# SaaS Admin Productization Implementation Plan

> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.

**Goal:** Add productized SaaS administration: roles, user management, user disablement, plugin token lifecycle, token usage tracking, and an admin center UI.

**Architecture:** Extend the existing JSON store and HTTP API without introducing a database migration framework. First user becomes admin, later users are buyers. Admin-only endpoints expose user summaries and allow status changes; plugin token endpoints gain disable/delete and usage metadata.

**Tech Stack:** Vanilla Node HTTP server, JSON persistence, vanilla HTML/CSS/JS frontend, Node test runner.

---

### Task 1: Backend Role And Admin APIs

**Files:**
- Modify: `src/store.js`
- Modify: `src/server.js`
- Test: `tests/server.test.js`

- [x] Add tests for first user admin, later buyer, admin user list, disable behavior.
- [x] Implement role/status defaults in `JsonStore.createUser` and `publicUser`.
- [x] Add `JsonStore.listUsersWithStats`, `updateUserStatus`.
- [x] Add `requireAdmin` in server and `/api/admin/users`, `/api/admin/users/:id/status`.
- [x] Run focused server tests, then full test suite.

### Task 2: Plugin Token Lifecycle

**Files:**
- Modify: `src/store.js`
- Modify: `src/server.js`
- Test: `tests/server.test.js`

- [x] Add tests for token usage count/last used, disabling token, deleting token.
- [x] Add token fields `status`, `usageCount`, `lastUsedAt`.
- [x] Add store methods `touchPluginToken`, `updatePluginTokenStatus`, `deletePluginToken`.
- [x] Add API endpoints `PATCH /api/plugin-tokens/:id` and `DELETE /api/plugin-tokens/:id`.
- [x] Block disabled token capture.

### Task 3: Admin Center UI

**Files:**
- Modify: `public/index.html`
- Modify: `public/app.js`
- Modify: `public/styles.css`

- [x] Add admin navigation item hidden for non-admin.
- [x] Load admin users when admin view opens.
- [x] Render admin center with user list, stats, status action.
- [x] Enhance plugin token panel with status, usage count, last used, disable/delete actions.
- [x] Keep Buyer Atelier visual system.

### Task 4: Verification

**Files:**
- Test: all

- [ ] Run `node --check public/app.js && npm run check && npm test`.
- [ ] Restart local server if needed.
- [ ] Browser verify admin center and plugin panel desktop/mobile.
- [ ] Confirm no temporary QA files remain.