Documentation
¶
Overview ¶
Package plan is the SuperAdmin HTTP surface for the platform subscription/DNS plan authority (models/plan) — the editable runtime source of truth for subscription + DNS pricing that admin.hanzo.ai governs.
Two audiences, two auth models (mirrors api/catalog):
- PUBLIC read is GET /v1/billing/plans (api/billing) — no auth, cacheable.
- PLATFORM-ADMIN write (create/update/delete/seed) mutates the platform-global plan authority (the "system" namespace, NOT a per-tenant org), so it gates on auth.IAMClaims.IsSuperAdmin() — a Hanzo platform admin, never an org admin. Wired on the /v1 bundle under /plans/entries.
The plan authority is platform-global: one store in models/plan.Namespace ("system"), keyed by the globally-unique slug. Because the same rows back resolveSubscriptionPlan → the internal-ledger charge, the money-adjacent guards live here: the slug is IMMUTABLE on update (deprecate-and-create, never rename, so a subscription's stored PlanId / a Stripe plan object can never be orphaned), and the free($0)-vs-custom(null, ContactSales) distinction is preserved as sent (never coerced null→0).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AdminRoute ¶
func AdminRoute(r zip.Router, seed SeedSource, args ...zip.Handler)
AdminRoute wires the platform-admin plan CRUD + seed on the /v1 bundle. args carry the bundle's token/admin middleware; each handler ALSO enforces IsSuperAdmin() explicitly (defense in depth — a token gate is not a platform-admin gate). seed is the injected embed source.
func CreateEntry ¶
CreateEntry adds a plan (platform admin). Slug is required + globally unique. The typed Price/PriceAnnual and the ContactSales flag are stored as sent, so the free-vs-custom distinction is preserved (never coerced).
func DeleteEntry ¶
DeleteEntry removes a plan by slug (platform admin).
func ListEntries ¶
ListEntries returns the raw plan authority rows (admin view). Platform admin only.
func UpdateEntry ¶
UpdateEntry edits a plan by slug (platform admin). The slug is IMMUTABLE — a rename is rejected outright (deprecate-and-create instead) so a subscription's stored PlanId or a Stripe plan object can never be orphaned by a renamed row. Absent body fields keep their stored value (the row is loaded first), so a partial edit never silently zeroes Price/ContactSales.
Types ¶
type SeedSource ¶
SeedSource yields the authoritative seed rows (the api/billing embed). It is injected at the composition root (api.Route) so this package depends only on models/plan — the embed source stays owned by api/billing, no import coupling.
Source Files