Initial Deal Room project scaffold
- Complete architecture specification (SPEC.md) - Go project structure with inou pattern - Database schema with unified entries table - RBAC engine with bitmask permissions - Encrypted file storage (AES-256-GCM + zstd) - HTTP handlers and routing structure - templ templates for UI (layout, dashboard, login) - K2.5 AI integration for document analysis - Docker deployment configuration - Comprehensive Makefile and documentation Tech Stack: Go + templ + HTMX + SQLite + Tailwind CSS Ready for development and deployment.
This commit is contained in:
James
commit
11cf55cfb8
|
|
@ -0,0 +1,74 @@
|
||||||
|
# Binaries for programs and plugins
|
||||||
|
*.exe
|
||||||
|
*.exe~
|
||||||
|
*.dll
|
||||||
|
*.so
|
||||||
|
*.dylib
|
||||||
|
/bin/
|
||||||
|
dealroom
|
||||||
|
|
||||||
|
# Test binary, built with `go test -c`
|
||||||
|
*.test
|
||||||
|
|
||||||
|
# Output of the go coverage tool, specifically when used with LiteIDE
|
||||||
|
*.out
|
||||||
|
coverage.html
|
||||||
|
|
||||||
|
# Dependency directories (remove the comment below to include it)
|
||||||
|
# vendor/
|
||||||
|
|
||||||
|
# Go workspace file
|
||||||
|
go.work
|
||||||
|
|
||||||
|
# IDE and editor files
|
||||||
|
.vscode/
|
||||||
|
.idea/
|
||||||
|
*.swp
|
||||||
|
*.swo
|
||||||
|
*~
|
||||||
|
|
||||||
|
# OS generated files
|
||||||
|
.DS_Store
|
||||||
|
.DS_Store?
|
||||||
|
._*
|
||||||
|
.Spotlight-V100
|
||||||
|
.Trashes
|
||||||
|
ehthumbs.db
|
||||||
|
Thumbs.db
|
||||||
|
|
||||||
|
# Application data
|
||||||
|
data/
|
||||||
|
*.db
|
||||||
|
*.db-shm
|
||||||
|
*.db-wal
|
||||||
|
|
||||||
|
# Generated files
|
||||||
|
*_templ.go
|
||||||
|
templates/*_templ.go
|
||||||
|
|
||||||
|
# Temporary files
|
||||||
|
tmp/
|
||||||
|
temp/
|
||||||
|
*.tmp
|
||||||
|
|
||||||
|
# Log files
|
||||||
|
*.log
|
||||||
|
logs/
|
||||||
|
|
||||||
|
# Config files (may contain secrets)
|
||||||
|
.env
|
||||||
|
.env.local
|
||||||
|
config.yaml
|
||||||
|
config.json
|
||||||
|
|
||||||
|
# Backup files
|
||||||
|
backups/
|
||||||
|
*.bak
|
||||||
|
*.backup
|
||||||
|
|
||||||
|
# Production files
|
||||||
|
docker-compose.override.yml
|
||||||
|
.secrets/
|
||||||
|
|
||||||
|
# Test files
|
||||||
|
testdata/output/
|
||||||
|
|
@ -0,0 +1,60 @@
|
||||||
|
# Build stage
|
||||||
|
FROM golang:1.22-alpine AS builder
|
||||||
|
|
||||||
|
# Install build dependencies
|
||||||
|
RUN apk --no-cache add gcc musl-dev sqlite-dev git
|
||||||
|
|
||||||
|
# Set working directory
|
||||||
|
WORKDIR /app
|
||||||
|
|
||||||
|
# Copy go mod files
|
||||||
|
COPY go.mod go.sum ./
|
||||||
|
|
||||||
|
# Download dependencies
|
||||||
|
RUN go mod download
|
||||||
|
|
||||||
|
# Copy source code
|
||||||
|
COPY . .
|
||||||
|
|
||||||
|
# Build the application
|
||||||
|
RUN CGO_ENABLED=1 GOOS=linux go build -a -ldflags '-linkmode external -extldflags "-static"' -o dealroom ./cmd/dealroom
|
||||||
|
|
||||||
|
# Production stage
|
||||||
|
FROM alpine:3.19
|
||||||
|
|
||||||
|
# Install runtime dependencies
|
||||||
|
RUN apk --no-cache add ca-certificates tzdata
|
||||||
|
|
||||||
|
# Create app user
|
||||||
|
RUN addgroup -g 1001 -S dealroom && \
|
||||||
|
adduser -S dealroom -u 1001 -G dealroom
|
||||||
|
|
||||||
|
# Create data directories
|
||||||
|
RUN mkdir -p /data/db /data/files /data/backups && \
|
||||||
|
chown -R dealroom:dealroom /data
|
||||||
|
|
||||||
|
# Copy binary from builder
|
||||||
|
COPY --from=builder /app/dealroom /usr/local/bin/dealroom
|
||||||
|
RUN chmod +x /usr/local/bin/dealroom
|
||||||
|
|
||||||
|
# Switch to app user
|
||||||
|
USER dealroom
|
||||||
|
|
||||||
|
# Set working directory
|
||||||
|
WORKDIR /data
|
||||||
|
|
||||||
|
# Expose port
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
# Health check
|
||||||
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
|
||||||
|
CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1
|
||||||
|
|
||||||
|
# Set environment variables
|
||||||
|
ENV PORT=8080 \
|
||||||
|
DB_PATH=/data/db/dealroom.db \
|
||||||
|
FILES_PATH=/data/files \
|
||||||
|
BACKUP_PATH=/data/backups
|
||||||
|
|
||||||
|
# Run the application
|
||||||
|
CMD ["dealroom"]
|
||||||
|
|
@ -0,0 +1,157 @@
|
||||||
|
# Deal Room Makefile
|
||||||
|
|
||||||
|
.PHONY: build run test clean docker migrate templ dev install lint
|
||||||
|
|
||||||
|
# Variables
|
||||||
|
APP_NAME := dealroom
|
||||||
|
BINARY_PATH := ./bin/$(APP_NAME)
|
||||||
|
DOCKER_IMAGE := $(APP_NAME):latest
|
||||||
|
|
||||||
|
# Go build flags
|
||||||
|
CGO_ENABLED := 1
|
||||||
|
LDFLAGS := -ldflags "-X main.Version=$(shell git describe --tags --always --dirty)"
|
||||||
|
|
||||||
|
# Default target
|
||||||
|
all: build
|
||||||
|
|
||||||
|
# Install dependencies
|
||||||
|
install:
|
||||||
|
go mod download
|
||||||
|
go install github.com/a-h/templ/cmd/templ@latest
|
||||||
|
|
||||||
|
# Generate templ templates
|
||||||
|
templ:
|
||||||
|
templ generate
|
||||||
|
|
||||||
|
# Build the application
|
||||||
|
build: templ
|
||||||
|
CGO_ENABLED=$(CGO_ENABLED) go build $(LDFLAGS) -o $(BINARY_PATH) ./cmd/dealroom
|
||||||
|
|
||||||
|
# Run in development mode
|
||||||
|
dev: templ
|
||||||
|
go run ./cmd/dealroom
|
||||||
|
|
||||||
|
# Run the built binary
|
||||||
|
run: build
|
||||||
|
$(BINARY_PATH)
|
||||||
|
|
||||||
|
# Run tests
|
||||||
|
test:
|
||||||
|
go test -v -race ./...
|
||||||
|
|
||||||
|
# Run tests with coverage
|
||||||
|
test-coverage:
|
||||||
|
go test -v -race -coverprofile=coverage.out ./...
|
||||||
|
go tool cover -html=coverage.out -o coverage.html
|
||||||
|
|
||||||
|
# Run linter
|
||||||
|
lint:
|
||||||
|
golangci-lint run
|
||||||
|
|
||||||
|
# Clean build artifacts
|
||||||
|
clean:
|
||||||
|
rm -rf ./bin
|
||||||
|
rm -f coverage.out coverage.html
|
||||||
|
rm -rf ./data/temp/*
|
||||||
|
|
||||||
|
# Database migrations
|
||||||
|
migrate: build
|
||||||
|
$(BINARY_PATH) --migrate-only
|
||||||
|
|
||||||
|
# Create a new migration
|
||||||
|
migration:
|
||||||
|
@read -p "Migration name: " name; \
|
||||||
|
timestamp=$$(date +%Y%m%d%H%M%S); \
|
||||||
|
touch migrations/$${timestamp}_$${name}.sql
|
||||||
|
|
||||||
|
# Docker build
|
||||||
|
docker:
|
||||||
|
docker build -t $(DOCKER_IMAGE) .
|
||||||
|
|
||||||
|
# Docker run
|
||||||
|
docker-run: docker
|
||||||
|
docker run --rm -p 8080:8080 -v $(PWD)/data:/data $(DOCKER_IMAGE)
|
||||||
|
|
||||||
|
# Docker compose for development
|
||||||
|
docker-dev:
|
||||||
|
docker-compose up --build
|
||||||
|
|
||||||
|
# Production deployment
|
||||||
|
deploy: docker
|
||||||
|
docker tag $(DOCKER_IMAGE) registry.example.com/$(DOCKER_IMAGE)
|
||||||
|
docker push registry.example.com/$(DOCKER_IMAGE)
|
||||||
|
|
||||||
|
# Create release
|
||||||
|
release:
|
||||||
|
@if [ -z "$(VERSION)" ]; then echo "VERSION is required"; exit 1; fi
|
||||||
|
git tag -a $(VERSION) -m "Release $(VERSION)"
|
||||||
|
git push origin $(VERSION)
|
||||||
|
|
||||||
|
# Backup data
|
||||||
|
backup:
|
||||||
|
@echo "Creating backup..."
|
||||||
|
mkdir -p backups
|
||||||
|
tar -czf backups/backup-$$(date +%Y%m%d-%H%M%S).tar.gz data/
|
||||||
|
|
||||||
|
# Restore from backup
|
||||||
|
restore:
|
||||||
|
@if [ -z "$(BACKUP)" ]; then echo "BACKUP file is required"; exit 1; fi
|
||||||
|
tar -xzf $(BACKUP)
|
||||||
|
|
||||||
|
# Security scan
|
||||||
|
security:
|
||||||
|
gosec ./...
|
||||||
|
govulncheck ./...
|
||||||
|
|
||||||
|
# Format code
|
||||||
|
fmt:
|
||||||
|
go fmt ./...
|
||||||
|
templ fmt .
|
||||||
|
|
||||||
|
# Tidy dependencies
|
||||||
|
tidy:
|
||||||
|
go mod tidy
|
||||||
|
|
||||||
|
# Generate documentation
|
||||||
|
docs:
|
||||||
|
godoc -http=:6060 &
|
||||||
|
@echo "Documentation available at http://localhost:6060/pkg/dealroom/"
|
||||||
|
|
||||||
|
# Benchmark tests
|
||||||
|
bench:
|
||||||
|
go test -bench=. -benchmem ./...
|
||||||
|
|
||||||
|
# Profile the application
|
||||||
|
profile: build
|
||||||
|
go tool pprof $(BINARY_PATH) http://localhost:8080/debug/pprof/profile
|
||||||
|
|
||||||
|
# Check for outdated dependencies
|
||||||
|
deps-check:
|
||||||
|
go list -u -m all
|
||||||
|
|
||||||
|
# Update dependencies
|
||||||
|
deps-update:
|
||||||
|
go get -u ./...
