valentinbvro
42cefaddb2
Specul de arhitectura cere Platform Kernel INAINTEA modulelor de domeniu. Modulele A1/A2 au fost construite peste un kernel caruia ii lipseau exact piesele astea. Le adaug acum, aditiv, fara sa rup ce merge. - workspaces: tenant != workspace. Workspace-ul e contextul de lucru DIN tenant. Backfill: fiecare tenant existent primeste workspace implicit, altfel SessionGuard i-ar respinge toate requesturile. - memberships.workspace_id + valid_from/valid_until: rol per workspace si acces delegat cu expirare (contabil pana la o data). SessionGuard respinge membership expirat si membership legat de alt workspace. - ExecutionContext inlocuieste sesiunea subtire (userId+tenantId+role): requestId, correlationId, workspaceId, membershipId, roles, permissions, purpose, timezone, source. Tipul vechi ramane exportat sub acelasi nume, ca sa nu ating ~15 module de domeniu doar pentru o redenumire. - GET /v1/navigation: menu registry mutat in backend. Filtreaza pe rol, tip de workspace, permisiuni si feature flags; intoarce doar itemii autorizati. Ramane UX, nu securitate -- fiecare endpoint verifica din nou. - event envelope: workspace_id, occurred_at, actor_id, aggregate_type, causation_id, classification, provenance - audit envelope: workspace_id, actor_type, purpose, changed_fields, before/after hash, session_id
14 lines
500 B
TypeScript
14 lines
500 B
TypeScript
import { Controller, Get } from '@nestjs/common';
|
|
import { CurrentSession } from '../auth/session.decorator';
|
|
import type { AuthenticatedSession } from '../auth/tenant.guard';
|
|
import { NavigationService } from './navigation.service';
|
|
|
|
@Controller('navigation')
|
|
export class NavigationController {
|
|
constructor(private readonly navigationService: NavigationService) {}
|
|
|
|
@Get()
|
|
get(@CurrentSession() session: AuthenticatedSession) {
|
|
return this.navigationService.getNavigation(session);
|
|
}
|
|
}
|