Evergreen farms (pos)

I have worked on multi product will hosted in a single domain architecture designing and implementation. Today this below points are covered to create a documentation.

1. Main company (platform owner)
One company in Mongo is treated as the platform owner.
Preferred: isMainCompany: true on that Company document.
If that flag is missing, the system falls back to Evergreen defaults (nursery/evergreen / db evergreen / env overrides).
You can force-tag it with Ensure Main Company (POST .../ensure-main-company).
2. Who can manage SaaS
Log in as admin/super_admin into that main company’s DB.
Middleware checks: your JWT dbName must match the main company’s dbName.
Only then you see Super Admin menus like SaaS Plans, Company Registrations, etc.
3. SaaS plans (create / manage)
UI: /saas-plans (SaasPlansPage.tsx)
API: /api/v1/superadmin/saas-plans
Plans are stored in SaasSubscriptionPlan (platform DB).
From there you create, edit, seed defaults, soft-delete plans (modules, prices, limits).
4. How tenants get a plan
New companies go through onboarding and pick a SaaS plan.
After approval/provisioning, that plan is applied onto the tenant Companie (billingPlan, modules, limits).
You can also apply/change a plan later via company apply-plan APIs / company control UI.
5. What that plan controls day-to-day
Which modules are on (POS, ecom, etc.).
Feature gates + role permissions for that tenant.
Usage limits / billing lifecycle on the company.

1. Work Completed

• Finalized the multi-tenant SaaS platform architecture with a product-based subdomain strategy.
• Defined independently deployable product frontends with shared platform backend services.
• Planned wildcard DNS architecture for automatic tenant onboarding without per-tenant DNS configuration.
• Documented authentication flow, white-label/custom domain support, and migration strategy.
• Created an implementation roadmap with backend/frontend phases, priorities, and dependencies.
• Planned dual-run migration to maintain compatibility for existing tenants during rollout.
• Hardened backend security by implementing CORS allowlists and enforcing required authentication secrets.
• Added rate limiting for login, superadmin login, password reset, and public company information APIs.
• Implemented centralized tenant and product resolution using the request Host header.
• Added product registry support for POS, E-Commerce, Restaurant, and Fence applications.
• Implemented host parsing for `{tenant}.{product}.{root}` with localhost support for local development.
• Enhanced company domain mapping with product association and verification status.
• Updated authentication and onboarding flows to generate product-based URLs.
• Extended JWT tokens with company and product information while maintaining backward compatibility.
• Replaced hardcoded platform owner detection with a configurable main-company approach.
• Enabled local development using product subdomains such as `tenant.pos.localhost`.
• Completed backend changes required for the new multi-tenant product-host architecture.
• Identified next phase: frontend migration (POS & E-Commerce) followed by staging/production wildcard DNS setup.