|
||||||
|
go mod tidy
|
||||||
|
|
||||||
|
# Local development setup
|
||||||
|
setup: install
|
||||||
|
mkdir -p data/{db,files,backups,temp}
|
||||||
|
@echo "Development environment setup complete"
|
||||||
|
@echo "Run 'make dev' to start the development server"
|
||||||
|
|
||||||
|
# CI/CD targets
|
||||||
|
ci: lint test security
|
||||||
|
|
||||||
|
# Help target
|
||||||
|
help:
|
||||||
|
@echo "Available targets:"
|
||||||
|
@echo " build - Build the application"
|
||||||
|
@echo " run - Run the built binary"
|
||||||
|
@echo " dev - Run in development mode"
|
||||||
|
@echo " test - Run tests"
|
||||||
|
@echo " clean - Clean build artifacts"
|
||||||
|
@echo " docker - Build Docker image"
|
||||||
|
@echo " migrate - Run database migrations"
|
||||||
|
@echo " setup - Setup development environment"
|
||||||
|
@echo " help - Show this help message"
|
||||||
|
|
@ -0,0 +1,327 @@
|
||||||
|
# Deal Room
|
||||||
|
|
||||||
|
**Secure Investment Banking Document Sharing Platform**
|
||||||
|
|
||||||
|
Deal Room is a secure, invite-only document sharing platform designed for Investment Banking deal teams. Built with Go, it provides role-based access control, encrypted file storage, AI-powered document analysis, and comprehensive audit trails for sensitive financial transactions.
|
||||||
|
|
||||||
|
## Features
|
||||||
|
|
||||||
|
- 🔐 **Security First**: End-to-end encryption, RBAC, audit logging
|
||||||
|
- 📊 **AI-Enhanced**: Document analysis and semantic search via K2.5
|
||||||
|
- 🚀 **Production Ready**: Single binary deployment, zero dependencies
|
||||||
|
- 📱 **Modern UI**: HTMX + Tailwind CSS for responsive interface
|
||||||
|
- 👥 **Collaboration**: Threaded discussions, activity feeds, @mentions
|
||||||
|
- 📈 **Deal Tracking**: Pipeline management and stage tracking
|
||||||
|
|
||||||
|
## Tech Stack
|
||||||
|
|
||||||
|
- **Backend**: Go 1.22+ with SQLite (encrypted)
|
||||||
|
- **Frontend**: HTMX + Tailwind CSS (zero build process)
|
||||||
|
- **Templates**: templ (type-safe Go HTML templates)
|
||||||
|
- **Storage**: AES-256-GCM encrypted files with zstd compression
|
||||||
|
- **AI**: K2.5 integration for document analysis and embeddings
|
||||||
|
|
||||||
|
## Quick Start
|
||||||
|
|
||||||
|
### Prerequisites
|
||||||
|
|
||||||
|
- Go 1.22 or later
|
||||||
|
- Make (optional, but recommended)
|
||||||
|
|
||||||
|
### Development Setup
|
||||||
|
|
||||||
|
1. **Clone and setup**:
|
||||||
|
```bash
|
||||||
|
git clone <repository-url>
|
||||||
|
cd dealroom
|
||||||
|
make setup
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **Install dependencies**:
|
||||||
|
```bash
|
||||||
|
make install
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Run in development mode**:
|
||||||
|
```bash
|
||||||
|
make dev
|
||||||
|
```
|
||||||
|
|
||||||
|
4. **Access the application**:
|
||||||
|
- Open http://localhost:8080
|
||||||
|
- Default admin user will be created on first run
|
||||||
|
|
||||||
|
### Production Deployment
|
||||||
|
|
||||||
|
1. **Build the binary**:
|
||||||
|
```bash
|
||||||
|
make build
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **Configure environment variables**:
|
||||||
|
```bash
|
||||||
|
export DB_KEY="your-32-byte-encryption-key"
|
||||||
|
export SESSION_SECRET="your-session-secret"
|
||||||
|
export BASE_URL="https://dealroom.yourcompany.com"
|
||||||
|
# See Configuration section for all variables
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Run the application**:
|
||||||
|
```bash
|
||||||
|
./bin/dealroom
|
||||||
|
```
|
||||||
|
|
||||||
|
### Docker Deployment
|
||||||
|
|
||||||
|
1. **Build and run with Docker**:
|
||||||
|
```bash
|
||||||
|
make docker-run
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **Or use Docker Compose** (see `docker-compose.yml`):
|
||||||
|
```bash
|
||||||
|
docker-compose up -d
|
||||||
|
```
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
|
||||||
|
Configure the application using environment variables:
|
||||||
|
|
||||||
|
### Required Settings
|
||||||
|
```bash
|
||||||
|
DB_KEY=your-32-byte-encryption-key # Database encryption key
|
||||||
|
SESSION_SECRET=your-session-secret # Session cookie encryption
|
||||||
|
BASE_URL=https://dealroom.company.com # Public URL for magic links
|
||||||
|
```
|
||||||
|
|
||||||
|
### Database & Storage
|
||||||
|
```bash
|
||||||
|
DB_PATH=/data/db/dealroom.db # SQLite database path
|
||||||
|
FILES_PATH=/data/files # Encrypted file storage
|
||||||
|
BACKUP_PATH=/data/backups # Backup directory
|
||||||
|
```
|
||||||
|
|
||||||
|
### AI Integration
|
||||||
|
```bash
|
||||||
|
K25_API_URL=http://k2.5:8080 # K2.5 API endpoint
|
||||||
|
K25_API_KEY=your-k2.5-api-key # K2.5 API key
|
||||||
|
```
|
||||||
|
|
||||||
|
### Email (Magic Links)
|
||||||
|
```bash
|
||||||
|
SMTP_HOST=smtp.company.com # SMTP server
|
||||||
|
SMTP_USER=dealroom@company.com # SMTP username
|
||||||
|
SMTP_PASS=your-smtp-password # SMTP password
|
||||||
|
```
|
||||||
|
|
||||||
|
### Server
|
||||||
|
```bash
|
||||||
|
PORT=8080 # HTTP port (default: 8080)
|
||||||
|
```
|
||||||
|
|
||||||
|
## Architecture
|
||||||
|
|
||||||
|
Deal Room follows the **inou pattern** for data-centric design:
|
||||||
|
|
||||||
|
- **Unified Data Model**: All content types (deal rooms, documents, notes) stored as typed JSON in the `entries` table
|
||||||
|
- **RBAC Engine**: Bitmask permissions (read=1, write=2, delete=4, manage=8) with inheritance
|
||||||
|
- **Encrypted Storage**: Files encrypted with AES-256-GCM and compressed with zstd
|
||||||
|
- **AI Pipeline**: Document analysis and embeddings for semantic search
|
||||||
|
|
||||||
|
### Database Schema
|
||||||
|
|
||||||
|
```sql
|
||||||
|
-- Users and authentication
|
||||||
|
users (id, email, name, role, created_at, ...)
|
||||||
|
|
||||||
|
-- Unified content storage
|
||||||
|
entries (id, deal_room_id, entry_type, title, content, file_path, ...)
|
||||||
|
|
||||||
|
-- Role-based access control
|
||||||
|
access (id, entry_id, user_id, permissions, granted_by, ...)
|
||||||
|
|
||||||
|
-- Session management
|
||||||
|
sessions (token, user_id, expires_at, ...)
|
||||||
|
|
||||||
|
-- Audit trail
|
||||||
|
audit_log (id, user_id, entry_id, action, details, ...)
|
||||||
|
```
|
||||||
|
|
||||||
|
### File Storage
|
||||||
|
|
||||||
|
```
|
||||||
|
data/
|
||||||
|
├── db/dealroom.db # Encrypted SQLite database
|
||||||
|
├── files/ # Encrypted file storage
|
||||||
|
│ ├── 2024/01/ # Date-based partitioning
|
||||||
|
│ │ ├── entry1.enc # AES-256-GCM + zstd
|
||||||
|
│ │ └── entry2.enc
|
||||||
|
│ └── temp/ # Temporary upload staging
|
||||||
|
└── backups/ # Automated backups
|
||||||
|
```
|
||||||
|
|
||||||
|
## API Reference
|
||||||
|
|
||||||
|
### Authentication
|
||||||
|
- `POST /auth/login` - Magic link login
|
||||||
|
- `GET /auth/verify/{token}` - Verify login token
|
||||||
|
- `POST /auth/logout` - End session
|
||||||
|
|
||||||
|
### Deal Rooms
|
||||||
|
- `GET /api/deal-rooms` - List accessible deal rooms
|
||||||
|
- `POST /api/deal-rooms` - Create new deal room
|
||||||
|
- `GET /api/deal-rooms/{id}` - Get deal room details
|
||||||
|
- `PUT /api/deal-rooms/{id}` - Update deal room
|
||||||
|
|
||||||
|
### Documents & Content
|
||||||
|
- `GET /api/entries` - List entries with permissions
|
||||||
|
- `POST /api/entries` - Create entry (document/note)
|
||||||
|
- `GET /api/entries/{id}` - Get entry details
|
||||||
|
- `GET /api/entries/{id}/file` - Download file
|
||||||
|
|
||||||
|
### Access Control
|
||||||
|
- `GET /api/entries/{id}/access` - List permissions
|
||||||
|
- `POST /api/entries/{id}/access` - Grant access
|
||||||
|
- `DELETE /api/entries/{id}/access/{user}` - Revoke access
|
||||||
|
|
||||||
|
### Search & AI
|
||||||
|
- `GET /api/search?q={query}` - Semantic search
|
||||||
|
- `POST /api/analyze/{id}` - Trigger AI analysis
|
||||||
|
|
||||||
|
## Development
|
||||||
|
|
||||||
|
### Project Structure
|
||||||
|
|
||||||
|
```
|
||||||
|
dealroom/
|
||||||
|
├── cmd/dealroom/ # Application entry point
|
||||||
|
│ └── main.go
|
||||||
|
├── internal/ # Internal packages
|
||||||
|
│ ├── db/ # Database layer & migrations
|
||||||
|
│ ├── model/ # Data models
|
||||||
|
│ ├── rbac/ # Role-based access control
|
||||||
|
│ ├── store/ # Encrypted file storage
|
||||||
|
│ ├── handler/ # HTTP handlers
|
||||||
|
│ └── ai/ # K2.5 integration
|
||||||
|
├── templates/ # templ templates
|
||||||
|
│ ├── layout.templ
|
||||||
|
│ ├── dashboard.templ
|
||||||
|
│ └── ...
|
||||||
|
├── static/ # Static assets
|
||||||
|
├── migrations/ # Database migrations
|
||||||
|
├── Dockerfile
|
||||||
|
├── Makefile
|
||||||
|
└── README.md
|
||||||
|
```
|
||||||
|
|
||||||
|
### Available Commands
|
||||||
|
|
||||||
|
```bash
|
||||||
|
make build # Build the application
|
||||||
|
make dev # Run in development mode
|
||||||
|
make test # Run tests
|
||||||
|
make lint # Run linter
|
||||||
|
make docker # Build Docker image
|
||||||
|
make migrate # Run database migrations
|
||||||
|
make clean # Clean build artifacts
|
||||||
|
make setup # Setup development environment
|
||||||
|
```
|
||||||
|
|
||||||
|
### Running Tests
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Run all tests
|
||||||
|
make test
|
||||||
|
|
||||||
|
# Run with coverage
|
||||||
|
make test-coverage
|
||||||
|
|
||||||
|
# Run benchmarks
|
||||||
|
make bench
|
||||||
|
```
|
||||||
|
|
||||||
|
### Code Quality
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Format code
|
||||||
|
make fmt
|
||||||
|
|
||||||
|
# Run linter
|
||||||
|
make lint
|
||||||
|
|
||||||
|
# Security scan
|
||||||
|
make security
|
||||||
|
```
|
||||||
|
|
||||||
|
## Security
|
||||||
|
|
||||||
|
Deal Room implements defense-in-depth security:
|
||||||
|
|
||||||
|
### Data Protection
|
||||||
|
- **Encryption at Rest**: AES-256-GCM for files, encrypted SQLite
|
||||||
|
- **Encryption in Transit**: HTTPS only, HSTS headers
|
||||||
|
- **Key Management**: Configurable encryption keys
|
||||||
|
- **File Access**: No direct file serving, all through API
|
||||||
|
|
||||||
|
### Access Control
|
||||||
|
- **RBAC**: Entry-level permissions with inheritance
|
||||||
|
- **Least Privilege**: Users see only what they have access to
|
||||||
|
- **Magic Links**: Passwordless email-based authentication
|
||||||
|
- **Session Management**: Secure HTTP-only cookies
|
||||||
|
|
||||||
|
### Audit & Compliance
|
||||||
|
- **Audit Trail**: All actions logged with user attribution
|
||||||
|
- **Activity Feeds**: Real-time activity monitoring
|
||||||
|
- **Access Reviews**: Permission management interface
|
||||||
|
- **Data Retention**: Configurable retention policies
|
||||||
|
|
||||||
|
## Production Considerations
|
||||||
|
|
||||||
|
### Performance
|
||||||
|
- **Concurrent Users**: ~100-200 with SQLite
|
||||||
|
- **File Storage**: Limited by disk space
|
||||||
|
- **Database Size**: Efficient up to ~100GB
|
||||||
|
- **Response Times**: <200ms for page loads
|
||||||
|
|
||||||
|
### Scalability
|
||||||
|
For higher scale requirements:
|
||||||
|
- **Database**: Migrate to PostgreSQL
|
||||||
|
- **File Storage**: Use S3-compatible object storage
|
||||||
|
- **Search**: Dedicated vector database (Pinecone, Weaviate)
|
||||||
|
- **Caching**: Add Redis for sessions and queries
|
||||||
|
|
||||||
|
### Monitoring
|
||||||
|
- Health checks at `/health`
|
||||||
|
- Metrics endpoint at `/metrics` (when enabled)
|
||||||
|
- Structured logging with levels
|
||||||
|
- Audit trail for compliance
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
1. Fork the repository
|
||||||
|
2. Create a feature branch
|
||||||
|
3. Make your changes
|
||||||
|
4. Add tests for new functionality
|
||||||
|
5. Run the test suite: `make test`
|
||||||
|
6. Submit a pull request
|
||||||
|
|
||||||
|
### Code Style
|
||||||
|
- Follow standard Go formatting (`make fmt`)
|
||||||
|
- Use meaningful variable names
|
||||||
|
- Add comments for public functions
|
||||||
|
- Keep functions focused and small
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
This project is proprietary software owned by Misha Muskepo and licensed for use by authorized parties only.
