153 lines
4.8 KiB
JSON
153 lines
4.8 KiB
JSON
{
|
|
"schemaVersion": "1.0",
|
|
"id": "auth-tenancy",
|
|
"title": "Auth, Accounts, Tenancy, Roles",
|
|
"classification": "core",
|
|
"status": "proposed",
|
|
"owner": "core-pruning",
|
|
"description": "Authentication, account lifecycle, tenant membership, invitations, and authorization primitives.",
|
|
"rationale": [
|
|
"Every SaaS or app installation needs account access, tenant scoping, and permission enforcement.",
|
|
"Admin and tenant flows depend on the same membership and role foundations.",
|
|
"Operator admins need silent tenant inspection access without being seeded as tenant members."
|
|
],
|
|
"codeAreas": [
|
|
"apps/web/app/routes/login.tsx",
|
|
"apps/web/app/routes/register.tsx",
|
|
"apps/web/app/routes/forgot-password.tsx",
|
|
"apps/web/app/routes/reset.tsx",
|
|
"apps/web/app/routes/oauth/github/*",
|
|
"apps/web/app/services/auth/*",
|
|
"apps/web/app/routes/verify.$id.tsx",
|
|
"apps/web/app/routes/invitation.$id.tsx",
|
|
"apps/web/app/routes/admin/accounts*",
|
|
"apps/web/app/routes/app.$tenant/settings/*",
|
|
"apps/web/app/modules/users",
|
|
"apps/web/app/utils/services/apiService.ts",
|
|
"apps/web/app/utils/services/authService.ts",
|
|
"apps/web/app/utils/services/rolesAndPermissionsService.ts",
|
|
"packages/db/src/permissions-seed.server.ts"
|
|
],
|
|
"dependencies": [
|
|
"transactional-mail"
|
|
],
|
|
"consumers": [
|
|
"admin-app-shell",
|
|
"billing",
|
|
"rows-entities-runtime",
|
|
"plugin-candidates"
|
|
],
|
|
"integration": {
|
|
"ownership": "system-only",
|
|
"surfaces": {
|
|
"adminRoutes": [
|
|
"apps/web/app/routes/admin/accounts*"
|
|
],
|
|
"tenantRoutes": [
|
|
"apps/web/app/routes/app.$tenant/settings/*"
|
|
],
|
|
"publicRoutes": [
|
|
"apps/web/app/routes/login.tsx",
|
|
"apps/web/app/routes/register.tsx",
|
|
"apps/web/app/routes/forgot-password.tsx",
|
|
"apps/web/app/routes/reset.tsx",
|
|
"apps/web/app/routes/verify.$id.tsx",
|
|
"apps/web/app/routes/invitation.$id.tsx"
|
|
],
|
|
"apiRoutes": [
|
|
"apps/api/src/app.ts",
|
|
"/v1/auth/login",
|
|
"/v1/auth/refresh-token",
|
|
"/v1/auth/logout",
|
|
"/v1/session/current-user",
|
|
"/v1/accounts",
|
|
"/v1/accounts/:id",
|
|
"/v1/workspaces/:tenantId/auth/providers",
|
|
"/v1/workspaces/:tenantId/context/revalidate",
|
|
"/v1/workspaces/:tenantId/invites",
|
|
"/v1/workspaces/:tenantId/invites/:inviteId/accept",
|
|
"/v1/workspaces/:tenantId/invites/:inviteId/revoke"
|
|
]
|
|
},
|
|
"configuration": {
|
|
"admin": [
|
|
"Role and permission policy"
|
|
],
|
|
"tenant": [
|
|
"Tenant membership and invitations"
|
|
],
|
|
"environment": [
|
|
"CRYPTO_SECRET",
|
|
"JWT_SECRET",
|
|
"SESSION_SECRET",
|
|
"API_ACCESS_TOKEN",
|
|
"APP_BASE_DOMAIN",
|
|
"WEB_APP_HOST",
|
|
"ADMIN_APP_HOST",
|
|
"APP_PROTOCOL"
|
|
],
|
|
"secrets": [
|
|
"Session and auth secrets are environment-owned, never tenant-owned."
|
|
]
|
|
},
|
|
"workers": {
|
|
"required": false,
|
|
"queues": [],
|
|
"jobs": [],
|
|
"notes": [
|
|
"Auth flows may send email through transactional mail but do not own workers."
|
|
]
|
|
},
|
|
"externalProviders": [],
|
|
"permissions": [
|
|
"admin.accounts.*",
|
|
"admin.users.*",
|
|
"app.settings.members.*"
|
|
],
|
|
"auditEvents": [
|
|
"auth.login",
|
|
"tenant.member.invited",
|
|
"tenant.member.updated",
|
|
"role.permission.updated"
|
|
],
|
|
"billingImpacts": [],
|
|
"uat": [
|
|
"User can register/login/reset password.",
|
|
"Login, forgot-password, reset-password, and GitHub OAuth start/callback enforce CSRF or OAuth state and rate-limit policy.",
|
|
"Service-token validation uses a timing-safe comparison and rejects mismatched tenant-scope overrides.",
|
|
"Admin can manage accounts/users.",
|
|
"Tenant membership scoping is enforced for regular users.",
|
|
"Operator admins can inspect any active tenant space without explicit tenant membership."
|
|
]
|
|
},
|
|
"boundaries": {
|
|
"mustKeep": [
|
|
"Login, registration, password reset, verification, and invitations",
|
|
"Tenant membership and tenant-aware authorization",
|
|
"Roles and permissions needed by app and admin surfaces",
|
|
"Operator-admin tenant inspection bypass at server-side access boundaries only"
|
|
],
|
|
"mayMoveToPlugin": [
|
|
"Advanced account CRM enrichment",
|
|
"Optional feature-flagged role management enhancements"
|
|
],
|
|
"mustNotTouch": [
|
|
"Route implementations during manifest Phase 1",
|
|
"Sidebar/navigation ownership during parallel work"
|
|
]
|
|
},
|
|
"pruning": {
|
|
"phase": "1",
|
|
"action": "keep",
|
|
"notes": [
|
|
"Treat auth-tenancy as a blocking dependency for most other manifests."
|
|
]
|
|
},
|
|
"validation": {
|
|
"source": [
|
|
"docs/feature-inventory.md"
|
|
],
|
|
"lastReviewed": "2026-05-16"
|
|
}
|
|
}
|