refactor: redesign planos interface with design system patterns

- Create CreatePlanModal component with Headless UI Dialog
- Implement dark mode support throughout plans UI
- Update plans/page.tsx with professional card layout
- Update plans/[id]/page.tsx with consistent styling
- Add proper spacing, typography, and color consistency
- Implement smooth animations and transitions
- Add success/error message feedback
- Improve form UX with better input styling

backend/cmd/server/main.go

@@ -56,12 +56,15 @@ func main() {
 	companyRepo := repository.NewCompanyRepository(db)
 	signupTemplateRepo := repository.NewSignupTemplateRepository(db)
 	agencyTemplateRepo := repository.NewAgencyTemplateRepository(db)
+	planRepo := repository.NewPlanRepository(db)
+	subscriptionRepo := repository.NewSubscriptionRepository(db)
 
 	// Initialize services
 	authService := service.NewAuthService(userRepo, tenantRepo, cfg)
 	agencyService := service.NewAgencyService(userRepo, tenantRepo, cfg)
 	tenantService := service.NewTenantService(tenantRepo)
 	companyService := service.NewCompanyService(companyRepo)
+	planService := service.NewPlanService(planRepo, subscriptionRepo)
 
 	// Initialize handlers
 	healthHandler := handlers.NewHealthHandler()
@@ -70,6 +73,7 @@ func main() {
 	agencyHandler := handlers.NewAgencyRegistrationHandler(agencyService, cfg)
 	tenantHandler := handlers.NewTenantHandler(tenantService)
 	companyHandler := handlers.NewCompanyHandler(companyService)
+	planHandler := handlers.NewPlanHandler(planService)
 	signupTemplateHandler := handlers.NewSignupTemplateHandler(signupTemplateRepo, userRepo, tenantRepo, agencyService)
 	agencyTemplateHandler := handlers.NewAgencyTemplateHandler(agencyTemplateRepo, agencyService, userRepo, tenantRepo)
 	filesHandler := handlers.NewFilesHandler(cfg)
@@ -112,6 +116,10 @@ func main() {
 	router.HandleFunc("/api/signup-templates/slug/{slug}", signupTemplateHandler.GetTemplateBySlug).Methods("GET")
 	router.HandleFunc("/api/signup/register", signupTemplateHandler.PublicRegister).Methods("POST")
 	
+	// Public plans (for signup flow)
+	router.HandleFunc("/api/plans", planHandler.ListActivePlans).Methods("GET")
+	router.HandleFunc("/api/plans/{id}", planHandler.GetActivePlan).Methods("GET")
+	
 	// File upload (public for signup, will also work with auth)
 	router.HandleFunc("/api/upload", uploadHandler.Upload).Methods("POST")
 
@@ -156,6 +164,9 @@ func main() {
 		}
 	}))).Methods("GET", "PUT", "PATCH", "DELETE")
 
+	// SUPERADMIN: Plans management
+	planHandler.RegisterRoutes(router)
+
 	// ADMIN_AGENCIA: Client registration
 	router.Handle("/api/agencies/clients/register", authMiddleware(http.HandlerFunc(agencyHandler.RegisterClient))).Methods("POST")
 

backend/internal/api/handlers/files.go

@@ -39,6 +39,23 @@ func (h *FilesHandler) ServeFile(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Whitelist de buckets públicos permitidos
+	allowedBuckets := map[string]bool{
+		"aggios-logos": true,
+	}
+	if !allowedBuckets[bucket] {
+		log.Printf("🚫 Access denied to bucket: %s", bucket)
+		http.Error(w, "Access denied", http.StatusForbidden)
+		return
+	}
+
+	// Proteção contra path traversal
+	if strings.Contains(filePath, "..") {
+		log.Printf("🚫 Path traversal attempt detected: %s", filePath)
+		http.Error(w, "Invalid path", http.StatusBadRequest)
+		return
+	}
+
 	log.Printf("📁 Serving file: bucket=%s, path=%s", bucket, filePath)
 