|
||||||
|
|
||||||
|
## Support
|
||||||
|
|
||||||
|
For support or questions:
|
||||||
|
- **Owner**: Misha Muskepo (michael@muskepo.com)
|
||||||
|
- **Tech Lead**: James
|
||||||
|
- **Documentation**: See `SPEC.md` for detailed architecture
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**Deal Room** - Secure, AI-Enhanced Investment Banking Platform
|
||||||
|
|
@ -0,0 +1,547 @@
|
||||||
|
# Deal Room - Architecture Specification
|
||||||
|
|
||||||
|
**Project:** Deal Room - Secure Investment Banking Document Sharing Platform
|
||||||
|
**Owner:** Misha Muskepo (michael@muskepo.com)
|
||||||
|
**Tech Lead:** James
|
||||||
|
**Architecture Pattern:** inou-portal pattern
|
||||||
|
|
||||||
|
## Executive Summary
|
||||||
|
|
||||||
|
Deal Room is a secure, invite-only document sharing platform designed for Investment Banking deal teams. It provides role-based access control, encrypted file storage, AI-powered document analysis, and comprehensive audit trails for sensitive financial transactions.
|
||||||
|
|
||||||
|
## System Architecture
|
||||||
|
|
||||||
|
### Core Principles
|
||||||
|
- **Single binary deployment** - Zero runtime dependencies
|
||||||
|
- **Data-centric design** - All entities stored as typed JSON in unified entries table
|
||||||
|
- **Security-first** - Encryption at rest, RBAC, audit logging
|
||||||
|
- **AI-enhanced** - Document analysis and embeddings for intelligent search
|
||||||
|
- **Production-grade** - Battle-tested patterns from inou-portal
|
||||||
|
|
||||||
|
### Technology Stack
|
||||||
|
- **Backend:** Go 1.22+ (single binary)
|
||||||
|
- **Templates:** templ (type-safe HTML generation)
|
||||||
|
- **Frontend:** HTMX + Tailwind CSS (CDN)
|
||||||
|
- **Database:** SQLite with encryption at rest
|
||||||
|
- **File Storage:** Encrypted (AES-256-GCM) + Compressed (zstd)
|
||||||
|
- **AI/ML:** K2.5 for document analysis and embeddings
|
||||||
|
- **Authentication:** Magic link + session cookies
|
||||||
|
|
||||||
|
## Database Schema
|
||||||
|
|
||||||
|
### Core Tables
|
||||||
|
|
||||||
|
#### users
|
||||||
|
```sql
|
||||||
|
CREATE TABLE users (
|
||||||
|
id TEXT PRIMARY KEY,
|
||||||
|
email TEXT UNIQUE NOT NULL,
|
||||||
|
name TEXT NOT NULL,
|
||||||
|
role TEXT NOT NULL CHECK (role IN ('admin', 'user')),
|
||||||
|
avatar_url TEXT,
|
||||||
|
created_at INTEGER NOT NULL,
|
||||||
|
last_login INTEGER,
|
||||||
|
is_active BOOLEAN NOT NULL DEFAULT 1
|
||||||
|
);
|
||||||
|
|
||||||
|
CREATE INDEX idx_users_email ON users(email);
|
||||||
|
CREATE INDEX idx_users_active ON users(is_active);
|
||||||
|
```
|
||||||
|
|
||||||
|
#### entries
|
||||||
|
**Unified data table storing all content types as typed JSON**
|
||||||
|
```sql
|
||||||
|
CREATE TABLE entries (
|
||||||
|
id TEXT PRIMARY KEY,
|
||||||
|
parent_id TEXT, -- For threading/hierarchy
|
||||||
|
deal_room_id TEXT NOT NULL, -- Links to deal room entry
|
||||||
|
entry_type TEXT NOT NULL CHECK (entry_type IN ('deal_room', 'document', 'note', 'message', 'analysis')),
|
||||||
|
title TEXT NOT NULL,
|
||||||
|
content TEXT NOT NULL, -- JSON payload, schema varies by type
|
||||||
|
file_path TEXT, -- For documents: encrypted file path
|
||||||
|
file_size INTEGER, -- Original file size
|
||||||
|
file_hash TEXT, -- SHA-256 of original file
|
||||||
|
embedding BLOB, -- AI embeddings for search
|
||||||
|
created_by TEXT NOT NULL,
|
||||||
|
created_at INTEGER NOT NULL,
|
||||||
|
updated_at INTEGER NOT NULL,
|
||||||
|
|
||||||
|
FOREIGN KEY (created_by) REFERENCES users(id),
|
||||||
|
FOREIGN KEY (parent_id) REFERENCES entries(id),
|
||||||
|
FOREIGN KEY (deal_room_id) REFERENCES entries(id)
|
||||||
|
);
|
||||||
|
|
||||||
|
CREATE INDEX idx_entries_deal_room ON entries(deal_room_id);
|
||||||
|
CREATE INDEX idx_entries_type ON entries(entry_type);
|
||||||
|
CREATE INDEX idx_entries_parent ON entries(parent_id);
|
||||||
|
CREATE INDEX idx_entries_created ON entries(created_at);
|
||||||
|
CREATE INDEX idx_entries_creator ON entries(created_by);
|
||||||
|
```
|
||||||
|
|
||||||
|
#### access
|
||||||
|
**RBAC permissions using bitmask**
|
||||||
|
```sql
|
||||||
|
CREATE TABLE access (
|
||||||
|
id TEXT PRIMARY KEY,
|
||||||
|
entry_id TEXT NOT NULL,
|
||||||
|
user_id TEXT NOT NULL,
|
||||||
|
permissions INTEGER NOT NULL DEFAULT 1, -- Bitmask: read=1, write=2, delete=4, manage=8
|
||||||
|
granted_by TEXT NOT NULL,
|
||||||
|
granted_at INTEGER NOT NULL,
|
||||||
|
|
||||||
|
FOREIGN KEY (entry_id) REFERENCES entries(id) ON DELETE CASCADE,
|
||||||
|
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
|
||||||
|
FOREIGN KEY (granted_by) REFERENCES users(id),
|
||||||
|
|
||||||
|
UNIQUE(entry_id, user_id)
|
||||||
|
);
|
||||||
|
|
||||||
|
CREATE INDEX idx_access_entry ON access(entry_id);
|
||||||
|
CREATE INDEX idx_access_user ON access(user_id);
|
||||||
|
CREATE INDEX idx_access_permissions ON access(permissions);
|
||||||
|
```
|
||||||
|
|
||||||
|
#### sessions
|
||||||
|
```sql
|
||||||
|
CREATE TABLE sessions (
|
||||||
|
token TEXT PRIMARY KEY,
|
||||||
|
user_id TEXT NOT NULL,
|
||||||
|
expires_at INTEGER NOT NULL,
|
||||||
|
created_at INTEGER NOT NULL,
|
||||||
|
last_used INTEGER NOT NULL,
|
||||||
|
user_agent TEXT,
|
||||||
|
ip_address TEXT,
|
||||||
|
|
||||||
|
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
|
||||||
|
);
|
||||||
|
|
||||||
|
CREATE INDEX idx_sessions_user ON sessions(user_id);
|
||||||
|
CREATE INDEX idx_sessions_expires ON sessions(expires_at);
|
||||||
|
```
|
||||||
|
|
||||||
|
#### audit_log
|
||||||
|
```sql
|
||||||
|
CREATE TABLE audit_log (
|
||||||
|
id TEXT PRIMARY KEY,
|
||||||
|
user_id TEXT,
|
||||||
|
entry_id TEXT,
|
||||||
|
action TEXT NOT NULL, -- view, create, update, delete, download, share
|
||||||
|
details TEXT, -- JSON with action-specific data
|
||||||
|
ip_address TEXT,
|
||||||
|
user_agent TEXT,
|
||||||
|
created_at INTEGER NOT NULL,
|
||||||
|
|
||||||
|
FOREIGN KEY (user_id) REFERENCES users(id),
|
||||||
|
FOREIGN KEY (entry_id) REFERENCES entries(id)
|
||||||
|
);
|
||||||
|
|
||||||
|
CREATE INDEX idx_audit_user ON audit_log(user_id);
|
||||||
|
CREATE INDEX idx_audit_entry ON audit_log(entry_id);
|
||||||
|
CREATE INDEX idx_audit_action ON audit_log(action);
|
||||||
|
CREATE INDEX idx_audit_created ON audit_log(created_at);
|
||||||
|
```
|
||||||
|
|
||||||
|
### Entry Content Schemas
|
||||||
|
|
||||||
|
#### Deal Room Entry
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"type": "deal_room",
|
||||||
|
"description": "Acquisition of TechCorp by PrivateEquity Partners",
|
||||||
|
"stage": "due_diligence", // sourcing, loi, due_diligence, closing, completed
|
||||||
|
"target_company": "TechCorp Inc.",
|
||||||
|
"deal_value": "$50M",
|
||||||
|
"participants": [
|
||||||
|
{"name": "John Smith", "role": "Deal Lead", "organization": "PE Partners"},
|
||||||
|
{"name": "Jane Doe", "role": "Analyst", "organization": "PE Partners"}
|
||||||
|
],
|
||||||
|
"key_dates": {
|
||||||
|
"loi_signed": "2024-01-15",
|
||||||
|
"dd_start": "2024-02-01",
|
||||||
|
"close_target": "2024-04-30"
|
||||||
|
},
|
||||||
|
"confidentiality_level": "highly_confidential"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Document Entry
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"type": "document",
|
||||||
|
"category": "financial_model", // nda, cim, financial_model, teaser, legal, dd_report
|
||||||
|
"mime_type": "application/pdf",
|
||||||
|
"original_name": "TechCorp_Financial_Model_v3.xlsx",
|
||||||
|
"version": "3.0",
|
||||||
|
"analysis": {
|
||||||
|
"summary": "Financial projections showing 15% EBITDA growth",
|
||||||
|
"key_metrics": ["Revenue: $100M", "EBITDA: $25M", "Growth: 15%"],
|
||||||
|
"risk_factors": ["Market volatility", "Regulatory changes"],
|
||||||
|
"ai_confidence": 0.92
|
||||||
|
},
|
||||||
|
"requires_nda": true
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Note/Message Entry
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"type": "note",
|
||||||
|
"body": "Updated financial model reflects Q4 performance...",
|
||||||
|
"mentions": ["user_id_123"], // @mentions for notifications
|
||||||
|
"attachments": ["entry_id_456"], // Reference to document entries
|
||||||
|
"thread_context": "document_discussion" // Helps organize conversations
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## Permission Model (RBAC)
