Mortezakoohjani 12c8615615 Ship enterprise Accounting FE/API with CRUD parity and production wiring.

Adds accounting-service PATCH/archive, fiscal helpers, COA templates and setup status, plus SuperApp Accounting UI (DS, scoreboard, masters, vouchers, ledger, ops modules) with session refresh and HTTPS public API URLs.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-07-24 15:26:43 +03:30

1.3 KiB

Raw Permalink Blame History

ADR-004: Central SSO with Keycloak

Field	Value
Status	Accepted
Date	2025-06-01
Deciders	Platform Architecture
Supersedes	—
Superseded by	—

Context

Platform staff, tenant staff, and multiple subsystem UIs need a single identity for the core SuperApp. Building a custom IdP is high risk.

Decision

Keycloak (superapp realm, torbatyar theme) is the only central login UX for platform and tenant staff. Identity & Access Service acts as BFF for OIDC token exchange, mobile OTP handoff, and profile sync. End-customer auth for tenant-facing modules may remain local to that module's database when SSO is optional.

Consequences

Positive

One login for staff across subsystems
Standard OIDC/JWT validation in all services
Themeable login without forking IdP core

Negative

Operational dependency on Keycloak
Dual user records (Keycloak + Core/Identity) require linking (keycloak_sub)

Alternatives Considered

Custom JWT-only auth without IdP
Auth0 / cloud IdP

1.3 KiB Raw Permalink Blame History