title: Superadmin control surface spec and access matrix

description: Define the minimal superadmin control surface, permissions, and mapping to tenant/guest responsibilities. Document scope and non-goals.

status: closed

issue_type: task

close_reason: Duplicate of fotospiel-app-ihd after beads re-init


title: Tenant announcements / release notes

description: Broadcast announcements to tenants/admins with targeting and scheduling.

status: open

issue_type: feature


title: SEC-BILL-02 Signature freshness + retry policies for Paddle webhooks

created_by: soeren


title: Tenant admin onboarding: inline checkout integration in welcome flow

close_reason: Completed in codebase (verified)


title: Paddle migration: design Paddle data mappings for packages/products/prices


title: Coupon ops: expand fraud tooling with IP/device reputation


title: Paddle catalog sync: SyncPackageToPaddle job create/update


title: Security review: payments/webhooks code audit (signatures, idempotency, linkage)


title: Paddle catalog sync: PackageResource sync status badges + timestamp


title: Security review: marketing/API controller+validation review


title: Security review checklist: Guest PWA dynamic tests


title: Paddle catalog sync: surface last sync error/log context in admin


title: SEC-API-03 Synthetic monitoring + alert config


title: Security review: event admin code audit (policies, PKCE, file handling)


title: SEC-BILL-03 Failed capture notifications + ledger hook


title: Security review: map roles/data


title: SEC-IO-02 Refresh-token management UI + audit logs


title: Tenant admin onboarding: add Paddle error UX + test coverage


title: Paddle catalog sync: extend PaddleClient tests/mocks for catalog endpoints


title: Tenant admin onboarding: legacy asset audit + component inventory


title: Paddle catalog sync: PaddleCatalogService scaffold


title: Security review: confirm env/header defaults


title: Localized SEO: canonical/hreflang tags + localized navigation


title: SEC-FE-01 CSP nonce/hashing rollout

close_reason: Completed in codebase (verified) - duplicate of fotospiel-app-zli


title: Coupon ops enhancements (redemption service, preview endpoint, widget, export)


title: Security review: media pipeline code audit (AV/EXIF, signed URLs, storage separation)


title: Paddle migration: register sandbox webhooks + document events consumed


title: Paddle migration: extend config/env handling for Paddle keys/webhook secrets


title: Paddle catalog sync: PaddlePackagePull job


title: Paddle migration: admin catalog sync UI for packages


title: Paddle migration: marketing checkout uses Paddle-hosted checkout


title: Security review checklist: Marketing/API dynamic tests


title: Paddle migration: review current billing implementation


title: SEC-API-02 Public API incident response playbook


title: SEC-FE-02 Consent-gated analytics loader


title: Ops mail default + withdrawal legal routes


title: Paddle migration: define mobile/native billing strategy (RevenueCat vs Paddle)


title: Tenant admin onboarding: update PRP/docs + handoff notes


title: Guest policy settings (toggles, rate limits, retention defaults)

description: Global guest feature toggles, rate limits, and retention defaults. Settings page + persistence.


title: Security review checklist: Media pipeline/storage dynamic tests


title: Security review: trust boundaries/entrypoints mapped


title: SEC-IO-01 Document PAT revocation/rotation playbook


title: Superadmin control surface roadmap

description: Roadmap to implement practical superadmin control over tenant admin + guest experience. Tracks lifecycle, moderation, policies, ops health, compliance, audit, announcements, integrations.

issue_type: epic

issue_id: fotospiel-app-bit

depends_on_id: fotospiel-app-ihd

type: blocks

depends_on_id: fotospiel-app-wde

depends_on_id: fotospiel-app-hbt

depends_on_id: fotospiel-app-arp

depends_on_id: fotospiel-app-tym

depends_on_id: fotospiel-app-sbs

depends_on_id: fotospiel-app-iyc

depends_on_id: fotospiel-app-lqp


title: Checkout refactor: auth/login/register flow alignment


title: Paddle catalog sync: unit tests for service + jobs


title: Checkout refactor: Stripe/Paddle payment integration + webhooks


title: Paddle catalog sync: migration for paddle sync columns


title: Paddle catalog sync: configure log channel/Slack hook for sync outcomes


title: Superadmin control surface spec and access matrix


title: SEC-API-01 Signed URL middleware + asset migration


title: SEC-BILL-01 Checkout session linkage + idempotency locks


title: Security review checklist: Event Admin dynamic tests


title: SEC-IO-03 Subnet/device matching config + tests


title: SEC-MS-03 Checksum validation + alert thresholds


title: Tenant admin onboarding: welcome flow + routing guard + UI steps


title: Security review: guest PWA code audit (join tokens, uploads, SW cache)


title: SEC-MS-04 Storage health widget in Super Admin


title: Paddle migration: automated tests for checkout/webhooks/sync


title: Localized SEO: validate hreflang via Search Console/Lighthouse


title: Moderation queue for guest content

description: Queue for flagged guest content (photos, feedback). Bulk actions to hide/delete/resolve with audit.