|
||||||
|
|
||||||
|
### Bitmask Values
|
||||||
|
- **READ (1):** View entry and metadata
|
||||||
|
- **WRITE (2):** Edit entry, add comments
|
||||||
|
- **DELETE (4):** Remove entry
|
||||||
|
- **MANAGE (8):** Grant/revoke access, manage permissions
|
||||||
|
|
||||||
|
### Permission Inheritance
|
||||||
|
- Deal room permissions cascade to all contained documents
|
||||||
|
- Explicit document permissions override inherited permissions
|
||||||
|
- Admins have MANAGE (8) on all entries by default
|
||||||
|
|
||||||
|
### Common Permission Patterns
|
||||||
|
- **Viewer:** READ (1) - Can view documents and notes
|
||||||
|
- **Contributor:** READ + WRITE (3) - Can add notes and upload documents
|
||||||
|
- **Manager:** READ + WRITE + DELETE (7) - Can manage content
|
||||||
|
- **Admin:** All permissions (15) - Full control
|
||||||
|
|
||||||
|
## API Endpoints
|
||||||
|
|
||||||
|
### Authentication
|
||||||
|
```
|
||||||
|
POST /auth/login # Magic link login
|
||||||
|
GET /auth/verify/{token} # Verify magic link
|
||||||
|
POST /auth/logout # End session
|
||||||
|
GET /auth/me # Current user info
|
||||||
|
```
|
||||||
|
|
||||||
|
### Deal Rooms
|
||||||
|
```
|
||||||
|
GET /api/deal-rooms # List accessible deal rooms
|
||||||
|
POST /api/deal-rooms # Create new deal room
|
||||||
|
GET /api/deal-rooms/{id} # Get deal room details
|
||||||
|
PUT /api/deal-rooms/{id} # Update deal room
|
||||||
|
DELETE /api/deal-rooms/{id} # Archive deal room
|
||||||
|
```
|
||||||
|
|
||||||
|
### Entries (Documents, Notes, etc.)
|
||||||
|
```
|
||||||
|
GET /api/entries # List entries (filtered by permissions)
|
||||||
|
POST /api/entries # Create entry
|
||||||
|
GET /api/entries/{id} # Get entry details
|
||||||
|
PUT /api/entries/{id} # Update entry
|
||||||
|
DELETE /api/entries/{id} # Delete entry
|
||||||
|
GET /api/entries/{id}/file # Download file (for documents)
|
||||||
|
```
|
||||||
|
|
||||||
|
### Access Management
|
||||||
|
```
|
||||||
|
GET /api/entries/{id}/access # List permissions for entry
|
||||||
|
POST /api/entries/{id}/access # Grant access
|
||||||
|
PUT /api/entries/{id}/access/{uid} # Update user permissions
|
||||||
|
DELETE /api/entries/{id}/access/{uid} # Revoke access
|
||||||
|
```
|
||||||
|
|
||||||
|
### Search & AI
|
||||||
|
```
|
||||||
|
GET /api/search?q={query} # Semantic search across accessible content
|
||||||
|
POST /api/analyze/{entry_id} # Trigger AI analysis
|
||||||
|
GET /api/similar/{entry_id} # Find similar documents
|
||||||
|
```
|
||||||
|
|
||||||
|
### Activity & Audit
|
||||||
|
```
|
||||||
|
GET /api/activity/{deal_room_id} # Activity feed for deal room
|
||||||
|
GET /api/audit/{entry_id} # Audit log for specific entry
|
||||||
|
```
|
||||||
|
|
||||||
|
## Page Routes (Server-Rendered)
|
||||||
|
|
||||||
|
```
|
||||||
|
GET / # Dashboard - accessible deal rooms
|
||||||
|
GET /login # Login page
|
||||||
|
GET /deal-rooms/{id} # Deal room detail view
|
||||||
|
GET /deal-rooms/{id}/upload # Document upload page
|
||||||
|
GET /documents/{id} # Document viewer
|
||||||
|
GET /admin # Admin panel (user/permissions management)
|
||||||
|
GET /profile # User profile
|
||||||
|
GET /activity # Global activity feed
|
||||||
|
```
|
||||||
|
|
||||||
|
## File Storage Design
|
||||||
|
|
||||||
|
### Storage Structure
|
||||||
|
```
|
||||||
|
data/
|
||||||
|
├── db/
|
||||||
|
│ └── dealroom.db # SQLite database
|
||||||
|
├── files/
|
||||||
|
│ ├── 2024/01/ # Date-based partitioning
|
||||||
|
│ │ ├── abc123.enc # Encrypted + compressed files
|
||||||
|
│ │ └── def456.enc
|
||||||
|
│ └── temp/ # Temporary upload staging
|
||||||
|
└── backups/ # Automated backups
|
||||||
|
├── db/
|
||||||
|
└── files/
|
||||||
|
```
|
||||||
|
|
||||||
|
### Encryption Process
|
||||||
|
1. **Upload:** File uploaded to `/temp/{uuid}`
|
||||||
|
2. **Compress:** Apply zstd compression (level 3)
|
||||||
|
3. **Encrypt:** AES-256-GCM with random nonce
|
||||||
|
4. **Store:** Move to date-partitioned directory
|
||||||
|
5. **Index:** Store metadata + embedding in database
|
||||||
|
6. **Cleanup:** Remove temp file
|
||||||
|
|
||||||
|
### File Naming
|
||||||
|
- **Pattern:** `{year}/{month}/{entry_id}.enc`
|
||||||
|
- **Metadata:** Stored in database, not filesystem
|
||||||
|
- **Deduplication:** SHA-256 hash prevents duplicate storage
|
||||||
|
|
||||||
|
## AI/Embeddings Pipeline
|
||||||
|
|
||||||
|
### Document Processing Workflow
|
||||||
|
1. **Upload:** User uploads document
|
||||||
|
2. **Extract:** Convert to text (PDF, DOCX, XLSX support)
|
||||||
|
3. **Analyze:** Send to K2.5 for:
|
||||||
|
- Content summarization
|
||||||
|
- Key metrics extraction
|
||||||
|
- Risk factor identification
|
||||||
|
- Classification (NDA, CIM, Financial Model, etc.)
|
||||||
|
4. **Embed:** Generate vector embeddings for semantic search
|
||||||
|
5. **Store:** Save analysis results in entry content JSON
|
||||||
|
|
||||||
|
### K2.5 Integration
|
||||||
|
```go
|
||||||
|
type DocumentAnalysis struct {
|
||||||
|
Summary string `json:"summary"`
|
||||||
|
KeyMetrics []string `json:"key_metrics"`
|
||||||
|
RiskFactors []string `json:"risk_factors"`
|
||||||
|
Category string `json:"category"`
|
||||||
|
Confidence float64 `json:"ai_confidence"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type EmbeddingRequest struct {
|
||||||
|
Text string `json:"text"`
|
||||||
|
Model string `json:"model"`
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
### Semantic Search
|
||||||
|
- **Vector Storage:** SQLite with vector extension
|
||||||
|
- **Similarity:** Cosine similarity for document matching
|
||||||
|
- **Hybrid Search:** Combine keyword + semantic results
|
||||||
|
- **Access Control:** Filter results by user permissions
|
||||||
|
|
||||||
|
## Security Model
|
||||||
|
|
||||||
|
### Authentication
|
||||||
|
- **Magic Link:** Email-based passwordless login
|
||||||
|
- **Session Management:** Secure HTTP-only cookies
|
||||||
|
- **Token Expiry:** 24-hour sessions with automatic refresh
|
||||||
|
- **Rate Limiting:** Prevent brute force attacks
|
||||||
|
|
||||||
|
### Authorization
|
||||||
|
- **RBAC:** Entry-level permissions with inheritance
|
||||||
|
- **Least Privilege:** Users see only what they have access to
|
||||||
|
- **Audit Trail:** All actions logged with user attribution
|
||||||
|
- **Admin Controls:** User management and permission oversight
|
||||||
|
|
||||||
|
### Data Protection
|
||||||
|
- **Encryption at Rest:** AES-256-GCM for files, encrypted SQLite
|
||||||
|
- **Encryption in Transit:** HTTPS only, HSTS headers
|
||||||
|
- **File Access:** Direct file serving prevented, all through API
|
||||||
|
- **Backup Encryption:** Automated encrypted backups
|
||||||
|
|
||||||
|
### Compliance Features
|
||||||
|
- **Audit Logging:** Comprehensive activity tracking
|
||||||
|
- **Data Retention:** Configurable retention policies
|
||||||
|
- **Access Reviews:** Periodic permission audits
|
||||||
|
- **Export Controls:** Document download tracking
|
||||||
|
|
||||||
|
## Deployment Architecture
|
||||||
|
|
||||||
|
### Single Binary Approach
|
||||||
|
```
|
||||||
|
dealroom
|
||||||
|
├── Static assets embedded (CSS, JS)
|
||||||
|
├── Templates compiled
|
||||||
|
├── Database migrations
|
||||||
|
└── Configuration via environment variables
|
||||||
|
```
|
||||||
|
|
||||||
|
### Configuration
|
||||||
|
```bash
|
||||||
|
# Database
|
||||||
|
DB_PATH=/data/db/dealroom.db
|
||||||
|
DB_KEY=<encryption_key>
|
||||||
|
|
||||||
|
# File Storage
|
||||||
|
FILES_PATH=/data/files
|
||||||
|
BACKUP_PATH=/data/backups
|
||||||
|
|
||||||
|
# AI Service
|
||||||
|
K25_API_URL=http://k2.5:8080
|
||||||
|
K25_API_KEY=<api_key>
|
||||||
|
|
||||||
|
# Server
|
||||||
|
PORT=8080
|
||||||
|
BASE_URL=https://dealroom.company.com
|
||||||
|
SESSION_SECRET=<random_key>
|
||||||
|
|
||||||
|
# Email (for magic links)
|
||||||
|
SMTP_HOST=smtp.company.com
|
||||||
|
SMTP_USER=dealroom@company.com
|
||||||
|
SMTP_PASS=<password>
|
||||||
|
```
|
||||||
|
|
||||||
|
### Docker Deployment
|
||||||
|
```dockerfile
|
||||||
|
FROM golang:1.22-alpine AS builder
|
||||||
|
# ... build process
|
||||||
|
|
||||||
|
FROM alpine:3.19
|
||||||
|
RUN apk --no-cache add ca-certificates tzdata
|
||||||
|
COPY --from=builder /app/dealroom /usr/local/bin/
|
||||||
|
VOLUME ["/data"]
|
||||||
|
EXPOSE 8080
|
||||||
|
CMD ["dealroom"]
|
||||||
|
```
|
||||||
|
|
||||||
|
## Development Workflow
|
||||||
|
|
||||||
|
### Project Structure
|
||||||
|
```
|
||||||
|
dealroom/
|
||||||
|
├── cmd/dealroom/main.go # Application entry point
|
||||||
|
├── internal/
|
||||||
|
│ ├── db/ # Database layer
|
||||||
|
│ ├── rbac/ # RBAC engine
|
||||||
|
│ ├── store/ # File storage
|
||||||
|
│ ├── ai/ # K2.5 integration
|
||||||
|
│ ├── handler/ # HTTP handlers
|
||||||
|
│ └── model/ # Data models
|
||||||
|
├── templates/ # templ templates
|
||||||
|
├── static/ # Static assets
|
||||||
|
├── migrations/ # Database migrations
|
||||||
|
├── Dockerfile
|
||||||
|
├── Makefile
|
||||||
|
└── README.md
|
||||||
|
```
|
||||||
|
|
||||||
|
### Build & Run
|
||||||
|
```bash
|
||||||
|
make build # Build binary
|
||||||
|
make run # Run in development mode
|
||||||
|
make test # Run tests
|
||||||
|
make migrate # Run database migrations
|
||||||
|
make docker # Build Docker image
|
||||||
|
```
|
||||||
|
|
||||||
|
### Testing Strategy
|
||||||
|
- **Unit Tests:** Core business logic and RBAC
|
||||||
|
- **Integration Tests:** Database and file operations
|
||||||
|
- **E2E Tests:** Critical user journeys with real browser
|
||||||
|
- **Security Tests:** Permission boundaries and file access
|
||||||
|
- **Performance Tests:** Large file uploads and search
|
||||||
|
|
||||||
|
## Scalability Considerations
|
||||||
|
|
||||||
|
### Current Limits (SQLite-based)
|
||||||
|
- **Concurrent Users:** ~100-200 active users
|
||||||
|
- **File Storage:** Limited by disk space
|
||||||
|
- **Search Performance:** Good up to ~10K documents
|
||||||
|
- **Database Size:** Efficient up to ~100GB
|
||||||
|
|
||||||
|
### Migration Path (Future)
|
||||||
|
- **Database:** PostgreSQL for higher concurrency
|
||||||
|
- **File Storage:** S3-compatible object storage
|
||||||
|
- **Search:** Dedicated vector database (Pinecone, Weaviate)
|
||||||
|
- **Caching:** Redis for session and query caching
|
||||||
|
|
||||||
|
## Success Metrics
|
||||||
|
|
||||||
|
### Technical Metrics
|
||||||
|
- **Uptime:** >99.9% availability
|
||||||
|
- **Response Time:** <200ms for page loads
|
||||||
|
- **File Upload:** <30s for 100MB files
|
||||||
|