 	// Initialize MinIO client

backend/internal/api/handlers/plan.go

@@ -0,0 +1,268 @@
+package handlers
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"strconv"
+
+	"aggios-app/backend/internal/domain"
+	"aggios-app/backend/internal/service"
+
+	"github.com/google/uuid"
+	"github.com/gorilla/mux"
+)
+
+// PlanHandler handles plan-related endpoints
+type PlanHandler struct {
+	planService *service.PlanService
+}
+
+// NewPlanHandler creates a new plan handler
+func NewPlanHandler(planService *service.PlanService) *PlanHandler {
+	return &PlanHandler{
+		planService: planService,
+	}
+}
+
+// RegisterRoutes registers plan routes
+func (h *PlanHandler) RegisterRoutes(r *mux.Router) {
+	// Note: Route protection is done in main.go with authMiddleware wrapper
+	r.HandleFunc("/api/admin/plans", h.CreatePlan).Methods(http.MethodPost)
+	r.HandleFunc("/api/admin/plans", h.ListPlans).Methods(http.MethodGet)
+	r.HandleFunc("/api/admin/plans/{id}", h.GetPlan).Methods(http.MethodGet)
+	r.HandleFunc("/api/admin/plans/{id}", h.UpdatePlan).Methods(http.MethodPut)
+	r.HandleFunc("/api/admin/plans/{id}", h.DeletePlan).Methods(http.MethodDelete)
+
+	// Public routes (for signup flow)
+	r.HandleFunc("/api/plans", h.ListActivePlans).Methods(http.MethodGet)
+	r.HandleFunc("/api/plans/{id}", h.GetActivePlan).Methods(http.MethodGet)
+}
+
+// CreatePlan creates a new plan (admin only)
+func (h *PlanHandler) CreatePlan(w http.ResponseWriter, r *http.Request) {
+	log.Printf("📋 CREATE PLAN - Method: %s", r.Method)
+
+	var req domain.CreatePlanRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		log.Printf("❌ Invalid request body: %v", err)
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	plan, err := h.planService.CreatePlan(&req)
+	if err != nil {
+		log.Printf("❌ Error creating plan: %v", err)
+		switch err {
+		case service.ErrPlanSlugTaken:
+			http.Error(w, err.Error(), http.StatusConflict)
+		case service.ErrInvalidUserRange:
+			http.Error(w, err.Error(), http.StatusBadRequest)
+		default:
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
+		}
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusCreated)
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"message": "Plan created successfully",
+		"plan":    plan,
+	})
+	log.Printf("✅ Plan created: %s", plan.ID)
+}
+
+// GetPlan retrieves a plan by ID (admin only)
+func (h *PlanHandler) GetPlan(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	idStr := vars["id"]
+
+	id, err := uuid.Parse(idStr)
+	if err != nil {
+		http.Error(w, "Invalid plan ID", http.StatusBadRequest)
+		return
+	}
+
+	plan, err := h.planService.GetPlan(id)
+	if err != nil {
+		if err == service.ErrPlanNotFound {
+			http.Error(w, "Plan not found", http.StatusNotFound)
+		} else {
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
+		}
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"plan": plan,
+	})
+}
+
+// ListPlans retrieves all plans (admin only)
+func (h *PlanHandler) ListPlans(w http.ResponseWriter, r *http.Request) {
+	plans, err := h.planService.ListPlans()
+	if err != nil {
+		log.Printf("❌ Error listing plans: %v", err)
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"plans": plans,
+	})
+	log.Printf("✅ Listed %d plans", len(plans))
+}
+
+// ListActivePlans retrieves all active plans (public)
+func (h *PlanHandler) ListActivePlans(w http.ResponseWriter, r *http.Request) {
+	plans, err := h.planService.ListActivePlans()
+	if err != nil {
+		log.Printf("❌ Error listing active plans: %v", err)
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"plans": plans,
+	})
+}
+
+// GetActivePlan retrieves an active plan by ID (public)
+func (h *PlanHandler) GetActivePlan(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	idStr := vars["id"]
+
+	id, err := uuid.Parse(idStr)
+	if err != nil {
+		http.Error(w, "Invalid plan ID", http.StatusBadRequest)
+		return
+	}
+
+	plan, err := h.planService.GetPlan(id)
+	if err != nil {
+		if err == service.ErrPlanNotFound {
+			http.Error(w, "Plan not found", http.StatusNotFound)
+		} else {
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
+		}
+		return
+	}
+
+	// Check if plan is active
+	if !plan.IsActive {
+		http.Error(w, "Plan not available", http.StatusNotFound)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"plan": plan,
+	})
+}
+
+// UpdatePlan updates a plan (admin only)
+func (h *PlanHandler) UpdatePlan(w http.ResponseWriter, r *http.Request) {
+	log.Printf("📋 UPDATE PLAN - Method: %s", r.Method)
+
+	vars := mux.Vars(r)
+	idStr := vars["id"]
+
+	id, err := uuid.Parse(idStr)
+	if err != nil {
+		http.Error(w, "Invalid plan ID", http.StatusBadRequest)
+		return
+	}
+
+	var req domain.UpdatePlanRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		log.Printf("❌ Invalid request body: %v", err)
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	plan, err := h.planService.UpdatePlan(id, &req)
+	if err != nil {
+		log.Printf("❌ Error updating plan: %v", err)
+		switch err {
+		case service.ErrPlanNotFound:
+			http.Error(w, "Plan not found", http.StatusNotFound)
+		case service.ErrPlanSlugTaken:
+			http.Error(w, err.Error(), http.StatusConflict)
+		case service.ErrInvalidUserRange:
+			http.Error(w, err.Error(), http.StatusBadRequest)
+		default:
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
+		}
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"message": "Plan updated successfully",
+		"plan":    plan,
+	})
+	log.Printf("✅ Plan updated: %s", plan.ID)
+}
+
+// DeletePlan deletes a plan (admin only)
+func (h *PlanHandler) DeletePlan(w http.ResponseWriter, r *http.Request) {
+	log.Printf("📋 DELETE PLAN - Method: %s", r.Method)
+
+	vars := mux.Vars(r)
+	idStr := vars["id"]
+
+	id, err := uuid.Parse(idStr)
+	if err != nil {
+		http.Error(w, "Invalid plan ID", http.StatusBadRequest)
+		return
+	}
+
+	err = h.planService.DeletePlan(id)
+	if err != nil {
+		log.Printf("❌ Error deleting plan: %v", err)
+		switch err {
+		case service.ErrPlanNotFound:
+			http.Error(w, "Plan not found", http.StatusNotFound)
+		default:
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
+		}
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"message": "Plan deleted successfully",
+	})
+	log.Printf("✅ Plan deleted: %s", idStr)
+}
+
+// GetPlanByUserCount returns a plan for a given user count
+func (h *PlanHandler) GetPlanByUserCount(w http.ResponseWriter, r *http.Request) {
+	userCountStr := r.URL.Query().Get("user_count")
+	if userCountStr == "" {
+		http.Error(w, "user_count parameter required", http.StatusBadRequest)
+		return
+	}
+
+	userCount, err := strconv.Atoi(userCountStr)
+	if err != nil {
+		http.Error(w, "Invalid user_count", http.StatusBadRequest)
+		return
+	}
+
+	plan, err := h.planService.GetPlanByUserCount(userCount)
+	if err != nil {
+		http.Error(w, "No plan available for this user count", http.StatusNotFound)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"plan": plan,
+	})
+}

