Keme Super-Admin Control Plane

Purpose

Keme Control is the restricted operational interface for PushHub platform administrators. It is served at https://admin.pushhub.kemegames.com/admin and is separate from customer workspaces.

Information architecture

The approval-based onboarding expansion adds Trial Requests as a required admin module. It should sit before Organizations because it is the intake queue that provisions new tenant workspaces after Keme review.

Implemented route: /admin/trial-requests. The module supports submitted/approved/rejected/expired filtering, requester/company search, approve with plan/trial settings, reject with admin notes, setup-email delivery state, resend setup email, admin-only setup-link recovery, and audit-backed review actions.

  1. Command Center — tenant, user, app, device, and notification totals; newest organizations; tenant health; core-service summary.
  2. Organizations — searchable tenant directory, status filters, footprint, plan visibility, suspension/reactivation, and plan changes.
  3. Apps & Environments — cross-tenant project inventory, platform/provider readiness, state, and device footprint.
  4. Users & Roles — workspace identities, verification/login state, and Keme super-admin operators.
  5. Plans & Billing — subscription plans, prices, features, and entitlement limits.
  6. Campaigns & Delivery — cross-tenant campaign activity and queued/sent/delivered/opened/failed delivery totals.
  7. API Credentials — safe key metadata, prefixes, scopes, last use, and revocation state; never plaintext secrets.
  8. Integrations — FCM/APNs readiness and the core data-plane connections.
  9. Audit Trail — system and super-admin events, ordered newest first.
  10. Data Governance — implemented safeguards and an explicit enterprise-governance backlog.
  11. Platform Health — API heartbeat and the operational boundary for PostgreSQL, Redis, storage, FCM, and APNs.
  12. Access & Security — current session posture and the operator security checklist.
  13. Delivery Engine — dedicated worker freshness, durable job states, leases, retry/dead-letter volume, secret-free provider attempts, and audited recovery.

Competitive baseline

The control-plane scope follows recurring capabilities in OneSignal, Pushwoosh, Knock, Braze, CleverTap, and MoEngage administration: organization/app hierarchy, granular access, API-key governance, environment boundaries, billing and usage, message observability, audit logs, provider configuration, and privacy/security controls. Unsupported enterprise functions are identified as planned rather than represented as active.

Authorization

Administrative APIs

High-risk workflows

Approve a trial request

  1. Open Trial Requests.
  2. Filter to submitted requests.
  3. Review company, requester, website, expected volume, and use case.
  4. Choose the initial plan and trial length.
  5. Approve the request.
  6. Verify the company, owner identity, owner membership, setup-password token, setup-email status, and audit event.
  7. If setup email shows Fallback or Failed, use Resend setup after fixing provider configuration, or use Setup link as a manual recovery path.

Reject a trial request

  1. Open Trial Requests.
  2. Review the request details.
  3. Enter an internal note and customer-facing reason when required.
  4. Reject the request.
  5. Verify no workspace was provisioned and the rejection audit event exists.

Recover setup access for an approved request

  1. Open Trial Requests and filter to approved requests.
  2. Check the Setup email column for attempt count, provider, last attempt time, and error/fallback detail.
  3. Click Resend setup after email configuration is healthy.
  4. Click Setup link only when the owner needs manual recovery before email is healthy.
  5. Copy the generated link from the modal and share it only with the listed workspace owner.
  6. Verify the trial_request.setup_link_generated audit event exists.

Suspend an organization

  1. Locate the organization in Tenant Directory.
  2. Open its action control.
  3. Enter a meaningful reason of at least five characters.
  4. Confirm suspension.
  5. Verify the new status and the admin.company.suspended audit event.

Reactivate an organization

  1. Locate the suspended organization.
  2. Confirm reactivation.
  3. Verify the active status and the admin.company.activated audit event.

Change a plan

  1. Select the current plan badge in Tenant Directory.
  2. Choose the new plan.
  3. Confirm the entitlement change.
  4. Verify the organization plan and the admin.company.plan_changed audit event.

Recover a dead-lettered dispatch job

  1. Open Delivery Engine and filter to DeadLettered.
  2. Inspect the job source, company/app ownership, normalized failure, and attempt history.
  3. Correct provider configuration or the reported operational fault before replay.
  4. Enter a recovery reason of at least five characters and retry the job. Final recipient outcomes remain skipped.
  5. Dismiss only when no replay should occur; this is terminal and audited.
  6. Verify admin.dispatch_job_retried or admin.dispatch_job_dismissed in Audit Trail.

Implementation

Cross-tenant read-only inventory endpoints use a dedicated EF Core read model in the super-admin controller. Administrative writes continue through MediatR command handlers so validation and audit creation remain centralized.

Verification

Production verification on July 17, 2026 confirmed admin authentication, trial request listing, protected unauthenticated access, public intake, and rejection workflow. The live smoke request was rejected immediately so no test tenant was provisioned.

Phase Three verification is documented in docs/PHASE_THREE.md. Delivery-engine smoke checks are read-only; retry and dismissal must use a designated test job.