🔑
JWT Auth & Silent Refresh
Access + refresh tokens. Silent refresh prevents random logouts.
- Access token (short-lived) for API requests
- Refresh token (long-lived) for silent renewal
- APP_INITIALIZER validates token on page load
- If access token expires → automatic silent refresh
- Only explicit 401/403 on refresh clears session
- Network errors → keep session, user can retry
- HTTP interceptor adds auth header to every request
🛡️
RBAC Permission Checks
Every request checks roles and permissions. Granular access control.
- @token_required decorator on every API endpoint
- User roles checked against required permissions
- Frontend hides UI elements based on permissions (e.g., cost fields)
- Backend enforces — UI hiding is just convenience, not security
🏢
Tenant Isolation
Every query filtered by tenant_id. Complete company data separation.
- Every table has tenant_id column (UUID)
- get_tenant_id() extracts from JWT token
- check_tenant_access() validates on every query
- Row-level isolation — not separate databases
- Super admin can access all tenants for support
📝
Audit Trail
Every create, update, delete logged with who and when.
- created_at, created_by on every record
- updated_at, updated_by tracked on every change
- Soft deletes: is_active=false, deleted_at, deleted_by
- Cost history: dedicated audit log for financial changes
- Subscription audit log for plan changes
- Safety inspection audit log for compliance
📱
Sync Engine & Offline
Delta sync, PWA service worker, Flutter mobile app for field workers.
- Device ID assigned to each browser/device
- Delta sync: GET /api/v1/sync/pull?since=timestamp
- Health check every 30 seconds: GET /api/v1/sync/health
- Angular service worker for offline caching (production)
- Flutter mobile app for inventory management on the go
- Conflict resolution for concurrent edits
💳
Subscription Enforcement
Modules, features, and usage limits enforced per plan. Auto-trial expiration.
- Sidebar navigation filtered by subscription
- API endpoints check subscription before processing
- Usage counters (projects, users, storage) checked against limits
- Grace period before full lockout on expiry
- Upgrade prompts when limits are approached