backend/internal/api/handlers/tenant.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"encoding/json"
+	"log"
 	"net/http"
 
 	"aggios-app/backend/internal/domain"
@@ -100,6 +101,8 @@ func (h *TenantHandler) GetPublicConfig(w http.ResponseWriter, r *http.Request)
 		"logo_horizontal_url": tenant.LogoHorizontalURL,
 	}
 
+	log.Printf("📤 Returning tenant config for %s: logo_url=%s", subdomain, tenant.LogoURL)
+
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	json.NewEncoder(w).Encode(response)
 }

backend/internal/domain/plan.go

@@ -0,0 +1,78 @@
+package domain
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/lib/pq"
+	"github.com/shopspring/decimal"
+)
+
+// Plan represents a subscription plan in the system
+type Plan struct {
+	ID              uuid.UUID           `json:"id" db:"id"`
+	Name            string              `json:"name" db:"name"`
+	Slug            string              `json:"slug" db:"slug"`
+	Description     string              `json:"description" db:"description"`
+	MinUsers        int                 `json:"min_users" db:"min_users"`
+	MaxUsers        int                 `json:"max_users" db:"max_users"` // -1 means unlimited
+	MonthlyPrice    *decimal.Decimal    `json:"monthly_price" db:"monthly_price"`
+	AnnualPrice     *decimal.Decimal    `json:"annual_price" db:"annual_price"`
+	Features        pq.StringArray      `json:"features" db:"features"`
+	Differentiators pq.StringArray      `json:"differentiators" db:"differentiators"`
+	StorageGB       int                 `json:"storage_gb" db:"storage_gb"`
+	IsActive        bool                `json:"is_active" db:"is_active"`
+	CreatedAt       time.Time           `json:"created_at" db:"created_at"`
+	UpdatedAt       time.Time           `json:"updated_at" db:"updated_at"`
+}
+
+// CreatePlanRequest represents the request to create a new plan
+type CreatePlanRequest struct {
+	Name            string     `json:"name" validate:"required"`
+	Slug            string     `json:"slug" validate:"required"`
+	Description     string     `json:"description"`
+	MinUsers        int        `json:"min_users" validate:"required,min=1"`
+	MaxUsers        int        `json:"max_users" validate:"required"` // -1 for unlimited
+	MonthlyPrice    *float64   `json:"monthly_price"`
+	AnnualPrice     *float64   `json:"annual_price"`
+	Features        []string   `json:"features"`
+	Differentiators []string   `json:"differentiators"`
+	StorageGB       int        `json:"storage_gb" validate:"required,min=1"`
+	IsActive        bool       `json:"is_active"`
+}
+
+// UpdatePlanRequest represents the request to update a plan
+type UpdatePlanRequest struct {
+	Name            *string    `json:"name"`
+	Slug            *string    `json:"slug"`
+	Description     *string    `json:"description"`
+	MinUsers        *int       `json:"min_users"`
+	MaxUsers        *int       `json:"max_users"`
+	MonthlyPrice    *float64   `json:"monthly_price"`
+	AnnualPrice     *float64   `json:"annual_price"`
+	Features        []string   `json:"features"`
+	Differentiators []string   `json:"differentiators"`
+	StorageGB       *int       `json:"storage_gb"`
+	IsActive        *bool      `json:"is_active"`
+}
+
+// Subscription represents an agency's subscription to a plan
+type Subscription struct {
+	ID          uuid.UUID `json:"id" db:"id"`
+	AgencyID    uuid.UUID `json:"agency_id" db:"agency_id"`
+	PlanID      uuid.UUID `json:"plan_id" db:"plan_id"`
+	BillingType string    `json:"billing_type" db:"billing_type"` // monthly or annual
+	CurrentUsers int      `json:"current_users" db:"current_users"`
+	Status      string    `json:"status" db:"status"` // active, suspended, cancelled
+	StartDate   time.Time `json:"start_date" db:"start_date"`
+	RenewalDate time.Time `json:"renewal_date" db:"renewal_date"`
+	CreatedAt   time.Time `json:"created_at" db:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at" db:"updated_at"`
+}
+
+// CreateSubscriptionRequest represents the request to create a subscription
+type CreateSubscriptionRequest struct {
+	AgencyID    uuid.UUID `json:"agency_id" validate:"required"`
+	PlanID      uuid.UUID `json:"plan_id" validate:"required"`
+	BillingType string    `json:"billing_type" validate:"required,oneof=monthly annual"`
+}