- **Search Latency:** <500ms for semantic search
|
||||||
|
|
||||||
|
### Business Metrics
|
||||||
|
- **User Adoption:** Active users per deal room
|
||||||
|
- **Document Velocity:** Files uploaded/downloaded per day
|
||||||
|
- **Security Events:** Zero unauthorized access incidents
|
||||||
|
- **User Satisfaction:** NPS > 8 for ease of use
|
||||||
|
|
||||||
|
## Risk Assessment
|
||||||
|
|
||||||
|
### Technical Risks
|
||||||
|
- **Single Point of Failure:** SQLite limits high availability
|
||||||
|
- **File Corruption:** Encryption key loss = data loss
|
||||||
|
- **AI Dependency:** K2.5 service availability required
|
||||||
|
- **Scaling Challenges:** May need architecture changes at scale
|
||||||
|
|
||||||
|
### Mitigation Strategies
|
||||||
|
- **Automated Backups:** Hourly encrypted backups to S3
|
||||||
|
- **Key Management:** Secure key storage and rotation
|
||||||
|
- **Circuit Breakers:** Graceful degradation when AI unavailable
|
||||||
|
- **Monitoring:** Comprehensive health checks and alerting
|
||||||
|
|
||||||
|
### Security Risks
|
||||||
|
- **Data Breach:** Highly sensitive financial information
|
||||||
|
- **Insider Threat:** Authorized users with malicious intent
|
||||||
|
- **Compliance:** Regulatory requirements for financial data
|
||||||
|
- **Access Control:** Complex permission inheritance bugs
|
||||||
|
|
||||||
|
### Security Controls
|
||||||
|
- **Defense in Depth:** Multiple security layers
|
||||||
|
- **Principle of Least Privilege:** Minimal required permissions
|
||||||
|
- **Comprehensive Auditing:** All actions logged and monitored
|
||||||
|
- **Regular Reviews:** Periodic security assessments
|
||||||
|
|
||||||
|
## Implementation Phases
|
||||||
|
|
||||||
|
### Phase 1: Core Platform (4 weeks)
|
||||||
|
- Basic authentication and session management
|
||||||
|
- Deal room creation and management
|
||||||
|
- Document upload with encryption
|
||||||
|
- Basic RBAC implementation
|
||||||
|
|
||||||
|
### Phase 2: Collaboration Features (3 weeks)
|
||||||
|
- Notes and messaging system
|
||||||
|
- Activity feeds and notifications
|
||||||
|
- Advanced permission management
|
||||||
|
- Search functionality
|
||||||
|
|
||||||
|
### Phase 3: AI Integration (2 weeks)
|
||||||
|
- K2.5 document analysis
|
||||||
|
- Embeddings and semantic search
|
||||||
|
- Document summarization
|
||||||
|
- Similar document recommendations
|
||||||
|
|
||||||
|
### Phase 4: Production Readiness (2 weeks)
|
||||||
|
- Comprehensive audit logging
|
||||||
|
- Admin dashboard
|
||||||
|
- Performance optimization
|
||||||
|
- Security hardening
|
||||||
|
|
||||||
|
### Phase 5: Advanced Features (3 weeks)
|
||||||
|
- Deal stage tracking
|
||||||
|
- Bulk operations
|
||||||
|
- API for integrations
|
||||||
|
- Advanced reporting
|
||||||
|
|
||||||
|
Total estimated development time: **14 weeks** with dedicated development team.
|
||||||
|
|
||||||
|
## Conclusion
|
||||||
|
|
||||||
|
Deal Room represents a modern, security-first approach to Investment Banking document management. By leveraging the proven inou-portal pattern with Go's performance characteristics and AI-enhanced document analysis, we deliver a solution that meets the demanding requirements of financial services while maintaining operational simplicity through single-binary deployment.
|
||||||
|
|
||||||
|
The architecture prioritizes security, auditability, and user experience while providing a clear path for future scalability as the platform grows.
|
||||||
|
|
@ -0,0 +1,15 @@
|
||||||
|
module dealroom
|
||||||
|
|
||||||
|
go 1.22
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/a-h/templ v0.2.778
|
||||||
|
github.com/gorilla/sessions v1.2.2
|
||||||
|
github.com/mattn/go-sqlite3 v1.14.18
|
||||||
|
github.com/klauspost/compress v1.17.4
|
||||||
|
golang.org/x/crypto v0.17.0
|
||||||
|
)
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/gorilla/securecookie v1.1.2 // indirect
|
||||||
|
)
|
||||||
|
|
@ -0,0 +1,211 @@
|
||||||
|
package ai
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"net/http"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"dealroom/internal/model"
|
||||||
|
)
|
||||||
|
|
||||||
|
// K25Client handles communication with K2.5 AI service
|
||||||
|
type K25Client struct {
|
||||||
|
baseURL string
|
||||||
|
apiKey string
|
||||||
|
client *http.Client
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewK25Client creates a new K2.5 client
|
||||||
|
func NewK25Client(baseURL, apiKey string) *K25Client {
|
||||||
|
return &K25Client{
|
||||||
|
baseURL: baseURL,
|
||||||
|
apiKey: apiKey,
|
||||||
|
client: &http.Client{
|
||||||
|
Timeout: 30 * time.Second,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// AnalysisRequest represents a request for document analysis
|
||||||
|
type AnalysisRequest struct {
|
||||||
|
Text string `json:"text"`
|
||||||
|
Category string `json:"category,omitempty"` // nda, cim, financial_model, etc.
|
||||||
|
Language string `json:"language,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// AnalysisResponse represents the response from K2.5 analysis
|
||||||
|
type AnalysisResponse struct {
|
||||||
|
Summary string `json:"summary"`
|
||||||
|
KeyMetrics []string `json:"key_metrics"`
|
||||||
|
RiskFactors []string `json:"risk_factors"`
|
||||||
|
Category string `json:"category"`
|
||||||
|
Confidence float64 `json:"confidence"`
|
||||||
|
ProcessingMs int64 `json:"processing_ms"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// EmbeddingRequest represents a request for text embeddings
|
||||||
|
type EmbeddingRequest struct {
|
||||||
|
Text string `json:"text"`
|
||||||
|
Model string `json:"model,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// EmbeddingResponse represents the response from K2.5 embedding
|
||||||
|
type EmbeddingResponse struct {
|
||||||
|
Embedding []float64 `json:"embedding"`
|
||||||
|
Dimension int `json:"dimension"`
|
||||||
|
Model string `json:"model"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// AnalyzeDocument sends text to K2.5 for analysis
|
||||||
|
func (c *K25Client) AnalyzeDocument(text, category string) (*model.DocumentAnalysis, error) {
|
||||||
|
if c.baseURL == "" || c.apiKey == "" {
|
||||||
|
return nil, fmt.Errorf("K2.5 client not configured")
|
||||||
|
}
|
||||||
|
|
||||||
|
req := AnalysisRequest{
|
||||||
|
Text: text,
|
||||||
|
Category: category,
|
||||||
|
Language: "en",
|
||||||
|
}
|
||||||
|
|
||||||
|
jsonData, err := json.Marshal(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to marshal request: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
httpReq, err := http.NewRequest("POST", c.baseURL+"/analyze", bytes.NewBuffer(jsonData))
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to create request: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
httpReq.Header.Set("Content-Type", "application/json")
|
||||||
|
httpReq.Header.Set("Authorization", "Bearer "+c.apiKey)
|
||||||
|
|
||||||
|
resp, err := c.client.Do(httpReq)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to send request: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
body, _ := io.ReadAll(resp.Body)
|
||||||
|
return nil, fmt.Errorf("K2.5 API error %d: %s", resp.StatusCode, string(body))
|
||||||
|
}
|
||||||
|
|
||||||
|
var analysisResp AnalysisResponse
|
||||||
|
if err := json.NewDecoder(resp.Body).Decode(&analysisResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to decode response: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &model.DocumentAnalysis{
|
||||||
|
Summary: analysisResp.Summary,
|
||||||
|
KeyMetrics: analysisResp.KeyMetrics,
|
||||||
|
RiskFactors: analysisResp.RiskFactors,
|
||||||
|
AIConfidence: analysisResp.Confidence,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateEmbedding creates vector embeddings for text
|
||||||
|
func (c *K25Client) GenerateEmbedding(text string) ([]float64, error) {
|
||||||
|
if c.baseURL == "" || c.apiKey == "" {
|
||||||
|
return nil, fmt.Errorf("K2.5 client not configured")
|
||||||
|
}
|
||||||
|
|
||||||
|
req := EmbeddingRequest{
|
||||||
|
Text: text,
|
||||||
|
Model: "default",
|
||||||
|
}
|
||||||
|
|
||||||
|
jsonData, err := json.Marshal(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to marshal request: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
httpReq, err := http.NewRequest("POST", c.baseURL+"/embed", bytes.NewBuffer(jsonData))
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to create request: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
httpReq.Header.Set("Content-Type", "application/json")
|
||||||
|
httpReq.Header.Set("Authorization", "Bearer "+c.apiKey)
|
||||||
|
|
||||||
|
resp, err := c.client.Do(httpReq)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to send request: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
body, _ := io.ReadAll(resp.Body)
|
||||||
|
return nil, fmt.Errorf("K2.5 API error %d: %s", resp.StatusCode, string(body))
|
||||||
|
}
|
||||||
|
|
||||||
|
var embeddingResp EmbeddingResponse
|
||||||
|
if err := json.NewDecoder(resp.Body).Decode(&embeddingResp); err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to decode response: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return embeddingResp.Embedding, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// SearchSimilar finds documents similar to the given text
|
||||||
|
func (c *K25Client) SearchSimilar(text string, limit int) ([]SimilarDocument, error) {
|
||||||
|
// This would typically involve:
|
||||||
|
// 1. Generate embedding for the search text
|
||||||
|
// 2. Query the database for similar embeddings using cosine similarity
|
||||||
|
// 3. Return ranked results
|
||||||
|
|
||||||
|
// For now, return a placeholder implementation
|
||||||
|
return []SimilarDocument{}, fmt.Errorf("not implemented")
|
||||||
|
}
|
||||||
|
|
||||||
|
// SimilarDocument represents a document similar to the search query
|
||||||
|
type SimilarDocument struct {
|
||||||
|
EntryID string `json:"entry_id"`
|
||||||
|
Title string `json:"title"`
|
||||||
|
Similarity float64 `json:"similarity"`
|
||||||
|
Snippet string `json:"snippet"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Health checks if the K2.5 service is available
|
||||||
|
func (c *K25Client) Health() error {
|
||||||
|
if c.baseURL == "" {
|
||||||
|
return fmt.Errorf("K2.5 client not configured")
|
||||||
|
}
|
||||||
|
|
||||||
|
req, err := http.NewRequest("GET", c.baseURL+"/health", nil)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("failed to create health check request: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if c.apiKey != "" {
|
||||||
|
