linus
e49eed871c
- Add package.json for backend dependencies and scripts. - Create Prisma schema for multi-tenant event management. - Implement main application module and configure global settings. - Develop authentication module with JWT and Authentik integration. - Create DTOs for guest account creation and KC management. - Implement role-based access control with custom guards and decorators. - Add services and controllers for managing KCs and guest accounts. - Set up global validation and CORS in the main application entry point. - Establish Prisma module for database access throughout the application. - Document project plan and architecture for multi-tenant platform.
38 lines
1.4 KiB
Markdown
38 lines
1.4 KiB
Markdown
# KC-App Backend
|
|
|
|
NestJS API for the KC-App platform (see repo root README + plan for
|
|
architecture context).
|
|
|
|
## Setup
|
|
|
|
```bash
|
|
npm install
|
|
cp .env.example .env # then fill in DATABASE_URL / AUTHENTIK_ISSUER_URL / GUEST_JWT_SECRET
|
|
npx prisma generate
|
|
npx prisma migrate dev --name init # requires a running PostgreSQL instance
|
|
npm run start:dev
|
|
```
|
|
|
|
## Auth model
|
|
|
|
- Team members (Leitungsteam, Gemeinde Verantwortliche, Gemeinde Teamer) are
|
|
provisioned in Authentik; this API acts as an OIDC **resource server**,
|
|
verifying access tokens against Authentik's JWKS (`AuthentikStrategy`) and
|
|
then resolving local `Membership` rows to determine role + KC/Gemeinde
|
|
scope. Clients perform the actual Authorization Code + PKCE flow against
|
|
Authentik directly.
|
|
- Guests/Konfis get a temporary local account (first/last name required, no
|
|
Authentik) created via `POST /auth/guest` with a KC invite code, returning
|
|
a JWT signed with `GUEST_JWT_SECRET`.
|
|
|
|
## Modules implemented so far
|
|
|
|
- `prisma/` — shared `PrismaClient` provider.
|
|
- `auth/` — Authentik resource-server strategy + guest invite-code login.
|
|
- `kc/` — KC (event) creation/listing, Leitungsteam-only.
|
|
- `common/` — `Role` enum, `@Roles()` decorator, `RolesGuard` (KC-scoped,
|
|
Leitungsteam roles are global across all KCs).
|
|
|
|
Not yet implemented: Wahl/Workshop/Zuteilung engine, file sharing, chat
|
|
realtime gateway, local/cloud sync engine.
|