product-sourcing-capture/docs/superpowers/plans/2026-06-13-saas-admin-productization.md

SaaS Admin Productization Implementation Plan

For agentic workers: REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (- [ ]) syntax for tracking.

Goal: Add productized SaaS administration: roles, user management, user disablement, plugin token lifecycle, token usage tracking, and an admin center UI.

Architecture: Extend the existing JSON store and HTTP API without introducing a database migration framework. First user becomes admin, later users are buyers. Admin-only endpoints expose user summaries and allow status changes; plugin token endpoints gain disable/delete and usage metadata.

Tech Stack: Vanilla Node HTTP server, JSON persistence, vanilla HTML/CSS/JS frontend, Node test runner.

---

Task 1: Backend Role And Admin APIs

Files:

• Modify: src/store.js

• Modify: src/server.js

• Test: tests/server.test.js

• Add tests for first user admin, later buyer, admin user list, disable behavior.

• Implement role/status defaults in JsonStore.createUser and publicUser.

• Add JsonStore.listUsersWithStats, updateUserStatus.

• Add requireAdmin in server and /api/admin/users, /api/admin/users/:id/status.

• Run focused server tests, then full test suite.

Task 2: Plugin Token Lifecycle

Files:

• Modify: src/store.js

• Modify: src/server.js

• Test: tests/server.test.js

• Add tests for token usage count/last used, disabling token, deleting token.

• Add token fields status, usageCount, lastUsedAt.

• Add store methods touchPluginToken, updatePluginTokenStatus, deletePluginToken.

• Add API endpoints PATCH /api/plugin-tokens/:id and DELETE /api/plugin-tokens/:id.

• Block disabled token capture.

Task 3: Admin Center UI

Files:

• Modify: public/index.html

• Modify: public/app.js

• Modify: public/styles.css

• Add admin navigation item hidden for non-admin.

• Load admin users when admin view opens.

• Render admin center with user list, stats, status action.

• Enhance plugin token panel with status, usage count, last used, disable/delete actions.

• Keep Buyer Atelier visual system.

Task 4: Verification

Files:

• Test: all

• Run node --check public/app.js && npm run check && npm test.

• Restart local server if needed.

• Browser verify admin center and plugin panel desktop/mobile.

• Confirm no temporary QA files remain.