req.Header.Set("Authorization", "Bearer "+c.apiKey)
|
||||||
|
}
|
||||||
|
|
||||||
|
resp, err := c.client.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("health check failed: %w", err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
if resp.StatusCode != http.StatusOK {
|
||||||
|
return fmt.Errorf("K2.5 service unhealthy: status %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExtractTextFromFile extracts text content from various file types
|
||||||
|
func ExtractTextFromFile(filePath, mimeType string) (string, error) {
|
||||||
|
// This would implement text extraction from:
|
||||||
|
// - PDF files
|
||||||
|
// - Microsoft Office documents (DOCX, XLSX, PPTX)
|
||||||
|
// - Plain text files
|
||||||
|
// - Images with OCR
|
||||||
|
|
||||||
|
// For now, return a placeholder
|
||||||
|
return "", fmt.Errorf("text extraction not implemented for %s", mimeType)
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,125 @@
|
||||||
|
package db
|
||||||
|
|
||||||
|
import (
|
||||||
|
"database/sql"
|
||||||
|
"fmt"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Migrate runs all database migrations
|
||||||
|
func Migrate(db *sql.DB) error {
|
||||||
|
migrations := []string{
|
||||||
|
createUsersTable,
|
||||||
|
createEntriesTable,
|
||||||
|
createAccessTable,
|
||||||
|
createSessionsTable,
|
||||||
|
createAuditLogTable,
|
||||||
|
createIndexes,
|
||||||
|
}
|
||||||
|
|
||||||
|
for i, migration := range migrations {
|
||||||
|
if _, err := db.Exec(migration); err != nil {
|
||||||
|
return fmt.Errorf("migration %d failed: %w", i+1, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
const createUsersTable = `
|
||||||
|
CREATE TABLE IF NOT EXISTS users (
|
||||||
|
id TEXT PRIMARY KEY,
|
||||||
|
email TEXT UNIQUE NOT NULL,
|
||||||
|
name TEXT NOT NULL,
|
||||||
|
role TEXT NOT NULL CHECK (role IN ('admin', 'user')),
|
||||||
|
avatar_url TEXT,
|
||||||
|
created_at INTEGER NOT NULL,
|
||||||
|
last_login INTEGER,
|
||||||
|
is_active BOOLEAN NOT NULL DEFAULT 1
|
||||||
|
);`
|
||||||
|
|
||||||
|
const createEntriesTable = `
|
||||||
|
CREATE TABLE IF NOT EXISTS entries (
|
||||||
|
id TEXT PRIMARY KEY,
|
||||||
|
parent_id TEXT,
|
||||||
|
deal_room_id TEXT NOT NULL,
|
||||||
|
entry_type TEXT NOT NULL CHECK (entry_type IN ('deal_room', 'document', 'note', 'message', 'analysis')),
|
||||||
|
title TEXT NOT NULL,
|
||||||
|
content TEXT NOT NULL,
|
||||||
|
file_path TEXT,
|
||||||
|
file_size INTEGER,
|
||||||
|
file_hash TEXT,
|
||||||
|
embedding BLOB,
|
||||||
|
created_by TEXT NOT NULL,
|
||||||
|
created_at INTEGER NOT NULL,
|
||||||
|
updated_at INTEGER NOT NULL,
|
||||||
|
|
||||||
|
FOREIGN KEY (created_by) REFERENCES users(id),
|
||||||
|
FOREIGN KEY (parent_id) REFERENCES entries(id),
|
||||||
|
FOREIGN KEY (deal_room_id) REFERENCES entries(id)
|
||||||
|
);`
|
||||||
|
|
||||||
|
const createAccessTable = `
|
||||||
|
CREATE TABLE IF NOT EXISTS access (
|
||||||
|
id TEXT PRIMARY KEY,
|
||||||
|
entry_id TEXT NOT NULL,
|
||||||
|
user_id TEXT NOT NULL,
|
||||||
|
permissions INTEGER NOT NULL DEFAULT 1,
|
||||||
|
granted_by TEXT NOT NULL,
|
||||||
|
granted_at INTEGER NOT NULL,
|
||||||
|
|
||||||
|
FOREIGN KEY (entry_id) REFERENCES entries(id) ON DELETE CASCADE,
|
||||||
|
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
|
||||||
|
FOREIGN KEY (granted_by) REFERENCES users(id),
|
||||||
|
|
||||||
|
UNIQUE(entry_id, user_id)
|
||||||
|
);`
|
||||||
|
|
||||||
|
const createSessionsTable = `
|
||||||
|
CREATE TABLE IF NOT EXISTS sessions (
|
||||||
|
token TEXT PRIMARY KEY,
|
||||||
|
user_id TEXT NOT NULL,
|
||||||
|
expires_at INTEGER NOT NULL,
|
||||||
|
created_at INTEGER NOT NULL,
|
||||||
|
last_used INTEGER NOT NULL,
|
||||||
|
user_agent TEXT,
|
||||||
|
ip_address TEXT,
|
||||||
|
|
||||||
|
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
|
||||||
|
);`
|
||||||
|
|
||||||
|
const createAuditLogTable = `
|
||||||
|
CREATE TABLE IF NOT EXISTS audit_log (
|
||||||
|
id TEXT PRIMARY KEY,
|
||||||
|
user_id TEXT,
|
||||||
|
entry_id TEXT,
|
||||||
|
action TEXT NOT NULL,
|
||||||
|
details TEXT,
|
||||||
|
ip_address TEXT,
|
||||||
|
user_agent TEXT,
|
||||||
|
created_at INTEGER NOT NULL,
|
||||||
|
|
||||||
|
FOREIGN KEY (user_id) REFERENCES users(id),
|
||||||
|
FOREIGN KEY (entry_id) REFERENCES entries(id)
|
||||||
|
);`
|
||||||
|
|
||||||
|
const createIndexes = `
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_users_active ON users(is_active);
|
||||||
|
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_entries_deal_room ON entries(deal_room_id);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_entries_type ON entries(entry_type);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_entries_parent ON entries(parent_id);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_entries_created ON entries(created_at);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_entries_creator ON entries(created_by);
|
||||||
|
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_access_entry ON access(entry_id);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_access_user ON access(user_id);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_access_permissions ON access(permissions);
|
||||||
|
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_sessions_expires ON sessions(expires_at);
|
||||||
|
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_audit_user ON audit_log(user_id);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_audit_entry ON audit_log(entry_id);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_audit_action ON audit_log(action);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_audit_created ON audit_log(created_at);`
|
||||||
|
|
@ -0,0 +1,206 @@
|
||||||
|
package handler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"database/sql"
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"dealroom/internal/rbac"
|
||||||
|
"dealroom/internal/store"
|
||||||
|
|
||||||
|
"github.com/gorilla/sessions"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Handler contains dependencies for HTTP handlers
|
||||||
|
type Handler struct {
|
||||||
|
db *sql.DB
|
||||||
|
store *store.Store
|
||||||
|
rbac *rbac.Engine
|
||||||
|
sessions *sessions.CookieStore
|
||||||
|
config *Config
|
||||||
|
}
|
||||||
|
|
||||||
|
// Config holds configuration for handlers
|
||||||
|
type Config struct {
|
||||||
|
BaseURL string
|
||||||
|
SessionKey string
|
||||||
|
K25APIURL string
|
||||||
|
K25APIKey string
|
||||||
|
SMTPHost string
|
||||||
|
SMTPUser string
|
||||||
|
SMTPPass string
|
||||||
|
}
|
||||||
|
|
||||||
|
// New creates a new handler instance
|
||||||
|
func New(db *sql.DB, fileStore *store.Store, config *Config) *Handler {
|
||||||
|
return &Handler{
|
||||||
|
db: db,
|
||||||
|
store: fileStore,
|
||||||
|
rbac: rbac.New(db),
|
||||||
|
sessions: sessions.NewCookieStore([]byte(config.SessionKey)),
|
||||||
|
config: config,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// RegisterRoutes sets up all HTTP routes
|
||||||
|
func (h *Handler) RegisterRoutes(mux *http.ServeMux) {
|
||||||
|
// Static files
|
||||||
|
mux.Handle("/static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static"))))
|
||||||
|
|
||||||
|
// Authentication routes
|
||||||
|
mux.HandleFunc("/auth/login", h.handleLogin)
|
||||||
|
mux.HandleFunc("/auth/verify/", h.handleVerifyLogin)
|
||||||
|
mux.HandleFunc("/auth/logout", h.handleLogout)
|
||||||
|
mux.HandleFunc("/auth/me", h.handleMe)
|
||||||
|
|
||||||
|
// Page routes
|
||||||
|
mux.HandleFunc("/", h.handleDashboard)
|
||||||
|
mux.HandleFunc("/login", h.handleLoginPage)
|
||||||
|
mux.HandleFunc("/deal-rooms/", h.handleDealRoom)
|
||||||
|
mux.HandleFunc("/documents/", h.handleDocument)
|
||||||
|
mux.HandleFunc("/admin", h.requireAuth(h.requireAdmin(h.handleAdmin)))
|
||||||
|
mux.HandleFunc("/profile", h.requireAuth(h.handleProfile))
|
||||||
|
mux.HandleFunc("/activity", h.requireAuth(h.handleActivity))
|
||||||
|
|
||||||
|
// API routes
|
||||||
|
mux.HandleFunc("/api/deal-rooms", h.requireAuth(h.handleAPIEndpoint("deal-rooms")))
|
||||||
|
mux.HandleFunc("/api/deal-rooms/", h.requireAuth(h.handleAPIEndpoint("deal-rooms")))
|
||||||
|
mux.HandleFunc("/api/entries", h.requireAuth(h.handleAPIEndpoint("entries")))
|
||||||
|
mux.HandleFunc("/api/entries/", h.requireAuth(h.handleAPIEndpoint("entries")))
|
||||||
|
mux.HandleFunc("/api/search", h.requireAuth(h.handleSearch))
|
||||||
|
mux.HandleFunc("/api/activity/", h.requireAuth(h.handleAPIActivity))
|
||||||
|
}
|
||||||
|
|
||||||
|
// Middleware
|
||||||
|
|
||||||
|
func (h *Handler) requireAuth(next http.HandlerFunc) http.HandlerFunc {
|
||||||
|
return func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
session, _ := h.sessions.Get(r, "dealroom")
|
||||||
|
userID, ok := session.Values["user_id"].(string)
|
||||||
|
|
||||||
|
if !ok || userID == "" {
|
||||||
|
if isAPIRequest(r) {
|
||||||
|
http.Error(w, "Authentication required", http.StatusUnauthorized)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
http.Redirect(w, r, "/login", http.StatusSeeOther)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// Add user ID to request context
|
||||||
|
ctx := r.Context()
|
||||||
|
ctx = setUserID(ctx, userID)
|
||||||
|
next.ServeHTTP(w, r.WithContext(ctx))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
|
||||||
|
return func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
userID := getUserID(r.Context())
|
||||||
|
|
||||||
|
// Check if user is admin
|
||||||
|
var role string
|
||||||
|
err := h.db.QueryRow("SELECT role FROM users WHERE id = ?", userID).Scan(&role)
|
||||||
|
if err != nil || role != "admin" {
|
||||||
|
http.Error(w, "Admin access required", http.StatusForbidden)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
next.ServeHTTP(w, r)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Placeholder handlers - to be implemented
|
||||||
|
|
||||||
|
func (h *Handler) handleLogin(w http.ResponseWriter, r *http.Request) {
|
||||||
|
// TODO: Implement magic link login
|
||||||
|
http.Error(w, "Not implemented", http.StatusNotImplemented)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) handleVerifyLogin(w http.ResponseWriter, r *http.Request) {
|
||||||
|
// TODO: Implement login verification
|
||||||
|
http.Error(w, "Not implemented", http.StatusNotImplemented)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) handleLogout(w http.ResponseWriter, r *http.Request) {
|
||||||
|
session, _ := h.sessions.Get(r, "dealroom")
|
||||||
|
session.Values["user_id"] = ""
|
||||||
|
session.Save(r, w)
|
||||||
|
