✅ Dynamic landing page — hero, features, testimonials, pricing, FAQ — all editable from the admin (no code)
✅ API Documentation — /docs ready for customer integration
✅ Legal pages: Terms of Service, Privacy Policy (Indonesian PDP Law), Refund Policy
✅ SEO ready — meta tags, OG image, Google Analytics, Facebook Pixel — configurable in the admin
✅ Register / Login / Email verification / Forgot password
✅ Connect WhatsApp via QR scan (real Baileys, multi-device support)
✅ Send Message — text, image, document, voice
✅ Broadcast Campaign — send to thousands of contacts with real-time progress + anti-ban rate limit
✅ Inbox & Logs — incoming/outgoing message history with search
✅ Contact Management — CRUD + CSV import
✅ Chatbot Auto-reply — keyword matching (contains/exact)
✅ API Keys — Generate, revoke, and monitor requests
✅ Webhook URL per device — receive incoming messages in real time
✅ Live stats — 7-day chart, quota meter
✅ Account self-service — change password, change email, export all data (UU PDP), permanently delete account
🛡️ Admin Panel (/admin) — 9 Pages
📊 Overview — total users, devices, messages, MRR, plan distribution donut chart, license status
👥 Users — search, edit, suspend, delete, dedicated subscription editor with quick action to extend 30/90/365 days
📱 All Devices — cross-user with bulk delete (all / disconnected only)
💬 All Messages — cross-user with bulk delete (>30 days, failed status, all)
💎 Plans & Billing — complete editor (price, maximum devices, broadcasts/day, API calls/day, duration, feature list)
💳 Transactions — history of all transactions + manual mark paid / refund / cancel + entry Manual payments for bank transfers
General — site name, contact, copyright, maintenance mode
SEO — meta tags, OG image, Google Analytics, Facebook Pixel
Payment — Tripay & iPaymu credentials (live editable, no .env)
Landing Page — hero copy, features, testimonials, CTA — all editable
🕐 Audit Log — all admin actions are recorded (user, IP, timestamp, metadata)
🔄 Software Update — upload ZIP updates from vendors → auto-backup, validate, apply, rollback per click
💰 Subscription & Billing System
✅ Paywall enforcement — users cannot connect devices without an active subscription (HTTP 402)
✅ Tripay integration — closed payment + HMAC signature verification callback
✅ iPaymu integration — redirect payment v2 + signature verification
✅ Plans editable in the admin — price, duration, quota — no hardcode
✅ Auto-activation after a successful callback
✅ Automatic email invoices sent
✅ Cron auto-downgrade subscription expiration
✅ Email reminders 7 days and 1 day before expiration
✅ Quota enforcement per plan (broadcasts/day, API calls/day, maximum devices)
✅ POST /v1/messages — send a message (Bearer API key auth)
✅ GET /v1/messages/:id — check status (pending/delivered/read/failed)
✅ GET /v1/devices — list of customer devices
✅ Per-key rate limiting (60 req/min default, configurable)
✅ Code examples cURL, Node.js, PHP, Python in docs
✅ bcrypt password hashing (10 rounds)
✅ API keys hashed SHA-256 (raw shown once)
✅ JWT 30-day expiry + secret enforcement in production
✅ Helmet security headers
✅ Rate limiting auth/api/public configurable
✅ CORS allowlist configurable
✅ Multi-tenant isolation verified 9/9 (user A cannot access user B's data)
✅ SQL injection protection (parameterized queries)
✅ XSS protection (HTML escape on rendering)
✅ Audit log for all admin actions
✅ UU PDP compliance — export data + delete built-in account
✅ License protection (Flavesite integration) — 6-layer guard, anti-piracy
✅ Auto-downgrade subscription expires
✅ Expiry reminder email (7d & 1d)
✅ Cleanup expired QR codes
✅ Auto-expire pending transactions >24h
✅ Daily database backup (7 day rotation)
🔄 Built-in Software Updater (KILLER FEATURE)
✅ Upload ZIP update via admin UI (drag & drop)
✅ Manifest validation + security path (.env/.git/data/ rejected)
✅ Preview changelog before applying
✅ Auto-backup before overwriting
✅ One-click rollback to previous version
✅ History of all updates + status