security: Add proper authentication, RBAC, and tenant isolation

- Add password hashing with bcrypt - Add AuthService with proper login - Add password strength validation - Add RBAC middleware (AdminOnly, ManagerOrAdmin) - Add tenant isolation middleware - Update CRM handler with tenant filtering - Add JWT fallback for development mode - Add user context helpers - Build successful
2026-08-10 12:52:48 +00:00
parent 8921fd1467
commit 78b57273e2
141 changed files with 29192 additions and 180 deletions
@@ -0,0 +1,188 @@
+{
+  "openapi": "3.0.0",
+  "info": {
+    "title": "BOC API",
+    "description": "Business Operations Center API - LandveX",
+    "version": "1.0.0",
+    "contact": {
+      "name": "LandveX Support",
+      "email": "support@landvex.com"
+    }
+  },
+  "servers": [
+    {
+      "url": "http://localhost:9096",
+      "description": "Local development"
+    }
+  ],
+  "security": [
+    {
+      "bearerAuth": []
+    }
+  ],
+  "paths": {
+    "/health": {
+      "get": {
+        "summary": "Health check",
+        "tags": ["System"],
+        "responses": {
+          "200": {
+            "description": "Service is healthy",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "ok": { "type": "boolean" },
+                    "service": { "type": "string" },
+                    "version": { "type": "string" }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/v1/auth/me": {
+      "get": {
+        "summary": "Get current user",
+        "tags": ["Auth"],
+        "security": [{"bearerAuth": []}],
+        "responses": {
+          "200": {
+            "description": "User data",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "user": {
+                      "type": "object",
+                      "properties": {
+                        "sub": { "type": "string" },
+                        "email": { "type": "string" },
+                        "roles": { "type": "array", "items": { "type": "string" } }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - Valid Bearer token required"
+          }
+        }
+      }
+    },
+    "/api/v1/hr/employees": {
+      "get": {
+        "summary": "List employees",
+        "tags": ["HR"],
+        "security": [{"bearerAuth": []}],
+        "responses": {
+          "200": { "description": "List of employees" }
+        }
+      },
+      "post": {
+        "summary": "Create employee",
+        "tags": ["HR"],
+        "security": [{"bearerAuth": []}],
+        "responses": {
+          "201": { "description": "Employee created" }
+        }
+      }
+    },
+    "/api/v1/crm/customers": {
+      "get": {
+        "summary": "List customers",
+        "tags": ["CRM"],
+        "security": [{"bearerAuth": []}],
+        "responses": {
+          "200": { "description": "List of customers" }
+        }
+      }
+    },
+    "/api/v1/sales/deals": {
+      "get": {
+        "summary": "List deals",
+        "tags": ["Sales"],
+        "security": [{"bearerAuth": []}],
+        "responses": {
+          "200": { "description": "List of deals" }
+        }
+      }
+    },
+    "/api/v1/legal/contracts": {
+      "get": {
+        "summary": "List contracts",
+        "tags": ["Legal"],
+        "security": [{"bearerAuth": []}],
+        "responses": {
+          "200": { "description": "List of contracts" }
+        }
+      }
+    },
+    "/api/v1/marketing/campaigns": {
+      "get": {
+        "summary": "List campaigns",
+        "tags": ["Marketing"],
+        "security": [{"bearerAuth": []}],
+        "responses": {
+          "200": { "description": "List of campaigns" }
+        }
+      }
+    },
+    "/api/v1/support/tickets": {
+      "get": {
+        "summary": "List tickets",
+        "tags": ["Support"],
+        "security": [{"bearerAuth": []}],
+        "responses": {
+          "200": { "description": "List of tickets" }
+        }
+      }
+    },
+    "/api/v1/analytics/dashboard": {
+      "get": {
+        "summary": "Get dashboard data",
+        "tags": ["Analytics"],
+        "security": [{"bearerAuth": []}],
+        "responses": {
+          "200": { "description": "Dashboard data" }
+        }
+      }
+    },
+    "/api/v1/finance/balance": {
+      "get": {
+        "summary": "Get balance sheet",
+        "tags": ["Finance"],
+        "security": [{"bearerAuth": []}],
+        "responses": {
+          "200": { "description": "Balance sheet data" }
+        }
+      }
+    },
+    "/api/v1/briefing/daily": {
+      "get": {
+        "summary": "Get daily briefing",
+        "tags": ["Briefing"],
+        "security": [{"bearerAuth": []}],
+        "responses": {
+          "200": { "description": "Daily briefing data" }
+        }
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "bearerAuth": {
+        "type": "http",
+        "scheme": "bearer",
+        "bearerFormat": "JWT",
+        "description": "RS256 JWT token from ouroboros-identity"
+      }
+    }
+  }
+}