c3f43d8b61
- Add 60 new agents across all 10 categories (75 -> 135) - Add 95 new plugins with command files (25 -> 120) - Update all agents to use model: opus - Update README with complete plugin/agent tables - Update marketplace.json with all 120 plugins
100 lines
4.7 KiB
Markdown
100 lines
4.7 KiB
Markdown
# Enterprise Portal
|
|
|
|
Internal enterprise portal for employee management, compliance tracking, and reporting.
|
|
|
|
## Stack
|
|
- **Language**: Java 21 (backend), TypeScript 5.x (frontend)
|
|
- **Backend**: Spring Boot 3.3, Spring Security, Spring Data JPA
|
|
- **Frontend**: React 19, Vite 6, Ant Design 5, TanStack Query
|
|
- **Database**: Oracle 23c (primary), PostgreSQL 16 (analytics)
|
|
- **Cache**: Hazelcast (distributed session cache)
|
|
- **Queue**: Apache Kafka (event streaming)
|
|
- **Auth**: Okta SSO (SAML 2.0) + Spring Security OAuth2
|
|
- **CI/CD**: Jenkins, SonarQube, Artifactory, ArgoCD
|
|
- **Infrastructure**: Kubernetes on AWS EKS, Terraform
|
|
- **Monitoring**: Datadog APM, PagerDuty, Splunk
|
|
|
|
## Commands
|
|
- `./gradlew build` - Build backend
|
|
- `./gradlew test` - Run unit tests
|
|
- `./gradlew integrationTest` - Run integration tests (requires Docker)
|
|
- `./gradlew sonar` - Run SonarQube analysis
|
|
- `npm run dev --workspace=frontend` - Start frontend dev server
|
|
- `npm run build --workspace=frontend` - Production frontend build
|
|
- `npm run test --workspace=frontend` - Frontend unit tests
|
|
- `docker compose up -d` - Start local dependencies (Oracle, Kafka, Redis)
|
|
- `./gradlew flywayMigrate` - Apply database migrations
|
|
- `./scripts/generate-api-client.sh` - Generate TypeScript API client from OpenAPI spec
|
|
|
|
## Project Structure
|
|
```
|
|
backend/
|
|
src/main/java/com/acme/portal/
|
|
config/ - Spring configuration, security, Kafka
|
|
controller/ - REST controllers (thin, delegates to services)
|
|
service/ - Business logic layer
|
|
repository/ - JPA repositories and custom queries
|
|
model/ - JPA entities and domain objects
|
|
dto/ - Request/response DTOs with Jakarta validation
|
|
mapper/ - MapStruct mappers (entity <-> DTO)
|
|
event/ - Kafka producers and consumers
|
|
security/ - Custom security filters, authorization
|
|
exception/ - Global exception handler, error codes
|
|
src/main/resources/
|
|
db/migration/ - Flyway migration scripts
|
|
application.yml - Configuration (profiles: dev, staging, prod)
|
|
src/test/ - Unit and integration tests
|
|
frontend/
|
|
src/
|
|
pages/ - Route-level page components
|
|
components/ - Reusable UI components
|
|
hooks/ - Custom React hooks
|
|
api/ - Generated API client (OpenAPI)
|
|
store/ - Zustand state management
|
|
utils/ - Utility functions
|
|
```
|
|
|
|
## Compliance Requirements
|
|
- SOC 2 Type II: Audit logging for all data access and mutations.
|
|
- GDPR: Data export and deletion endpoints for user data.
|
|
- HIPAA: PHI fields encrypted at rest (AES-256) and in transit (TLS 1.3).
|
|
- Retain audit logs for 7 years. No hard deletes on regulated data.
|
|
- All API endpoints require authentication. No public endpoints.
|
|
- Role-based access control (RBAC) with four levels: Viewer, Editor, Admin, SuperAdmin.
|
|
|
|
## Conventions
|
|
- All REST endpoints versioned: `/api/v1/...`.
|
|
- DTOs validated with Jakarta Bean Validation annotations.
|
|
- MapStruct for all entity-to-DTO conversions. No manual mapping.
|
|
- Kafka events follow CloudEvents specification.
|
|
- Database migrations must be backward-compatible (no column drops without a 2-release window).
|
|
- Feature flags via LaunchDarkly for all new features. No code-level toggles.
|
|
- Every service method that modifies data must emit an audit event.
|
|
|
|
## Security
|
|
- Okta SSO for all authentication. No local user/password storage.
|
|
- API keys for service-to-service communication (rotated quarterly).
|
|
- Secrets stored in AWS Secrets Manager. Never in environment variables or config files.
|
|
- Dependency scanning via Snyk. Block PRs with critical vulnerabilities.
|
|
- SAST via SonarQube. Quality gate: 0 critical issues, 80% coverage on new code.
|
|
- Penetration testing quarterly via external vendor.
|
|
|
|
## Environment Variables
|
|
- `SPRING_DATASOURCE_URL` - Oracle JDBC connection string
|
|
- `SPRING_DATASOURCE_USERNAME` / `PASSWORD` - Database credentials
|
|
- `OKTA_ISSUER_URI` - Okta OIDC issuer
|
|
- `OKTA_CLIENT_ID` / `CLIENT_SECRET` - OAuth2 client credentials
|
|
- `KAFKA_BOOTSTRAP_SERVERS` - Kafka broker addresses
|
|
- `HAZELCAST_CLUSTER_NAME` - Cache cluster identifier
|
|
- `DATADOG_API_KEY` - APM and logging
|
|
- `AWS_SECRETS_MANAGER_PREFIX` - Secrets namespace
|
|
|
|
## Key Decisions
|
|
| Date | Decision | Rationale |
|
|
|------|----------|-----------|
|
|
| 2024-03-01 | Oracle over PostgreSQL | Enterprise licensing agreement, existing DBA team |
|
|
| 2024-06-15 | Kafka over RabbitMQ | Event sourcing requirement, compliance audit trail |
|
|
| 2024-09-01 | MapStruct over manual mapping | Type safety, compile-time validation |
|
|
| 2025-01-10 | Okta over Auth0 | Corporate SSO standardization |
|
|
| 2025-04-20 | Hazelcast over Redis | Distributed session replication across AZs |
|