2 Commits

Author	SHA1	Message	Date
Macky	056753e8cb	feat(saas): multi-tenant isolation (Phase 1) + rate-limit/audit/org-scoped export (Phase 2) ... Phase 1 (tenant isolation): - g.org_id set on require_auth; assert_tenant()/current_org_id() choke-point helpers. - Multi-org provisioning: POST /api/admin/users {new_org:true} (super_admin) creates a new org + its first admin; GET /api/admin/orgs (super_admin sees all, admin own). - Fixed latent create_org double-id bug (dict id != store key). - test_saas_tenant.py: org2 admin blocked from org1 group (403), can't list org1 groups/users, sees only own org; super_admin sees all. Phase 2 (hardening): - Rate limit login (per-IP + per-username) + chat send (per-user) to protect LLM cost and slow brute force; services/rate_limit.py (in-memory + disk, no external deps). - Audit log data/audit/audit.jsonl on org.create, user.promote_super_admin, analytics.export. - CSV export now org-scoped (admin exports only own org). All 8 backend suites pass.	2026-08-09 09:35:26 +07:00
Macky	c3d31c06e2	Sales Trainer v0.1: corporate sales-training simulator (Flask+Vue, 15 personas, chat simulator, judge, analytics) ... - Auth/roles (no self-reg), admin user provision, JWT - Analyze: sales kit + initial pain-fit from form/upload - Persona generator: 15 personas (5/tier) w/ pain variety, negotiation, init mode, channel, latent/revealable, wrong_text special - Chat simulator: per-mode initiation, one-shot, hidden signals, judge-LLM debrief+coaching - Trainee loop: win/lose board, weak-areas, user-generated personas - Admin analytics; EN+TH Vue SPA served by Flask - Deploy: Dockerfile, docker-compose, README, eng-log + HANDOFF - Tests (mock LLM): m0/m1/routes/e2e all pass	2026-08-07 15:31:06 +07:00