http.Redirect(w, r, "/login", http.StatusSeeOther)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) handleMe(w http.ResponseWriter, r *http.Request) {
|
||||||
|
// TODO: Return current user info
|
||||||
|
http.Error(w, "Not implemented", http.StatusNotImplemented)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) handleDashboard(w http.ResponseWriter, r *http.Request) {
|
||||||
|
// TODO: Render dashboard template
|
||||||
|
http.Error(w, "Not implemented", http.StatusNotImplemented)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) handleLoginPage(w http.ResponseWriter, r *http.Request) {
|
||||||
|
// TODO: Render login template
|
||||||
|
http.Error(w, "Not implemented", http.StatusNotImplemented)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) handleDealRoom(w http.ResponseWriter, r *http.Request) {
|
||||||
|
// TODO: Handle deal room pages
|
||||||
|
http.Error(w, "Not implemented", http.StatusNotImplemented)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) handleDocument(w http.ResponseWriter, r *http.Request) {
|
||||||
|
// TODO: Handle document viewing
|
||||||
|
http.Error(w, "Not implemented", http.StatusNotImplemented)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) handleAdmin(w http.ResponseWriter, r *http.Request) {
|
||||||
|
// TODO: Render admin panel
|
||||||
|
http.Error(w, "Not implemented", http.StatusNotImplemented)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) handleProfile(w http.ResponseWriter, r *http.Request) {
|
||||||
|
// TODO: Render user profile
|
||||||
|
http.Error(w, "Not implemented", http.StatusNotImplemented)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) handleActivity(w http.ResponseWriter, r *http.Request) {
|
||||||
|
// TODO: Render activity feed
|
||||||
|
http.Error(w, "Not implemented", http.StatusNotImplemented)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) handleAPIEndpoint(endpoint string) http.HandlerFunc {
|
||||||
|
return func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
// TODO: Implement REST API endpoints
|
||||||
|
http.Error(w, "Not implemented", http.StatusNotImplemented)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) handleSearch(w http.ResponseWriter, r *http.Request) {
|
||||||
|
// TODO: Implement search API
|
||||||
|
http.Error(w, "Not implemented", http.StatusNotImplemented)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) handleAPIActivity(w http.ResponseWriter, r *http.Request) {
|
||||||
|
// TODO: Implement activity API
|
||||||
|
http.Error(w, "Not implemented", http.StatusNotImplemented)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Helper functions
|
||||||
|
|
||||||
|
func isAPIRequest(r *http.Request) bool {
|
||||||
|
return r.Header.Get("Accept") == "application/json" ||
|
||||||
|
r.Header.Get("Content-Type") == "application/json" ||
|
||||||
|
r.URL.Path[:5] == "/api/"
|
||||||
|
}
|
||||||
|
|
||||||
|
// Context helpers would go in a separate context.go file
|
||||||
|
func setUserID(ctx context.Context, userID string) context.Context {
|
||||||
|
// TODO: Implement context helpers
|
||||||
|
return ctx
|
||||||
|
}
|
||||||
|
|
||||||
|
func getUserID(ctx context.Context) string {
|
||||||
|
// TODO: Implement context helpers
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,146 @@
|
||||||
|
package model
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// User represents a system user
|
||||||
|
type User struct {
|
||||||
|
ID string `json:"id"`
|
||||||
|
Email string `json:"email"`
|
||||||
|
Name string `json:"name"`
|
||||||
|
Role string `json:"role"` // admin, user
|
||||||
|
AvatarURL *string `json:"avatar_url,omitempty"`
|
||||||
|
CreatedAt time.Time `json:"created_at"`
|
||||||
|
LastLogin *time.Time `json:"last_login,omitempty"`
|
||||||
|
IsActive bool `json:"is_active"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Entry represents any content in the system (deal room, document, note, etc.)
|
||||||
|
type Entry struct {
|
||||||
|
ID string `json:"id"`
|
||||||
|
ParentID *string `json:"parent_id,omitempty"`
|
||||||
|
DealRoomID string `json:"deal_room_id"`
|
||||||
|
EntryType string `json:"entry_type"`
|
||||||
|
Title string `json:"title"`
|
||||||
|
Content json.RawMessage `json:"content"`
|
||||||
|
FilePath *string `json:"file_path,omitempty"`
|
||||||
|
FileSize *int64 `json:"file_size,omitempty"`
|
||||||
|
FileHash *string `json:"file_hash,omitempty"`
|
||||||
|
Embedding []byte `json:"-"` // Not included in JSON output
|
||||||
|
CreatedBy string `json:"created_by"`
|
||||||
|
CreatedAt time.Time `json:"created_at"`
|
||||||
|
UpdatedAt time.Time `json:"updated_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Access represents RBAC permissions for entries
|
||||||
|
type Access struct {
|
||||||
|
ID string `json:"id"`
|
||||||
|
EntryID string `json:"entry_id"`
|
||||||
|
UserID string `json:"user_id"`
|
||||||
|
Permissions int `json:"permissions"` // Bitmask: read=1, write=2, delete=4, manage=8
|
||||||
|
GrantedBy string `json:"granted_by"`
|
||||||
|
GrantedAt time.Time `json:"granted_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Permission constants
|
||||||
|
const (
|
||||||
|
PermissionRead = 1
|
||||||
|
PermissionWrite = 2
|
||||||
|
PermissionDelete = 4
|
||||||
|
PermissionManage = 8
|
||||||
|
)
|
||||||
|
|
||||||
|
// HasPermission checks if access includes the given permission
|
||||||
|
func (a *Access) HasPermission(permission int) bool {
|
||||||
|
return a.Permissions&permission != 0
|
||||||
|
}
|
||||||
|
|
||||||
|
// Session represents a user session
|
||||||
|
type Session struct {
|
||||||
|
Token string `json:"token"`
|
||||||
|
UserID string `json:"user_id"`
|
||||||
|
ExpiresAt time.Time `json:"expires_at"`
|
||||||
|
CreatedAt time.Time `json:"created_at"`
|
||||||
|
LastUsed time.Time `json:"last_used"`
|
||||||
|
UserAgent *string `json:"user_agent,omitempty"`
|
||||||
|
IPAddress *string `json:"ip_address,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// IsExpired checks if the session has expired
|
||||||
|
func (s *Session) IsExpired() bool {
|
||||||
|
return time.Now().After(s.ExpiresAt)
|
||||||
|
}
|
||||||
|
|
||||||
|
// AuditLog represents an audit trail entry
|
||||||
|
type AuditLog struct {
|
||||||
|
ID string `json:"id"`
|
||||||
|
UserID *string `json:"user_id,omitempty"`
|
||||||
|
EntryID *string `json:"entry_id,omitempty"`
|
||||||
|
Action string `json:"action"`
|
||||||
|
Details json.RawMessage `json:"details,omitempty"`
|
||||||
|
IPAddress *string `json:"ip_address,omitempty"`
|
||||||
|
UserAgent *string `json:"user_agent,omitempty"`
|
||||||
|
CreatedAt time.Time `json:"created_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Deal Room specific content types
|
||||||
|
|
||||||
|
// DealRoomContent represents the content structure for deal room entries
|
||||||
|
type DealRoomContent struct {
|
||||||
|
Type string `json:"type"`
|
||||||
|
Description string `json:"description"`
|
||||||
|
Stage string `json:"stage"` // sourcing, loi, due_diligence, closing, completed
|
||||||
|
TargetCompany string `json:"target_company"`
|
||||||
|
DealValue string `json:"deal_value"`
|
||||||
|
Participants []DealParticipant `json:"participants"`
|
||||||
|
KeyDates map[string]string `json:"key_dates"`
|
||||||
|
ConfidentialityLevel string `json:"confidentiality_level"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type DealParticipant struct {
|
||||||
|
Name string `json:"name"`
|
||||||
|
Role string `json:"role"`
|
||||||
|
Organization string `json:"organization"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// DocumentContent represents the content structure for document entries
|
||||||
|
type DocumentContent struct {
|
||||||
|
Type string `json:"type"`
|
||||||
|
Category string `json:"category"` // nda, cim, financial_model, teaser, legal, dd_report
|
||||||
|
MimeType string `json:"mime_type"`
|
||||||
|
OriginalName string `json:"original_name"`
|
||||||
|
Version string `json:"version"`
|
||||||
|
Analysis *DocumentAnalysis `json:"analysis,omitempty"`
|
||||||
|
RequiresNDA bool `json:"requires_nda"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type DocumentAnalysis struct {
|
||||||
|
Summary string `json:"summary"`
|
||||||
|
KeyMetrics []string `json:"key_metrics"`
|
||||||
|
RiskFactors []string `json:"risk_factors"`
|
||||||
|
AIConfidence float64 `json:"ai_confidence"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// NoteContent represents the content structure for note/message entries
|
||||||
|
type NoteContent struct {
|
||||||
|
Type string `json:"type"`
|
||||||
|
Body string `json:"body"`
|
||||||
|
Mentions []string `json:"mentions"` // User IDs mentioned with @
|
||||||
|
Attachments []string `json:"attachments"` // Entry IDs referenced
|
||||||
|
ThreadContext string `json:"thread_context"` // Context for organizing conversations
|
||||||
|
}
|
||||||
|
|
||||||
|
// ActivityItem represents an item in the activity feed
|
||||||
|
type ActivityItem struct {
|
||||||
|
ID string `json:"id"`
|
||||||
|
UserID string `json:"user_id"`
|
||||||
|
UserName string `json:"user_name"`
|
||||||
|
Action string `json:"action"`
|
||||||
|
EntryID string `json:"entry_id"`
|
||||||
|
EntryType string `json:"entry_type"`
|
||||||
|
Title string `json:"title"`
|
||||||
|
Details json.RawMessage `json:"details,omitempty"`
|
||||||
|
CreatedAt time.Time `json:"created_at"`
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
package model
|
||||||
|
|
||||||
|
import "time"
|
||||||
|
|
||||||
|
// Now returns the current Unix timestamp
|
||||||
|
func Now() int64 {
|
||||||
|
return time.Now().Unix()
|
||||||
|
}
|
||||||
|
|
||||||
|
// TimeFromUnix converts Unix timestamp to time.Time
|
||||||
|
func TimeFromUnix(unix int64) time.Time {
|
||||||
|
return time.Unix(unix, 0)
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,246 @@
|
||||||
|
package rbac
|
||||||
|
|
||||||
|
import (
|
||||||
|
"database/sql"
|
||||||
|
"fmt"
|
||||||
|
|
||||||
|
"dealroom/internal/model"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Engine handles role-based access control
|
||||||
|
type Engine struct {
|
||||||
|
db *sql.DB
|
||||||
|
}
|
||||||
|
|
||||||
|
// New creates a new RBAC engine
|
||||||
|
func New(db *sql.DB) *Engine {
|
||||||
|
return &Engine{db: db}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GrantAccess grants permissions to a user for an entry
|
||||||
|
func (e *Engine) GrantAccess(entryID, userID string, permissions int, grantedBy string) error {
|
||||||
|
query := `
|
||||||
|
INSERT OR REPLACE INTO access (id, entry_id, user_id, permissions, granted_by, granted_at)
|
||||||
|
VALUES (?, ?, ?, ?, ?, ?)