backend/internal/repository/plan_repository.go

@@ -0,0 +1,283 @@
+package repository
+
+import (
+	"database/sql"
+	"time"
+
+	"aggios-app/backend/internal/domain"
+
+	"github.com/google/uuid"
+	"github.com/lib/pq"
+)
+
+// PlanRepository handles database operations for plans
+type PlanRepository struct {
+	db *sql.DB
+}
+
+// NewPlanRepository creates a new plan repository
+func NewPlanRepository(db *sql.DB) *PlanRepository {
+	return &PlanRepository{db: db}
+}
+
+// Create creates a new plan
+func (r *PlanRepository) Create(plan *domain.Plan) error {
+	query := `
+		INSERT INTO plans (id, name, slug, description, min_users, max_users, monthly_price, annual_price, features, differentiators, storage_gb, is_active, created_at, updated_at)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)
+		RETURNING id, created_at, updated_at
+	`
+
+	now := time.Now()
+	plan.ID = uuid.New()
+	plan.CreatedAt = now
+	plan.UpdatedAt = now
+
+	features := pq.Array(plan.Features)
+	differentiators := pq.Array(plan.Differentiators)
+
+	return r.db.QueryRow(
+		query,
+		plan.ID,
+		plan.Name,
+		plan.Slug,
+		plan.Description,
+		plan.MinUsers,
+		plan.MaxUsers,
+		plan.MonthlyPrice,
+		plan.AnnualPrice,
+		features,
+		differentiators,
+		plan.StorageGB,
+		plan.IsActive,
+		plan.CreatedAt,
+		plan.UpdatedAt,
+	).Scan(&plan.ID, &plan.CreatedAt, &plan.UpdatedAt)
+}
+
+// GetByID retrieves a plan by ID
+func (r *PlanRepository) GetByID(id uuid.UUID) (*domain.Plan, error) {
+	query := `
+		SELECT id, name, slug, description, min_users, max_users, monthly_price, annual_price, features, differentiators, storage_gb, is_active, created_at, updated_at
+		FROM plans
+		WHERE id = $1
+	`
+
+	plan := &domain.Plan{}
+	var features, differentiators pq.StringArray
+
+	err := r.db.QueryRow(query, id).Scan(
+		&plan.ID,
+		&plan.Name,
+		&plan.Slug,
+		&plan.Description,
+		&plan.MinUsers,
+		&plan.MaxUsers,
+		&plan.MonthlyPrice,
+		&plan.AnnualPrice,
+		&features,
+		&differentiators,
+		&plan.StorageGB,
+		&plan.IsActive,
+		&plan.CreatedAt,
+		&plan.UpdatedAt,
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	plan.Features = []string(features)
+	plan.Differentiators = []string(differentiators)
+
+	return plan, nil
+}
+
+// GetBySlug retrieves a plan by slug
+func (r *PlanRepository) GetBySlug(slug string) (*domain.Plan, error) {
+	query := `
+		SELECT id, name, slug, description, min_users, max_users, monthly_price, annual_price, features, differentiators, storage_gb, is_active, created_at, updated_at
+		FROM plans
+		WHERE slug = $1
+	`
+
+	plan := &domain.Plan{}
+	var features, differentiators pq.StringArray
+
+	err := r.db.QueryRow(query, slug).Scan(
+		&plan.ID,
+		&plan.Name,
+		&plan.Slug,
+		&plan.Description,
+		&plan.MinUsers,
+		&plan.MaxUsers,
+		&plan.MonthlyPrice,
+		&plan.AnnualPrice,
+		&features,
+		&differentiators,
+		&plan.StorageGB,
+		&plan.IsActive,
+		&plan.CreatedAt,
+		&plan.UpdatedAt,
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	plan.Features = []string(features)
+	plan.Differentiators = []string(differentiators)
+
+	return plan, nil
+}
+
+// ListAll retrieves all plans
