEO: locale-prefixed routing + redirects


title: Paddle migration: seed sandbox catalog via MCP + validate activation flow


title: Localized SEO: add tests for hreflang/canonical tags


title: Localized SEO: update PRP/marketing playbooks for hreflang strategy


title: Registration flow fixes: JSON redirect, error clearing, role handling

close_reason: Duplicate of fotospiel-app-l6a


title: SEC-FE-03 Cookie banner UX + localisation


title: Paddle catalog sync: document failure recovery playbook


title: Tenant lifecycle controls (status, limits, suspend/grace)

description: Superadmin controls for tenant status, grace periods, and hard limits (uploads/storage/events). Includes UI, policy checks, and audit events.

notes: Delivered dedicated tenant lifecycle view with limits + audit timeline, added grace_period_ends_at field and tenant_lifecycle_events logging, wired lifecycle actions (activate/suspend/deletion/anonymize) + management actions (limits, grace, subscription expiry), enforced tenant photo/storage limits in PackageLimitEvaluator, added lifecycle/limits tests, ran Pint + targeted tests.


title: Paddle catalog sync: paddle:sync-packages command (dry-run/pull)


title: Security review: run dynamic testing harness (identities, DAST, fuzz uploads)


title: Paddle migration: tenant ↔ Paddle customer sync + webhook handlers


title: Compliance tools: superadmin data export + retention override UI

description:
Add superadmin compliance tools for data exports and retention overrides.
Scope: list export requests, status, expiry, and allow manual retry/cancel; add per-tenant/event retention override UI with audit logging.
Ensure access is restricted to superadmins and no PII is exposed beyond existing export metadata.


title: Ops health widget visual polish

description: Replace Tailwind utility styling in ops health widget with Filament components and icon-driven layout.

notes: Updated queue health widget layout to use Filament cards, badges, empty states, and grid utilities; added status strip and alert rail.

close_reason: completed


title: Tenant admin onboarding: PWA/Capacitor/TWA packaging prep


title: SEC-FE-01 CSP nonce/hashing rollout