notes: Spec v1: Superadmin control surface\n\nGoals\n- Practical controls over tenant admin + guest experience (safety, limits, visibility).\n- Fast response to abuse/outages without deploys.\n- GDPR-safe: no new PII logging; audit log stores action metadata only.\n\nNon-goals\n- New tracking beyond anonymous guest session_id.\n- Deep analytics beyond operational KPIs.\n\nAccess matrix (high-level)\n- Guest: upload/like/join per event only, no admin privileges.\n- Tenant Admin: manage their events/photos/tasks; no cross-tenant access.\n- Superadmin: global visibility + override controls + audit trail.\n\nProposed control areas\nDaily Ops\n- Tenant Lifecycle: status (active/suspended/grace), limits (uploads/storage/events), manual overrides.\n- Moderation Queue: flagged photos/feedback; hide/delete/resolve/bulk actions.\n- Support: Tenant feedback triage view.\n\nWeekly Ops\n- Guest Policy: feature toggles + rate limits + retention defaults.\n- Event Access: join token TTL, max uses, invalidate/regenerate.\n- Commercial: packages/addons/coupons/tenant packages.\n\nRare/Admin\n- Ops Health: queues, failed jobs, storage thresholds.\n- Compliance: data export requests + retention overrides.\n- Audit Log: superadmin actions (no PII payloads).\n- Integrations health: Paddle/RevenueCat/webhooks status.\n\nData model considerations\n- Existing JSON fields: tenants.settings/features; events.settings; tenant_feedback.metadata; photos.security_meta.\n- Prefer new tables for auditability: moderation_items, super_admin_audit_logs, data_export_requests, retention_overrides, guest_policy_settings.\n- Tenant lifecycle limits can be a new table (tenant_overrides) or fields on tenants (status, grace_until, limits JSON).\n\nSuccess criteria\n- Each resource renders in superadmin panel without errors.\n- Actions are logged (audit log).\n- Policies enforce tenant isolation + superadmin override.


title: Superadmin audit log for admin actions

description: Audit trail for superadmin actions without PII payloads.


title: Security review follow-ups: signed URL TTLs, guest asset throttles, CORS allowlist, logging hygiene


title: Checkout refactor: CheckoutController + marketing route alignment


title: Tenant admin onboarding: Playwright skeleton for welcome flow


title: Security review checklist: Webhooks/Billing dynamic tests


title: Paddle catalog sync: add DTO helpers for Paddle product/price responses


title: SEC-MS-02 Streaming upload refactor + tests


title: Paddle customer success metrics (tenant ↔ Paddle sync, sandbox seeding, rollout/rollback)


title: Session changes 2025-09-08 (PRP split, PWA scaffolding, Filament resources, API)


title: Registration flow fixes: JSON redirect, error clearing, role handling


title: SEC-GT-02 Join-token analytics dashboard (Grafana)

description: Logging + Filament summaries exist; Grafana dashboard still missing.


title: Paddle catalog sync: announce workflow change to admin users


title: SEC-GT-01 Hash join tokens + data migration


title: Integrations health (Paddle/RevenueCat/webhooks)

description: Health/status dashboard for payment and webhook integrations.


title: SEC-GT-03 Tighten gallery/photo rate limits + alerting


title: Coupon ops: wire analytics into Matomo dashboard


title: Checkout refactor: test coverage + rollout notes


title: Localized SEO: sitemap updated with locale alternates


title: Security review: configure env assumptions for dynamic testing


title: Paddle migration: draft production cutover procedure


title: Paddle catalog sync: add Link existing Paddle entity action in admin


title: Paddle catalog sync: Package model casts/fillable + factory


title: Audit PayPal SDK migration doc vs code (PayPal integration missing)


title: Paddle catalog sync: seed sandbox catalog via MCP


title: Paddle catalog sync: Playwright smoke for admin sync action


title: Paddle migration: tenant admin billing pages (Paddle transactions/portal)


title: Security review: seed test identities/fixtures


title: Security review: route/middleware inventory for marketing/API


title: Security review checklist: Cross-cutting headers/CSRF/rate limits


title: Checkout refactor: wizard foundations + updated steps


title: Paddle catalog sync: verify legacy packages mapped before auto-sync


title: Security review kickoff mitigations (CORS allowlist, headers, upload hardening, signed URLs)


title: Compliance tools: data export + retention overrides

description: GDPR-compliant export requests and retention override workflows for tenants/events.


title: Security review: replace public asset URLs with signed routes


title: Tenant admin onboarding: staging E2E validation


title: Security review: data classes & retention baseline


title: Ops health dashboard (queues, storage, upload pipeline)

description: Superadmin ops dashboard showing queue backlog, failed jobs, storage thresholds, and upload pipeline health.


title: Paddle catalog sync: feature test for artisan command


title: Paddle migration: build Paddle API service layer


title: SEC-MS-01 AV + EXIF scrubber worker integration


title: Localized SEO: locale-prefixed routing + redirects


title: Paddle migration: seed sandbox catalog via MCP + validate activation flow


title: Localized SEO: add tests for hreflang/canonical tags


title: Localized SEO: update PRP/marketing playbooks for hreflang strategy


title: Registration flow fixes: JSON redirect, error clearing, role handling

close_reason: Duplicate of fotospiel-app-l6a


title: SEC-FE-03 Cookie banner UX + localisation


title: Paddle catalog sync: document failure recovery playbook


title: Tenant lifecycle controls (status, limits, suspend/grace)

description: Superadmin controls for tenant status, grace periods, and hard limits (uploads/storage/events). Includes UI, policy checks, and audit events.

notes: Implemented superadmin tenant lifecycle controls: activate/deactivate, suspend/unsuspend, schedule/cancel deletion (optional warning email), anonymize now; added tenant view infolist with lifecycle + audit timeline (retention milestones + recent notification logs) and tests for lifecycle actions + view timeline. Remaining: grace-period logic + hard limits (uploads/storage/events) wiring, policy checks, and audit-event storage.


title: Paddle catalog sync: paddle:sync-packages command (dry-run/pull)


title: Security review: run dynamic testing harness (identities, DAST, fuzz uploads)


title: Paddle migration: tenant ↔ Paddle customer sync + webhook handlers


title: Tenant admin onboarding: PWA/Capacitor/TWA packaging prep


title: SEC-FE-01 CSP nonce/hashing rollout