+func (r *PlanRepository) ListAll() ([]*domain.Plan, error) {
+	query := `
+		SELECT id, name, slug, description, min_users, max_users, monthly_price, annual_price, features, differentiators, storage_gb, is_active, created_at, updated_at
+		FROM plans
+		ORDER BY min_users ASC
+	`
+
+	rows, err := r.db.Query(query)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var plans []*domain.Plan
+
+	for rows.Next() {
+		plan := &domain.Plan{}
+		var features, differentiators pq.StringArray
+
+		err := rows.Scan(
+			&plan.ID,
+			&plan.Name,
+			&plan.Slug,
+			&plan.Description,
+			&plan.MinUsers,
+			&plan.MaxUsers,
+			&plan.MonthlyPrice,
+			&plan.AnnualPrice,
+			&features,
+			&differentiators,
+			&plan.StorageGB,
+			&plan.IsActive,
+			&plan.CreatedAt,
+			&plan.UpdatedAt,
+		)
+
+		if err != nil {
+			return nil, err
+		}
+
+		plan.Features = []string(features)
+		plan.Differentiators = []string(differentiators)
+		plans = append(plans, plan)
+	}
+
+	return plans, rows.Err()
+}
+
+// ListActive retrieves all active plans
+func (r *PlanRepository) ListActive() ([]*domain.Plan, error) {
+	query := `
+		SELECT id, name, slug, description, min_users, max_users, monthly_price, annual_price, features, differentiators, storage_gb, is_active, created_at, updated_at
+		FROM plans
+		WHERE is_active = true
+		ORDER BY min_users ASC
+	`
+
+	rows, err := r.db.Query(query)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var plans []*domain.Plan
+
+	for rows.Next() {
+		plan := &domain.Plan{}
+		var features, differentiators pq.StringArray
+
+		err := rows.Scan(
+			&plan.ID,
+			&plan.Name,
+			&plan.Slug,
+			&plan.Description,
+			&plan.MinUsers,
+			&plan.MaxUsers,
+			&plan.MonthlyPrice,
+			&plan.AnnualPrice,
+			&features,
+			&differentiators,
+			&plan.StorageGB,
+			&plan.IsActive,
+			&plan.CreatedAt,
+			&plan.UpdatedAt,
+		)
+
+		if err != nil {
+			return nil, err
+		}
+
+		plan.Features = []string(features)
+		plan.Differentiators = []string(differentiators)
+		plans = append(plans, plan)
+	}
+
+	return plans, rows.Err()
+}
+
+// Update updates a plan
+func (r *PlanRepository) Update(plan *domain.Plan) error {
+	query := `
+		UPDATE plans
+		SET name = $2, slug = $3, description = $4, min_users = $5, max_users = $6, monthly_price = $7, annual_price = $8, features = $9, differentiators = $10, storage_gb = $11, is_active = $12, updated_at = $13
+		WHERE id = $1
+		RETURNING updated_at
+	`
+
+	plan.UpdatedAt = time.Now()
+
+	features := pq.Array(plan.Features)
+	differentiators := pq.Array(plan.Differentiators)
+
+	return r.db.QueryRow(
+		query,
+		plan.ID,
+		plan.Name,
+		plan.Slug,
+		plan.Description,
+		plan.MinUsers,
+		plan.MaxUsers,
+		plan.MonthlyPrice,
+		plan.AnnualPrice,
+		features,
+		differentiators,
+		plan.StorageGB,
+		plan.IsActive,
+		plan.UpdatedAt,
+	).Scan(&plan.UpdatedAt)
+}
+
+// Delete deletes a plan
+func (r *PlanRepository) Delete(id uuid.UUID) error {
+	query := `DELETE FROM plans WHERE id = $1`
+	result, err := r.db.Exec(query, id)
+	if err != nil {
+		return err
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+
+	if rowsAffected == 0 {
+		return sql.ErrNoRows
+	}
+
+	return nil
+}

