Platform Administration

Overview

The Platform Administration area is only accessible to users with the super_admin role. It gives SalonOS platform operators a cross-tenant view for monitoring, support, and incident response. Salon staff and owners cannot see this section — it is hidden from their navigation and protected by server-side role enforcement.

Access

The platform dashboard is at /dashboard/super-admin. Any attempt to access it with a role below super_admin redirects to /dashboard.

Server-side guard (lib/auth/require-role.ts):

await requireRole(["super_admin"])

This uses the memberships table — the role is never passed from the client.

Platform Overview Dashboard

The dashboard aggregates data across all tenants using the Supabase service role key.

All-Time Metrics

Metric	Description
Tenants	Number of orgs
Brands	Total brands across all orgs
Locations	Total active locations
Staff	Total staff members
Clients	Total clients
Users	Total operator memberships (non-client roles)

Today's Activity

Metric	Description
Appointments	Appointments starting today (all tenants)
Paid Invoices	Invoices marked paid today
Revenue	Sum of paid invoice totals today (in ₹)

This Month

Same three metrics aggregated since the first of the current month. Also shows average revenue per tenant for the month.

Tenant Table

Lists up to 50 tenants ordered by creation date (newest first). Columns:

• Org name
• Brand name
• Location count
• Staff count
• Client count
• User count
• Joined date

Role Hierarchy and Constants

Roles are defined in lib/auth/types.ts:

Constant	Roles included
ALL_ROLES	super_admin, org_owner, brand_manager, location_manager, front_desk, stylist
OPS_ROLES	super_admin, org_owner, brand_manager, location_manager, front_desk
ADMIN_ROLES	super_admin, org_owner, brand_manager, location_manager
MANAGER_ROLES	super_admin, org_owner, brand_manager
OWNER_ROLES	super_admin, org_owner
SUPER_ADMIN_ONLY	super_admin

These constants are used throughout nav-links.tsx to control which menu items a user sees, and in page-level requireRole() guards to enforce access server-side.

Server-Side Role Enforcement

Any server component or server action can enforce a minimum role:

import { requireRole, requireAnyAdmin, requireManagerOrAbove } from "@/lib/auth/require-role"

// Allow only super_admin
await requireRole(["super_admin"])

// Allow location_manager and above
await requireAnyAdmin()

// Allow brand_manager and above
await requireManagerOrAbove()

The function reads memberships.role from the database for the authenticated user. It never trusts client-supplied role values.

Impersonation and Support

Super-admins can view any tenant by loading the tenant context directly. All super-admin actions are captured in the Audit Log (audit_log table) with the acting user ID, tenant context, action type, and timestamp. Platform-level actions are tagged with context: 'super_admin'.

Platform Security Posture

• Super-admin endpoints require service_role key on server; RLS is bypassed intentionally
• IP allowlisting for the control plane is managed at the OCI firewall layer
• DPDP data export requests from tenants are routed through the control plane (/api/dpdp/export)
• Plan limits (max_staff, max_locations, trial expiry) exist in the org_plans table but enforcement is open (SALO-177, Sprint 3)

Permissions

Capability	super_admin
View platform overview dashboard	Yes
View all tenants and their metrics	Yes
Access tenant context for support	Yes
Manage subscription plans	Yes
Trigger data exports	Yes
Access audit log across tenants	Yes
Enforce / override plan limits	Sprint 3