Joshua OosthuizenandClaude Sonnet 5
4acbc03b35
Root company app (src/, client/) — GL foundation, AR, and AP: - Segmented Chart of Accounts (Sage 300-style), double-entry PostingService with three-layer balance enforcement (app validation, CHECK constraints, deferred DB trigger), gap-free document numbering, RBAC with branch restrictions. - Accounts Receivable: Customers, Invoices, Credit Notes, Receipts with allocation, all posting through PostingService. - Accounts Payable: Suppliers, Supplier Invoices, Debit Notes, Payments with allocation, mirroring AR's posting pattern. - Tax Codes shared between AR and AP. - Company-app login is a token handoff from the Account Manager (RS256, single-use, company-scoped) rather than a local password. - Frontend reskinned to the approved mockup: navy sidebar, dashboard, tree-view Chart of Accounts, Customer/Supplier 360 pages. Account Manager (manager/, manager/client/) — central login gateway: - Password + TOTP 2FA + Google/Microsoft OAuth, company picker, and the RS256 handoff token issuance that the company app verifies. Covered by unit + integration tests against a real Postgres database (GL balance invariants, AR/AP posting correctness and allocation limits, the full handoff exchange including replay/cross-company/expiry/forgery rejection). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Tq2DbEvzHzs13jDFhLaX44
31 lines
1.2 KiB
Bash
31 lines
1.2 KiB
Bash
DATABASE_URL="postgresql://USER:PASSWORD@localhost:5432/cfm_manager?schema=public"
|
|
PORT="5100"
|
|
|
|
# Manager-internal session tokens (Person sessions on the Manager app itself — never leave the Manager)
|
|
JWT_ACCESS_SECRET="change-me-access-secret"
|
|
JWT_REFRESH_SECRET="change-me-refresh-secret"
|
|
JWT_ACCESS_TTL="15m"
|
|
JWT_REFRESH_TTL="7d"
|
|
|
|
# RS256 keypair used to sign/verify handoff tokens. Generate once with:
|
|
# openssl genrsa -out manager/keys/handoff-private.pem 2048
|
|
# openssl rsa -in manager/keys/handoff-private.pem -pubout -out manager/keys/handoff-public.pem
|
|
# Both files are gitignored. Every company app is given a copy of the PUBLIC key only.
|
|
HANDOFF_PRIVATE_KEY_PATH="./keys/handoff-private.pem"
|
|
HANDOFF_PUBLIC_KEY_PATH="./keys/handoff-public.pem"
|
|
HANDOFF_TOKEN_TTL_SECONDS="90"
|
|
|
|
TOTP_ISSUER="Cross Financial Manager"
|
|
|
|
GOOGLE_CLIENT_ID=""
|
|
GOOGLE_CLIENT_SECRET=""
|
|
GOOGLE_REDIRECT_URI="http://localhost:5100/api/auth/oauth/google/callback"
|
|
|
|
MICROSOFT_CLIENT_ID=""
|
|
MICROSOFT_CLIENT_SECRET=""
|
|
MICROSOFT_TENANT="common"
|
|
MICROSOFT_REDIRECT_URI="http://localhost:5100/api/auth/oauth/microsoft/callback"
|
|
|
|
# Where the Manager's own frontend lives, used to build OAuth-return / redirect URLs
|
|
MANAGER_WEB_URL="http://localhost:5174"
|