Multi-Tenant SaaS Platform – PLog

Multi-Tenant PLog – SaaS Content Publishing Platform

Live Applications

• Owner Console
• Tenant Dashboard
• User Web
• System Atlas
• API Documentation
• GitHub Repository

---

A fully engineered, end-to-end multi-tenant SaaS platform designed to manage multiple independent content publishing workspaces through a centralized platform management system.

Built from the ground up, the system combines a centralized Laravel API with four independent frontend applications, providing tenant isolation, granular authorization, subscription management, payment processing, and dedicated management experiences for different user roles.

The Problem

Building a multi-tenant SaaS platform involves much more than allowing multiple organizations to use the same application.

Each organization needs its own isolated data, users, permissions, content, and subscription lifecycle, while the platform owner needs centralized control over tenant provisioning, platform configuration, billing, and support operations.

The challenge is designing these capabilities within a unified system without compromising data isolation, authorization boundaries, authentication security, or maintainability.

The Solution

I designed and engineered a complete multi-tenant SaaS platform from scratch, using Laravel as the centralized backend and a pnpm monorepo containing four independent React applications.

The platform is organized around three primary user realms:

• Platform Owner: Manages tenants, subscription plans, billing operations, platform metrics, and controlled support access.
• Tenant Administrators & Members: Manage their workspace, users, permission profiles, content, and subscription.
• Public Users: Discover tenant workspaces and browse publicly published content.

Each application has its own frontend and dedicated user experience, while sharing a centralized API and reusable frontend infrastructure.

Key Features

1. Multi-Tenant Architecture

• Tenant provisioning and lifecycle management.
• Tenant-scoped data access and resource isolation.
• Independent tenant workspaces with their own users, content, and settings.
• Tenant suspension through billing-state restrictions.
• Soft deletion, restoration, and scheduled permanent cleanup.
• Tenant resolution based on authenticated identity and tenant association rather than URL slugs.

2. Authentication & Authorization

• Separate authentication realms for platform owners and tenant users.
• Session-based authentication with dedicated HttpOnly session cookies.
• CSRF protection for state-changing requests.
• Role-based and permission-based access control.
• Configurable permission profiles and additional user-specific permissions.
• Invitation-based onboarding for tenant administrators.
• Different access levels for administrators, authors, and viewers.

3. Platform Owner Console

• Create, update, suspend, restore, and manage tenants.
• Provision initial tenant administrators through invitation workflows.
• Manage subscription plans and platform configuration.
• Monitor platform-wide billing transactions and financial metrics.
• Access tenant workspaces through a controlled support mechanism.
• Review tenant subscription and billing status.

4. Tenant Management Dashboard

• Manage workspace settings and organization information.
• Create, update, and manage users.
• Assign roles and configure granular permission profiles.
• Manage posts through draft, publish, unpublish, update, and delete workflows.
• Control content visibility based on user permissions.
• Manage subscription information, invoices, and payment history.

5. Public User Application

• User registration and authentication.
• Browse the available tenant directory.
• Discover published content across different workspaces.
• Access only publicly available posts.
• Paginated content browsing and tenant discovery.

6. Subscription & Payment System

• Subscription plan management.
• Stripe-hosted Checkout integration.
• Stripe Customer Portal integration.
• Subscription lifecycle management.
• Invoice and payment tracking.
• Webhook-driven synchronization of subscriptions and payment records.
• Payment failure handling and billing-state updates.
• Owner-level revenue and subscription analytics.

7. Controlled Support Access

Implemented a dedicated cross-application support workflow that allows the platform owner to access a tenant workspace without sharing credentials or bypassing the authentication system.

• Single-use, short-lived support tickets.
• Ticket expiration and validation.
• Explicit tenant consent through support-access settings.
• Dedicated support identity with controlled administrative permissions.
• Auditing of support sessions and activities.
• Automatic access revocation when tenant support permission is disabled.

8. System Atlas – Interactive Architecture Explorer

Built a dedicated application to visualize and document the entire backend architecture.

It provides:

• Interactive system architecture maps.
• Searchable API request catalog with permissions and middleware information.
• Detailed application file and responsibility catalog.
• 16 interactive system journeys covering end-to-end request lifecycles.
• Entity Relationship Diagrams for application and owner database schemas.
• Model and database table explorers.
• Command catalog and scheduled task documentation.
• Presenter mode with navigation and deep links.

Technology Stack

Backend

• PHP 8.3+
• Laravel 13
• PostgreSQL 16
• Eloquent ORM
• Stripe PHP SDK
• Laravel Scramble / OpenAPI 3.1

Frontend

• React
• TypeScript
• Vite
• Tailwind CSS
• shadcn/ui
• TanStack Query
• Axios
• React Router

Frontend Architecture

• pnpm Workspaces
• Shared UI component library
• Shared API clients and HTTP infrastructure
• Centralized cookie, theme, and notification utilities
• Independent frontend applications

Payments & Integrations

• Stripe Checkout
• Stripe Customer Portal
• Stripe Webhooks
• Email-based invitation workflows

Infrastructure & DevOps

• Docker
• Multi-stage Docker builds
• Nginx
• PHP-FPM
• Supervisor
• GitHub Actions CI/CD

Testing & Code Quality

• PHPUnit 12
• Vitest
• React Testing Library
• PHPStan
• Larastan
• PHP-CS-Fixer
• Prettier
• TypeScript type checking

Architecture & Engineering Highlights

Multi-Tenant Data Isolation

Designed tenant-scoped data access around authenticated user identity and tenant association, ensuring that application queries remain within the authorized tenant context.

Cross-tenant resource access is rejected, and tenant-specific operations are protected through centralized authorization and request handling.

Session-Based Authentication Across Multiple Applications

Implemented separate owner and tenant authentication realms with independent session cookies, CSRF token handling, and secure session management.

The frontend applications communicate with the API through shared HTTP infrastructure that handles credentials, CSRF headers, authentication errors, and session expiration.

Permission-Based Access Control

Built a flexible authorization system combining predefined role permissions, tenant-specific permission profiles, and additional user-level permissions.

Authorization is enforced on the backend rather than relying exclusively on frontend visibility controls.

Reliable Payment Processing

Designed a backend-driven Stripe integration where the server owns checkout session creation, payment configuration, webhook verification, and subscription synchronization.

Implemented signature verification, duplicate event protection, transactional processing, and retry-friendly webhook handling.

Secure Cross-Tenant Support Workflow

Designed a temporary access mechanism using single-use tickets with limited validity, explicit tenant consent, dedicated support identity, and audit records.

Independent Frontend Architecture

Organized four Vite applications into a pnpm monorepo with a shared package for UI components, API clients, cookies, themes, notifications, and data-fetching infrastructure.

This keeps each application independently buildable and deployable while maintaining consistent shared functionality.

Architecture Documentation & System Visualization

Developed System Atlas as a dedicated engineering tool to make the system's architecture, data model, API surface, and end-to-end request flows explorable rather than relying exclusively on static documentation.

Automated Quality & CI Pipeline

Integrated automated formatting checks, backend static analysis, frontend type checking, automated tests, application builds, and production boot checks into GitHub Actions.

Live Applications & Documentation

• Owner Console: Platform administration and tenant lifecycle management.
• Tenant Dashboard: Workspace, users, permissions, content, and billing management.
• User Web: Public tenant discovery and content browsing.
• System Atlas: Interactive system architecture and documentation.
• API Documentation: OpenAPI 3.1 documentation with request and response schemas.

---

Designed, Engineered & Built End-to-End by Youssef Mohammed