# RetailOS — Phase 05: Super Admin (SaaS Layer)

**Status:** Draft for review · **Depends on:** Phase 02–04 sign-off (needs real tenant/subscription/order data to manage)
**Duration estimate:** সপ্তাহ ১১–১২ (UI prototype scope)
**Goal:** পুরো SaaS ব্যবস্থাপনা — এই ধাপ শেষ হলে RetailOS প্রকৃত multi-tenant প্রোডাক্টে পরিণত হবে। এটাই v2.0 Scale release-এর অংশ যেখানে RetailOS operator team (super_admin role, Phase 00 §1) কাজ করে।

---

## 1. Deliverable Checklist (per roadmap chip list)

| # | Module | Description |
|---|---|---|
| 1 | Shop Management | Approve/suspend tenants, view shop details cross-tenant |
| 2 | Subscription Plans | Manage plan catalog (Starter/Business/Premium/Enterprise) |
| 3 | Payments | Payment history, failed-payment workflow visibility |
| 4 | Support Tickets | Tenant-raised issues, operator response |
| 5 | System Settings | Global config not scoped to any tenant |
| 6 | Global Analytics | Cross-tenant metrics for the RetailOS business itself |

## 2. Shop Management

- New shop registrations land here for **approval** before going live (fraud/spam prevention) — this is the one place Phase 00's tenant isolation is intentionally crossed, restricted strictly to `super_admin` middleware (per Phase 00 §9 API Conventions).
- Actions: approve, suspend (manual, separate from the automated billing-driven suspension in §4 below), view shop profile + usage summary.
- Every cross-tenant view/action here must be audit-logged — who (which operator), which shop, what action, when.

## 3. Subscription Plans (catalog management)

- Implements the plan catalog from the existing Pricing/Billing Rules sections (Starter ₹499/mo, Business ₹999/mo, Premium ₹1,999/mo, Enterprise custom) — yearly always = 10× monthly (2 months free), per the documented rule.
- Plan changes here affect *future* subscriptions/renewals only — existing active subscriptions are not retroactively changed mid-cycle (consistent with the Downgrade Rules already defined).
- Feature-gating per plan (e.g. Loyalty/Consumption Prediction = Premium+, per Phase 03 §7) is configured here, not hardcoded in application logic — so a plan's feature set can change without a code deploy.

## 4. Payments — implements the existing Failed Payment Workflow

Directly operationalizes the timeline already defined in Billing Rules:

```
Payment due        → 3-day reminder (email + in-app)
Payment failed      → 7-day grace period starts
Grace period ends   → Read-only mode
30 days unpaid       → Account suspension
```

- Super Admin view shows every tenant's current state in this pipeline (which tenants are in grace period, read-only, or suspended) — this is the operator's early-warning dashboard, directly feeding Risk Register RSK-09 (margin/revenue review).
- Manual override capability (e.g. extend grace period for a known good-faith customer) must be logged — no silent manual billing changes.
- GST-compliant invoice generation/reprint (per Billing Rules §Invoice Generation) is visible/re-triggerable here.

## 5. Support Tickets

- Tenant-raised tickets (from their dashboard) land in a queue here, assignable to operator staff.
- Ticket should carry tenant context automatically (plan, subscription state, recent activity) so operators don't have to cross-reference Shop Management manually.
- SLA/response-time expectations should be defined once the Legal & Compliance / Customer Support policy is finalized (flagged gap — not yet in scope of this roadmap and worth a dedicated section).

## 6. System Settings

- Global, non-tenant-scoped configuration: notification provider credentials (WhatsApp/SMS — abstracted per RSK-06), global feature flags, maintenance-mode toggle, default plan for new signups.
- Changes here are inherently high-blast-radius — should require a confirmation step and are always audit-logged.

## 7. Global Analytics (RetailOS's own business metrics)

- Distinct from tenant-facing Reports (Phase 02 §8) — this is aggregate/anonymized data about RetailOS's own business: total active tenants, MRR/ARR, churn rate, plan-tier distribution, trial-to-paid conversion.
- No individual tenant's raw business data (sales figures, customer lists) should be browsable here beyond what's needed for support — this boundary protects tenant trust and should be explicit in the Legal & Compliance data-ownership commitment.

---

## Deliverable Sign-off Checklist
- [ ] Shop approval/suspension flow tested, audit logging verified
- [ ] Subscription plan catalog manageable without code changes; feature-gating confirmed data-driven
- [ ] Failed Payment Workflow states (reminder → grace → read-only → suspension) tested end-to-end with correct notifications at each step
- [ ] Support ticket queue tested with tenant-context auto-attached
- [ ] System Settings changes confirmed audit-logged
- [ ] Global Analytics confirmed aggregate-only, no raw tenant data leakage

**Once every box above is checked, Phase 05 is Done — RetailOS is a complete, operator-manageable multi-tenant SaaS product, closing out all 6 build phases.**