Files

Macky 3c22d88bcd feat: demo SaaS + training flow security hardening (8/8 review gate passed)

- Demo accounts: super_admin-only provisioning into isolated DEMO_ORG_ID tenant,
  30-day UTC trial on first login, revocable, one-time credential delivery via
  optional SES/webhook (never persisted). Adds boto3 dependency.
- Analytics/report/export/privacy: shared bounded scan budget across users/groups/
  sessions, tenant-consistent session/user/group joins, scalar-only CSV export
  (no nested persisted-value stringification).
- Ownership/tenant isolation: canonical owner-tenant predicate for list/read/chat;
  client sees is_owned only, never owner_user_id.
- Lifecycle/races: status transition validation, analyzing is an in-progress gate
  (no duplicate reanalysis), structured-ready publication, stale-variant revalidation.
- Auth/setup/consent/JWT/OAuth/config: fail-closed consent, bounded JWT lifetime,
  provider-subject atomic OAuth identity, repeated-secret rejection, strict Persona
  trait validation.
- Chat/session/privacy: pre-seller opener redaction, corrupt-session recovery,
  role-aware completed-chat dashboard routing.
- Frontend: Training→product→personas→practice flow, demo/role/demo guards,
  is_owned-based ownership display, 320×568 and 500×768 responsive E2E.
- 8 independent exact-five-key review scopes passed; backend 509, frontend 26,
  production build 1775 modules, isolated E2E 15.

2026-08-25 06:39:06 +07:00

3.7 KiB

Raw Blame History

2026-08-23 — Demo SaaS account provisioning and restricted trial

Date: 2026-08-23 Status: implemented + locally verified; live delivery, production operation, deployment, and push not performed

Scope

Added the demo role with a dedicated DEMO_ORG_ID tenant. Demo accounts can be created only through POST /api/admin/demo-accounts by a super_admin; generic user creation and direct role=demo mutations are blocked.
A demo account starts exactly one fixed 30-day UTC trial on its first successful password login. The trial timestamps are record-locked and idempotent. super_admin can revoke through POST /api/admin/demo-accounts/<username>/revoke (with the DELETE alias), deactivating the account and invalidating existing tokens.
Demo users can access only demo-visibility, ready groups in the demo tenant. Backend guards block cross-tenant access, group/persona creation, and visibility changes for the demo role.
Provisioning returns the generated username and temporary password once, together with SES and authenticated HTTPS webhook delivery status. Delivery is opt-in/best-effort; the temporary password is not retrievable later and is not persisted in user stores, audit logs, delivery events, or application logs.

Implementation surface

These are the implementation modules documented by this entry; this documentation update did not modify code or tests.

Backend configuration/wiring: backend/.env.example, backend/app/config.py, backend/app/factory.py, backend/requirements.txt, backend/requirements.lock.txt.
Identity and API policy: backend/app/auth/users.py, backend/app/api/auth_routes.py, backend/app/api/admin_routes.py, backend/app/api/group_routes.py, backend/app/api/chat_routes.py, backend/app/api/me_routes.py, and backend/app/api/helpers.py.
Delivery and storage: backend/app/services/demo_delivery.py and backend/app/services/groups.py.
Frontend wiring/UI: frontend/src/api/index.js, frontend/src/i18n/index.js, frontend/src/store/auth.js, frontend/src/router.spec.js, and the affected views AdminUsers.vue, GroupBuilder.vue, GroupEdit.vue, MyBoard.vue, Personas.vue, SessionDetail.vue, and Training.vue.
Focused regression coverage: backend/tests/test_demo_accounts.py.

Verification evidence

Command	Result
`cd backend && uv run pytest -q tests/test_demo_accounts.py`	10 passed
`cd backend && uv run pytest -q`	358 passed
`cd frontend && npm run test:unit` (Vitest)	5 passed
`cd frontend && npm run build`	passed

Limitations and remaining operational gates

SES delivery was not exercised against AWS. Before operational use, configure a verified SES_FROM_EMAIL, AWS_REGION, and the normal AWS credential chain (SES_REPLY_TO is optional).
Webhook delivery was not exercised against a live receiver. Configure HTTPS DEMO_WEBHOOK_URL and DEMO_WEBHOOK_SECRET; the secret is required for signed delivery.
Test/local configuration may leave SES and webhook settings blank, in which case delivery is reported as skipped while the one-time API response remains the credential handoff.
The remaining gate is a restricted-environment test with verified SES sender/AWS credentials and webhook secret, followed by operator approval. No live SES/webhook call, production operation, deployment, or push was performed.

Documentation updated

docs/HANDOFF.md — added the current Demo SaaS state, verification totals, required configuration, and explicit operational gates.
README.md — added a minimal Demo SaaS roles/permissions/trial note and pointed to backend/.env.example for demo/SES/webhook environment configuration.

3.7 KiB Raw Blame History