Joshua OosthuizenandClaude Sonnet 5
4acbc03b35
Root company app (src/, client/) — GL foundation, AR, and AP: - Segmented Chart of Accounts (Sage 300-style), double-entry PostingService with three-layer balance enforcement (app validation, CHECK constraints, deferred DB trigger), gap-free document numbering, RBAC with branch restrictions. - Accounts Receivable: Customers, Invoices, Credit Notes, Receipts with allocation, all posting through PostingService. - Accounts Payable: Suppliers, Supplier Invoices, Debit Notes, Payments with allocation, mirroring AR's posting pattern. - Tax Codes shared between AR and AP. - Company-app login is a token handoff from the Account Manager (RS256, single-use, company-scoped) rather than a local password. - Frontend reskinned to the approved mockup: navy sidebar, dashboard, tree-view Chart of Accounts, Customer/Supplier 360 pages. Account Manager (manager/, manager/client/) — central login gateway: - Password + TOTP 2FA + Google/Microsoft OAuth, company picker, and the RS256 handoff token issuance that the company app verifies. Covered by unit + integration tests against a real Postgres database (GL balance invariants, AR/AP posting correctness and allocation limits, the full handoff exchange including replay/cross-company/expiry/forgery rejection). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Tq2DbEvzHzs13jDFhLaX44
41 lines
1.3 KiB
TypeScript
41 lines
1.3 KiB
TypeScript
/**
|
|
* Generates the RSA keypair used to sign (Manager) and verify (every company app) handoff
|
|
* tokens. Run once per environment: npm run generate-handoff-keys
|
|
*/
|
|
import fs from 'fs';
|
|
import path from 'path';
|
|
import crypto from 'crypto';
|
|
|
|
const keysDir = path.resolve(__dirname, '..', 'keys');
|
|
|
|
function main() {
|
|
if (!fs.existsSync(keysDir)) {
|
|
fs.mkdirSync(keysDir, { recursive: true });
|
|
}
|
|
|
|
const privateKeyPath = path.join(keysDir, 'handoff-private.pem');
|
|
const publicKeyPath = path.join(keysDir, 'handoff-public.pem');
|
|
|
|
if (fs.existsSync(privateKeyPath) || fs.existsSync(publicKeyPath)) {
|
|
console.log('Handoff keypair already exists at manager/keys/ — not overwriting.');
|
|
console.log(` Private: ${privateKeyPath}`);
|
|
console.log(` Public: ${publicKeyPath}`);
|
|
return;
|
|
}
|
|
|
|
const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
|
|
modulusLength: 2048,
|
|
publicKeyEncoding: { type: 'spki', format: 'pem' },
|
|
privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
|
|
});
|
|
|
|
fs.writeFileSync(privateKeyPath, privateKey, { mode: 0o600 });
|
|
fs.writeFileSync(publicKeyPath, publicKey);
|
|
|
|
console.log('Generated handoff RS256 keypair:');
|
|
console.log(` Private (Manager only, never share): ${privateKeyPath}`);
|
|
console.log(` Public (copy into every company app's HANDOFF_PUBLIC_KEYS): ${publicKeyPath}`);
|
|
}
|
|
|
|
main();
|