schalli/tessera-ctl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 14 Wiki Activity

docs(02): capture phase context

Browse Source
This commit is contained in:
Schalli
2026-06-18 12:48:31 +02:00
parent 8df059b5dd
commit 1ba3433158
2 changed files with 236 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/phases/02-authentication-multi-tenancy/02-DISCUSSION-LOG.md
+120
View File
@@ -0,0 +1,120 @@
# Phase 2: Authentication & Multi-Tenancy - Discussion Log
> **Audit trail only.** Do not use as input to planning, research, or execution agents.
**Date:** 2026-06-18
**Phase:** 2-Authentication & Multi-Tenancy
**Areas discussed:** Login-Flow, Admin-Setup, Mandanten-Modell, LDAP-Import
---
## Login-Flow
| Option | Description | Selected |
|--------|-------------|----------|
| Zentriert/Minimal | Logo + Formular mittig | |
| Split-Screen | Links Branding/Bild, rechts Formular | ✓ |
| Du entscheidest | Claude waehlt | |
**User's choice:** Split-Screen
| Option | Description | Selected |
|--------|-------------|----------|
| 8 Stunden | Arbeitstag | |
| 24 Stunden | Ein Tag | |
| 30 Tage + Remember | Langlebig mit Angemeldet-bleiben | ✓ |
| Du entscheidest | Claude waehlt | |
**User's choice:** 30 Tage + Remember
| Option | Description | Selected |
|--------|-------------|----------|
| Ja, per E-Mail | Reset-Link per E-Mail | |
| Nur Admin-Reset | Admin setzt manuell zurueck | |
| Beides | Self-Service + Admin-Reset | ✓ |
**User's choice:** Beides
---
## Admin-Setup
| Option | Description | Selected |
|--------|-------------|----------|
| E-Mail + Passwort | TESSERA_ADMIN_EMAIL + PASSWORD | |
| Username + Passwort | TESSERA_ADMIN_USER + PASSWORD | |
| Beides | Username + E-Mail + Passwort | ✓ |
**User's choice:** Beides (alle drei ENV-Variablen)
| Option | Description | Selected |
|--------|-------------|----------|
| Ja, Pflicht | Force-Change beim ersten Login | |
| Nein | ENV-Passwort bleibt | |
| Optional konfigurierbar | Per ENV einstellbar | ✓ |
**User's choice:** Optional konfigurierbar (TESSERA_FORCE_CHANGE)
---
## Mandanten-Modell
| Option | Description | Selected |
|--------|-------------|----------|
| Subdomain | firma.tessera.de | |
| Nach Login | Tenant per Benutzer-Zuordnung | |
| Tenant-Auswahl | Benutzer waehlt Mandant | |
| Du entscheidest | Claude waehlt | ✓ |
**User's choice:** Du entscheidest
| Option | Description | Selected |
|--------|-------------|----------|
| Ja | Multi-Tenant pro User | |
| Nein | Ein Mandant pro User | |
| Spaeter | Erstmal einer, spaeter mehrere | ✓ |
**User's choice:** Spaeter (erstmal ein Mandant pro User)
| Option | Description | Selected |
|--------|-------------|----------|
| Ja | Super-Admin fuer alle Mandanten | ✓ |
| Nein | Jeder Admin nur eigener Mandant | |
| Ja, spaeter | Super-Admin kommt spaeter | |
**User's choice:** Ja (Super-Admin von Anfang an)
---
## LDAP-Import
| Option | Description | Selected |
|--------|-------------|----------|
| Manuell per Button | Admin klickt Sync | |
| Manuell + Auto-Sync | Button + Intervall | ✓ |
| Nur Auto-Sync | Nur automatisch | |
**User's choice:** Manuell + Auto-Sync
| Option | Description | Selected |
|--------|-------------|----------|
| Deaktivieren | User wird deaktiviert | ✓ |
| Loeschen | User wird entfernt | |
| Nichts | Nur Import, keine Sync | |
**User's choice:** Deaktivieren
**LDAP Feld-Mapping:** Konfigurierbar mit Standard-Defaults (displayName → Name, mail → E-Mail, sAMAccountName → Username). Custom-Felder muessen auch mappbar sein.
---
## Claude's Discretion
- Tenant-Identifikation (JWT-Claim vs Header vs Middleware)
- JWT vs Session-Cookie Implementierung
- SMTP-Konfiguration Struktur
- Keycloak vs eigene Auth-Loesung
## Deferred Ideas
None