backend/internal/repository/subscription_repository.go

@@ -0,0 +1,203 @@
+package repository
+
+import (
+	"database/sql"
+	"time"
+
+	"aggios-app/backend/internal/domain"
+
+	"github.com/google/uuid"
+)
+
+// SubscriptionRepository handles database operations for subscriptions
+type SubscriptionRepository struct {
+	db *sql.DB
+}
+
+// NewSubscriptionRepository creates a new subscription repository
+func NewSubscriptionRepository(db *sql.DB) *SubscriptionRepository {
+	return &SubscriptionRepository{db: db}
+}
+
+// Create creates a new subscription
+func (r *SubscriptionRepository) Create(subscription *domain.Subscription) error {
+	query := `
+		INSERT INTO agency_subscriptions (id, agency_id, plan_id, billing_type, current_users, status, start_date, renewal_date, created_at, updated_at)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+		RETURNING id, created_at, updated_at
+	`
+
+	now := time.Now()
+	subscription.ID = uuid.New()
+	subscription.CreatedAt = now
+	subscription.UpdatedAt = now
+	subscription.StartDate = now
+
+	// Set renewal date based on billing type
+	if subscription.BillingType == "annual" {
+		subscription.RenewalDate = now.AddDate(1, 0, 0)
+	} else {
+		subscription.RenewalDate = now.AddDate(0, 1, 0)
+	}
+
+	return r.db.QueryRow(
+		query,
+		subscription.ID,
+		subscription.AgencyID,
+		subscription.PlanID,
+		subscription.BillingType,
+		subscription.CurrentUsers,
+		subscription.Status,
+		subscription.StartDate,
+		subscription.RenewalDate,
+		subscription.CreatedAt,
+		subscription.UpdatedAt,
+	).Scan(&subscription.ID, &subscription.CreatedAt, &subscription.UpdatedAt)
+}
+
+// GetByID retrieves a subscription by ID
+func (r *SubscriptionRepository) GetByID(id uuid.UUID) (*domain.Subscription, error) {
+	query := `
+		SELECT id, agency_id, plan_id, billing_type, current_users, status, start_date, renewal_date, created_at, updated_at
+		FROM agency_subscriptions
+		WHERE id = $1
+	`
+
+	subscription := &domain.Subscription{}
+	err := r.db.QueryRow(query, id).Scan(
+		&subscription.ID,
+		&subscription.AgencyID,
+		&subscription.PlanID,
+		&subscription.BillingType,
+		&subscription.CurrentUsers,
+		&subscription.Status,
+		&subscription.StartDate,
+		&subscription.RenewalDate,
+		&subscription.CreatedAt,
+		&subscription.UpdatedAt,
+	)
+
+	return subscription, err
+}
+
+// GetByAgencyID retrieves a subscription by agency ID
+func (r *SubscriptionRepository) GetByAgencyID(agencyID uuid.UUID) (*domain.Subscription, error) {
+	query := `
+		SELECT id, agency_id, plan_id, billing_type, current_users, status, start_date, renewal_date, created_at, updated_at
+		FROM agency_subscriptions
+		WHERE agency_id = $1 AND status = 'active'
+		LIMIT 1
+	`
+
+	subscription := &domain.Subscription{}
+	err := r.db.QueryRow(query, agencyID).Scan(
+		&subscription.ID,
+		&subscription.AgencyID,
+		&subscription.PlanID,
+		&subscription.BillingType,
+		&subscription.CurrentUsers,
+		&subscription.Status,
+		&subscription.StartDate,
+		&subscription.RenewalDate,
+		&subscription.CreatedAt,
+		&subscription.UpdatedAt,
+	)
+
+	return subscription, err
+}
+
+// ListAll retrieves all subscriptions
+func (r *SubscriptionRepository) ListAll() ([]*domain.Subscription, error) {
+	query := `
+		SELECT id, agency_id, plan_id, billing_type, current_users, status, start_date, renewal_date, created_at, updated_at
+		FROM agency_subscriptions
+		ORDER BY created_at DESC
+	`
+
+	rows, err := r.db.Query(query)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var subscriptions []*domain.Subscription
+
+	for rows.Next() {
+		subscription := &domain.Subscription{}
+		err := rows.Scan(
+			&subscription.ID,
+			&subscription.AgencyID,
+			&subscription.PlanID,
+			&subscription.BillingType,
+			&subscription.CurrentUsers,
+			&subscription.Status,
+			&subscription.StartDate,
+			&subscription.RenewalDate,
+			&subscription.CreatedAt,
+			&subscription.UpdatedAt,
+		)
+
+		if err != nil {
+			return nil, err
+		}
+
+		subscriptions = append(subscriptions, subscription)
+	}
+
+	return subscriptions, rows.Err()
+}
+
+// Update updates a subscription
+func (r *SubscriptionRepository) Update(subscription *domain.Subscription) error {
+	query := `
+		UPDATE agency_subscriptions
+		SET plan_id = $2, billing_type = $3, current_users = $4, status = $5, renewal_date = $6, updated_at = $7
+		WHERE id = $1
+		RETURNING updated_at
+	`
+
+	subscription.UpdatedAt = time.Now()
+
+	return r.db.QueryRow(
+		query,
+		subscription.ID,
+		subscription.PlanID,
+		subscription.BillingType,
+		subscription.CurrentUsers,
+		subscription.Status,
+		subscription.RenewalDate,
+		subscription.UpdatedAt,
+	).Scan(&subscription.UpdatedAt)
+}
+
+// Delete deletes a subscription
+func (r *SubscriptionRepository) Delete(id uuid.UUID) error {
+	query := `DELETE FROM agency_subscriptions WHERE id = $1`
+	result, err := r.db.Exec(query, id)
+	if err != nil {
+		return err
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+
+	if rowsAffected == 0 {
+		return sql.ErrNoRows
+	}
+
+	return nil
+}
+
+// UpdateUserCount updates the current user count for a subscription
+func (r *SubscriptionRepository) UpdateUserCount(agencyID uuid.UUID, userCount int) error {
+	query := `
+		UPDATE agency_subscriptions
+		SET current_users = $2, updated_at = $3
+		WHERE agency_id = $1 AND status = 'active'
+	`
+
+	_, err := r.db.Exec(query, agencyID, userCount, time.Now())
+	return err
+}

