Getting StartedMSPScanningWorkers and AgentsBilling and PlansAPI and WebhooksPlatform AdministrationSecurity
Platform Administration
Admin Guide
Platform administration: tenant management, plan overrides, audit logs, and environment hygiene.
1Admin Console Overview
Platform admins have a platformAdmin custom claim on their Firebase Auth token. This grants access to designated admin-only UI pages.
Admin-only capabilities
- View and manage all orgs, members, and plans.
- Apply plan overrides per org (enterprise custom contracts).
- Suspend or restore any org.
- Read all audit logs across the platform.
- Trigger manual cost rollup and budget alert jobs.
- Issue and revoke worker enrollment tokens.
2Tenants and Plans Management
Plans are maintained in /plans collection. Orgs reference planId; entitlements resolve at runtime.
- To create a new plan: write directly to /plans/{planId} via Admin SDK or console.
- To override an org plan: set org.planId and optionally populate /orgs/{orgId}/entitlements/snapshot.
- Billing status changes arrive via Stripe webhook → Function → /orgBilling update + /orgs.billing summary update.
- Seat limit violations are enforced at invite time. Existing members are never auto-removed.
3Audit Logs and Evidence Exports
The platform writes structured audit logs for all privileged actions. Logs are append-only and stored in /platform/auditLogs/items/{logId}.
Log doc fields
{
actorUid, actorEmail,
action, // e.g. "org.suspend", "plan.override"
orgId,
targetType, targetId,
before, after, // optional diffs
severity, // "info" | "warn" | "critical"
correlationId,
timestamp
}Export audit logs via the Admin Console → Audit Logs → Export (CSV/JSON) for compliance evidence.
4Environment Separation
Production
projectId: vulnios
branch: main
Auto-deploy from main on merge.
Staging
projectId: vulnios-stg
branch: staging
Deploy staging branch for pre-release validation.
- Separate Firebase projects — never share Auth or Firestore.
- Separate .env files (not committed) — each environment has distinct API keys.
- Firestore rules and indexes deployed independently per project.
- Worker tokens are environment-scoped and non-transferable.