12c8615615
Adds accounting-service PATCH/archive, fiscal helpers, COA templates and setup status, plus SuperApp Accounting UI (DS, scoreboard, masters, vouchers, ledger, ops modules) with session refresh and HTTPS public API URLs. Co-authored-by: Cursor <cursoragent@cursor.com>
1.4 KiB
1.4 KiB
Security Architecture
Principles
- Least privilege per role and service token scope.
- Secrets only in environment / secret stores — never in git.
- Tenant isolation on every business query.
- Auditable business actions (audit log).
- TLS at the edge for all public hosts.
Authentication Surfaces
| Surface | Mechanism |
|---|---|
| Platform / tenant staff | Keycloak OIDC JWT (RS256) |
| Local OTP (Core) | HS256 JWT after SMS verify |
| Service-to-service | Internal service token (hashed at rest) |
| Public tenant site | Unauthenticated read of public theme/site data only |
Token Rules
- Frontend sends
Authorization: Bearer <token>. - Services validate via shared JWT helpers (
shared/auth/jwt.py). - Internal tokens carry scopes; callers must hold required scope.
Edge
Nginx enforces HTTPS for platform hosts; tenant hosts redirect to HTTPS when SSL map marks them ready. ACME challenge paths remain HTTP.
Data Protection
- Passwords only in Keycloak (not Core).
- OTP codes are short-lived (
OTP_EXPIRE_SECONDS). - Token hashes stored for internal service tokens — raw tokens never persisted.