backend/internal/service/plan_service.go

@@ -0,0 +1,286 @@
+package service
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+
+	"aggios-app/backend/internal/domain"
+	"aggios-app/backend/internal/repository"
+
+	"github.com/google/uuid"
+	"github.com/shopspring/decimal"
+)
+
+var (
+	ErrPlanNotFound           = errors.New("plan not found")
+	ErrPlanSlugTaken          = errors.New("plan slug already exists")
+	ErrInvalidUserRange       = errors.New("invalid user range: min_users must be less than or equal to max_users")
+	ErrSubscriptionNotFound   = errors.New("subscription not found")
+	ErrUserLimitExceeded      = errors.New("user limit exceeded for this plan")
+	ErrSubscriptionExists     = errors.New("agency already has an active subscription")
+)
+
+// PlanService handles plan business logic
+type PlanService struct {
+	planRepo         *repository.PlanRepository
+	subscriptionRepo *repository.SubscriptionRepository
+}
+
+// NewPlanService creates a new plan service
+func NewPlanService(planRepo *repository.PlanRepository, subscriptionRepo *repository.SubscriptionRepository) *PlanService {
+	return &PlanService{
+		planRepo:         planRepo,
+		subscriptionRepo: subscriptionRepo,
+	}
+}
+
+// CreatePlan creates a new plan
+func (s *PlanService) CreatePlan(req *domain.CreatePlanRequest) (*domain.Plan, error) {
+	// Validate user range
+	if req.MinUsers > req.MaxUsers && req.MaxUsers != -1 {
+		return nil, ErrInvalidUserRange
+	}
+
+	// Check if slug is unique
+	existing, _ := s.planRepo.GetBySlug(req.Slug)
+	if existing != nil {
+		return nil, ErrPlanSlugTaken
+	}
+
+	plan := &domain.Plan{
+		Name:            req.Name,
+		Slug:            req.Slug,
+		Description:     req.Description,
+		MinUsers:        req.MinUsers,
+		MaxUsers:        req.MaxUsers,
+		Features:        req.Features,
+		Differentiators: req.Differentiators,
+		StorageGB:       req.StorageGB,
+		IsActive:        req.IsActive,
+	}
+
+	// Convert prices if provided
+	if req.MonthlyPrice != nil {
+		price := decimal.NewFromFloat(*req.MonthlyPrice)
+		plan.MonthlyPrice = &price
+	}
+	if req.AnnualPrice != nil {
+		price := decimal.NewFromFloat(*req.AnnualPrice)
+		plan.AnnualPrice = &price
+	}
+
+	if err := s.planRepo.Create(plan); err != nil {
+		return nil, err
+	}
+
+	return plan, nil
+}
+
+// GetPlan retrieves a plan by ID
+func (s *PlanService) GetPlan(id uuid.UUID) (*domain.Plan, error) {
+	plan, err := s.planRepo.GetByID(id)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, ErrPlanNotFound
+		}
+		return nil, err
+	}
+	return plan, nil
+}
+
+// ListPlans retrieves all plans
+func (s *PlanService) ListPlans() ([]*domain.Plan, error) {
+	return s.planRepo.ListAll()
+}
+
+// ListActivePlans retrieves all active plans
+func (s *PlanService) ListActivePlans() ([]*domain.Plan, error) {
+	return s.planRepo.ListActive()
+}
+
+// UpdatePlan updates a plan
+func (s *PlanService) UpdatePlan(id uuid.UUID, req *domain.UpdatePlanRequest) (*domain.Plan, error) {
+	plan, err := s.planRepo.GetByID(id)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, ErrPlanNotFound
+		}
+		return nil, err
+	}
+
+	// Update fields if provided
+	if req.Name != nil {
+		plan.Name = *req.Name
+	}
+	if req.Slug != nil {
+		// Check if new slug is unique
+		existing, _ := s.planRepo.GetBySlug(*req.Slug)
+		if existing != nil && existing.ID != plan.ID {
+			return nil, ErrPlanSlugTaken
+		}
+		plan.Slug = *req.Slug
+	}
+	if req.Description != nil {
+		plan.Description = *req.Description
+	}
+	if req.MinUsers != nil {
+		plan.MinUsers = *req.MinUsers
+	}
+	if req.MaxUsers != nil {
+		plan.MaxUsers = *req.MaxUsers
+	}
+	if req.MonthlyPrice != nil {
+		price := decimal.NewFromFloat(*req.MonthlyPrice)
+		plan.MonthlyPrice = &price
+	}
+	if req.AnnualPrice != nil {
+		price := decimal.NewFromFloat(*req.AnnualPrice)
+		plan.AnnualPrice = &price
+	}
+	if req.Features != nil {
+		plan.Features = req.Features
+	}
+	if req.Differentiators != nil {
+		plan.Differentiators = req.Differentiators
+	}
+	if req.StorageGB != nil {
+		plan.StorageGB = *req.StorageGB
+	}
+	if req.IsActive != nil {
+		plan.IsActive = *req.IsActive
+	}
+
+	// Validate user range
+	if plan.MinUsers > plan.MaxUsers && plan.MaxUsers != -1 {
+		return nil, ErrInvalidUserRange
+	}
+
+	if err := s.planRepo.Update(plan); err != nil {
+		return nil, err
+	}
+
+	return plan, nil
+}
+
+// DeletePlan deletes a plan
+func (s *PlanService) DeletePlan(id uuid.UUID) error {
+	// Check if plan exists
+	if _, err := s.planRepo.GetByID(id); err != nil {
+		if err == sql.ErrNoRows {
+			return ErrPlanNotFound
+		}
+		return err
+	}
+
+	return s.planRepo.Delete(id)
+}
+
+// CreateSubscription creates a new subscription for an agency
+func (s *PlanService) CreateSubscription(req *domain.CreateSubscriptionRequest) (*domain.Subscription, error) {
+	// Check if plan exists
+	plan, err := s.planRepo.GetByID(req.PlanID)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, ErrPlanNotFound
+		}
+		return nil, err
+	}
+
+	// Check if agency already has active subscription
+	existing, err := s.subscriptionRepo.GetByAgencyID(req.AgencyID)
+	if err != nil && err != sql.ErrNoRows {
+		return nil, err
+	}
+	if existing != nil {
+		return nil, ErrSubscriptionExists
+	}
+
+	subscription := &domain.Subscription{
+		AgencyID:    req.AgencyID,
+		PlanID:      req.PlanID,
+		BillingType: req.BillingType,
+		Status:      "active",
+		CurrentUsers: 0,
+	}
+
+	if err := s.subscriptionRepo.Create(subscription); err != nil {
+		return nil, err
+	}
+
+	// Load plan details
+	subscription.PlanID = plan.ID
+
+	return subscription, nil
+}
+
+// GetSubscription retrieves a subscription by ID
+func (s *PlanService) GetSubscription(id uuid.UUID) (*domain.Subscription, error) {
+	subscription, err := s.subscriptionRepo.GetByID(id)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, ErrSubscriptionNotFound
+		}
+		return nil, err
+	}
+	return subscription, nil
+}
+
+// GetAgencySubscription retrieves an agency's active subscription
+func (s *PlanService) GetAgencySubscription(agencyID uuid.UUID) (*domain.Subscription, error) {
+	subscription, err := s.subscriptionRepo.GetByAgencyID(agencyID)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, ErrSubscriptionNotFound
+		}
+		return nil, err
+	}
+	return subscription, nil
+}
+
+// ListSubscriptions retrieves all subscriptions
+func (s *PlanService) ListSubscriptions() ([]*domain.Subscription, error) {
+	return s.subscriptionRepo.ListAll()
+}
+
+// ValidateUserLimit checks if adding a user would exceed plan limit
+func (s *PlanService) ValidateUserLimit(agencyID uuid.UUID, newUserCount int) error {
+	subscription, err := s.subscriptionRepo.GetByAgencyID(agencyID)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return ErrSubscriptionNotFound
+		}
+		return err
+	}
+
+	plan, err := s.planRepo.GetByID(subscription.PlanID)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return ErrPlanNotFound
+		}
+		return err
+	}
+
+	if plan.MaxUsers != -1 && newUserCount > plan.MaxUsers {
+		return fmt.Errorf("%w (limit: %d, requested: %d)", ErrUserLimitExceeded, plan.MaxUsers, newUserCount)
+	}
+
+	return nil
+}
+
+// GetPlanByUserCount returns the appropriate plan for a given user count
+func (s *PlanService) GetPlanByUserCount(userCount int) (*domain.Plan, error) {
+	plans, err := s.planRepo.ListActive()
+	if err != nil {
+		return nil, err
+	}
+
+	// Find the plan that fits the user count
+	for _, plan := range plans {
+		if userCount >= plan.MinUsers && (plan.MaxUsers == -1 || userCount <= plan.MaxUsers) {
+			return plan, nil
+		}
+	}
+
+	return nil, fmt.Errorf("no plan found for user count: %d", userCount)
+}