|
||||||
|
`
|
||||||
|
|
||||||
|
id := fmt.Sprintf("%s:%s", entryID, userID)
|
||||||
|
_, err := e.db.Exec(query, id, entryID, userID, permissions, grantedBy, model.Now())
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
// RevokeAccess removes all permissions for a user on an entry
|
||||||
|
func (e *Engine) RevokeAccess(entryID, userID string) error {
|
||||||
|
query := `DELETE FROM access WHERE entry_id = ? AND user_id = ?`
|
||||||
|
_, err := e.db.Exec(query, entryID, userID)
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
// CheckAccess verifies if a user has specific permissions for an entry
|
||||||
|
func (e *Engine) CheckAccess(userID, entryID string, permission int) (bool, error) {
|
||||||
|
// Admins have all permissions
|
||||||
|
if isAdmin, err := e.isUserAdmin(userID); err != nil {
|
||||||
|
return false, err
|
||||||
|
} else if isAdmin {
|
||||||
|
return true, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check direct permissions
|
||||||
|
access, err := e.getUserAccess(userID, entryID)
|
||||||
|
if err != nil && err != sql.ErrNoRows {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if access != nil && access.HasPermission(permission) {
|
||||||
|
return true, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check inherited permissions from deal room
|
||||||
|
if inherited, err := e.checkInheritedAccess(userID, entryID, permission); err != nil {
|
||||||
|
return false, err
|
||||||
|
} else if inherited {
|
||||||
|
return true, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
return false, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetUserAccess returns the access record for a user on an entry
|
||||||
|
func (e *Engine) GetUserAccess(userID, entryID string) (*model.Access, error) {
|
||||||
|
return e.getUserAccess(userID, entryID)
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetEntryAccess returns all access records for an entry
|
||||||
|
func (e *Engine) GetEntryAccess(entryID string) ([]*model.Access, error) {
|
||||||
|
query := `
|
||||||
|
SELECT id, entry_id, user_id, permissions, granted_by, granted_at
|
||||||
|
FROM access
|
||||||
|
WHERE entry_id = ?
|
||||||
|
ORDER BY granted_at DESC
|
||||||
|
`
|
||||||
|
|
||||||
|
rows, err := e.db.Query(query, entryID)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
defer rows.Close()
|
||||||
|
|
||||||
|
var accessList []*model.Access
|
||||||
|
for rows.Next() {
|
||||||
|
access := &model.Access{}
|
||||||
|
var grantedAt int64
|
||||||
|
|
||||||
|
err := rows.Scan(&access.ID, &access.EntryID, &access.UserID,
|
||||||
|
&access.Permissions, &access.GrantedBy, &grantedAt)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
access.GrantedAt = model.TimeFromUnix(grantedAt)
|
||||||
|
accessList = append(accessList, access)
|
||||||
|
}
|
||||||
|
|
||||||
|
return accessList, rows.Err()
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetUserEntries returns entries accessible to a user with specified permissions
|
||||||
|
func (e *Engine) GetUserEntries(userID string, entryType string, permission int) ([]*model.Entry, error) {
|
||||||
|
// Admins can see everything
|
||||||
|
if isAdmin, err := e.isUserAdmin(userID); err != nil {
|
||||||
|
return nil, err
|
||||||
|
} else if isAdmin {
|
||||||
|
return e.getAllEntriesByType(entryType)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Get entries with direct access
|
||||||
|
query := `
|
||||||
|
SELECT DISTINCT e.id, e.parent_id, e.deal_room_id, e.entry_type, e.title,
|
||||||
|
e.content, e.file_path, e.file_size, e.file_hash,
|
||||||
|
e.created_by, e.created_at, e.updated_at
|
||||||
|
FROM entries e
|
||||||
|
JOIN access a ON e.id = a.entry_id
|
||||||
|
WHERE a.user_id = ? AND (a.permissions & ?) > 0
|
||||||
|
AND ($1 = '' OR e.entry_type = $1)
|
||||||
|
ORDER BY e.created_at DESC
|
||||||
|
`
|
||||||
|
|
||||||
|
rows, err := e.db.Query(query, userID, permission, entryType)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
defer rows.Close()
|
||||||
|
|
||||||
|
return e.scanEntries(rows)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Helper methods
|
||||||
|
|
||||||
|
func (e *Engine) isUserAdmin(userID string) (bool, error) {
|
||||||
|
query := `SELECT role FROM users WHERE id = ? AND is_active = 1`
|
||||||
|
var role string
|
||||||
|
err := e.db.QueryRow(query, userID).Scan(&role)
|
||||||
|
if err != nil {
|
||||||
|
if err == sql.ErrNoRows {
|
||||||
|
return false, nil
|
||||||
|
}
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
return role == "admin", nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (e *Engine) getUserAccess(userID, entryID string) (*model.Access, error) {
|
||||||
|
query := `
|
||||||
|
SELECT id, entry_id, user_id, permissions, granted_by, granted_at
|
||||||
|
FROM access
|
||||||
|
WHERE user_id = ? AND entry_id = ?
|
||||||
|
`
|
||||||
|
|
||||||
|
access := &model.Access{}
|
||||||
|
var grantedAt int64
|
||||||
|
|
||||||
|
err := e.db.QueryRow(query, userID, entryID).Scan(
|
||||||
|
&access.ID, &access.EntryID, &access.UserID,
|
||||||
|
&access.Permissions, &access.GrantedBy, &grantedAt)
|
||||||
|
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
access.GrantedAt = model.TimeFromUnix(grantedAt)
|
||||||
|
return access, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (e *Engine) checkInheritedAccess(userID, entryID string, permission int) (bool, error) {
|
||||||
|
// Get the deal room ID for this entry
|
||||||
|
query := `SELECT deal_room_id FROM entries WHERE id = ?`
|
||||||
|
var dealRoomID string
|
||||||
|
err := e.db.QueryRow(query, entryID).Scan(&dealRoomID)
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
|
||||||
|
// If this is already a deal room, no inheritance
|
||||||
|
if dealRoomID == entryID {
|
||||||
|
return false, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check access to the deal room
|
||||||
|
return e.CheckAccess(userID, dealRoomID, permission)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (e *Engine) getAllEntriesByType(entryType string) ([]*model.Entry, error) {
|
||||||
|
query := `
|
||||||
|
SELECT id, parent_id, deal_room_id, entry_type, title,
|
||||||
|
content, file_path, file_size, file_hash,
|
||||||
|
created_by, created_at, updated_at
|
||||||
|
FROM entries
|
||||||
|
WHERE ($1 = '' OR entry_type = $1)
|
||||||
|
ORDER BY created_at DESC
|
||||||
|
`
|
||||||
|
|
||||||
|
rows, err := e.db.Query(query, entryType)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
defer rows.Close()
|
||||||
|
|
||||||
|
return e.scanEntries(rows)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (e *Engine) scanEntries(rows *sql.Rows) ([]*model.Entry, error) {
|
||||||
|
var entries []*model.Entry
|
||||||
|
|
||||||
|
for rows.Next() {
|
||||||
|
entry := &model.Entry{}
|
||||||
|
var createdAt, updatedAt int64
|
||||||
|
var parentID, filePath, fileSize, fileHash sql.NullString
|
||||||
|
var fileSizeInt sql.NullInt64
|
||||||
|
|
||||||
|
err := rows.Scan(&entry.ID, &parentID, &entry.DealRoomID, &entry.EntryType,
|
||||||
|
&entry.Title, &entry.Content, &filePath, &fileSizeInt, &fileHash,
|
||||||
|
&entry.CreatedBy, &createdAt, &updatedAt)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if parentID.Valid {
|
||||||
|
entry.ParentID = &parentID.String
|
||||||
|
}
|
||||||
|
if filePath.Valid {
|
||||||
|
entry.FilePath = &filePath.String
|
||||||
|
}
|
||||||
|
if fileSizeInt.Valid {
|
||||||
|
entry.FileSize = &fileSizeInt.Int64
|
||||||
|
}
|
||||||
|
if fileHash.Valid {
|
||||||
|
entry.FileHash = &fileHash.String
|
||||||
|
}
|
||||||
|
|
||||||
|
entry.CreatedAt = model.TimeFromUnix(createdAt)
|
||||||
|
entry.UpdatedAt = model.TimeFromUnix(updatedAt)
|
||||||
|
|
||||||
|
entries = append(entries, entry)
|
||||||
|
}
|
||||||
|
|
||||||
|
return entries, rows.Err()
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,256 @@
|
||||||
|
package store
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/aes"
|
||||||
|
"crypto/cipher"
|
||||||
|
"crypto/rand"
|
||||||
|
"crypto/sha256"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/klauspost/compress/zstd"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Store handles encrypted file storage
|
||||||
|
type Store struct {
|
||||||
|
basePath string
|
||||||
|
key []byte
|
||||||
|
gcm cipher.AEAD
|
||||||
|
encoder *zstd.Encoder
|
||||||
|
decoder *zstd.Decoder
|
||||||
|
}
|
||||||
|
|
||||||
|
// New creates a new encrypted file store
|
||||||
|
func New(basePath string, key []byte) (*Store, error) {
|
||||||
|
// Ensure base path exists
|
||||||
|
if err := os.MkdirAll(basePath, 0755); err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to create base path: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Create AES cipher
|
||||||
|
block, err := aes.NewCipher(key)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to create AES cipher: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
gcm, err := cipher.NewGCM(block)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to create GCM: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Create compression encoder/decoder
|
||||||
|
encoder, err := zstd.NewWriter(nil, zstd.WithEncoderLevel(zstd.SpeedFastest))
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to create zstd encoder: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
decoder, err := zstd.NewReader(nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to create zstd decoder: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &Store{
|
||||||
|
basePath: basePath,
|
||||||
|
key: key,
|
||||||
|
gcm: gcm,
|
||||||
|
encoder: encoder,
|
||||||
|
decoder: decoder,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Store saves data to encrypted storage and returns the file path
|
||||||
|
func (s *Store) Store(entryID string, data []byte) (string, string, error) {
|
||||||
|
// Calculate hash of original data
|
||||||
|
hash := fmt.Sprintf("%x", sha256.Sum256(data))
|
||||||
|
|
||||||
|
// Compress data
|
||||||
|
compressed := s.encoder.EncodeAll(data, nil)
|
||||||
|
|
||||||
|
// Encrypt compressed data
|
||||||
|
nonce := make([]byte, s.gcm.NonceSize())
|
||||||
|
if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
|
||||||
|
return "", "", fmt.Errorf("failed to generate nonce: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
encrypted := s.gcm.Seal(nonce, nonce, compressed, nil)
|
||||||
|
|
||||||
|
// Generate date-based path
|
||||||
|
now := time.Now()
|
||||||
|
datePath := fmt.Sprintf("%d/%02d", now.Year(), now.Month())
|
||||||
|
fullDir := filepath.Join(s.basePath, datePath)
|
||||||
|
|
||||||
|
// Ensure directory exists
|
||||||
|
if err := os.MkdirAll(fullDir, 0755); err != nil {
|
||||||
|
return "", "", fmt.Errorf("failed to create date directory: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Write encrypted data
|
||||||
|
filePath := filepath.Join(datePath, entryID+".enc")
|
||||||
|
fullPath := filepath.Join(s.basePath, filePath)
|
||||||
|
|
||||||
|
if err := os.WriteFile(fullPath, encrypted, 0644); err != nil {
|
||||||
|
return "", "", fmt.Errorf("failed to write encrypted file: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return filePath, hash, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Retrieve loads and decrypts data from storage
|
||||||
|
func (s *Store) Retrieve(filePath string) ([]byte, error) {
|
||||||
|
fullPath := filepath.Join(s.basePath, filePath)
|
||||||
|
|
||||||
|
// Read encrypted data
|
||||||
|
encrypted, err := os.ReadFile(fullPath)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to read encrypted file: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Extract nonce
|
||||||
|
if len(encrypted) < s.gcm.NonceSize() {
|
||||||
|
return nil, fmt.Errorf("encrypted data too short")
|
||||||
|
}
|
||||||
|
|
||||||
|
nonce := encrypted[:s.gcm.NonceSize()]
|
||||||
|
ciphertext := encrypted[s.gcm.NonceSize():]
|
||||||
|
|
||||||
|
// Decrypt
|
||||||
|
compressed, err := s.gcm.Open(nil, nonce, ciphertext, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to decrypt data: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Decompress
|
||||||
|
data, err := s.decoder.DecodeAll(compressed, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to decompress data: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return data, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Delete removes a file from storage
|
||||||
|
func (s *Store) Delete(filePath string) error {
|
||||||
|
fullPath := filepath.Join(s.basePath, filePath)
|
||||||
|
return os.Remove(fullPath)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Exists checks if a file exists in storage
|
||||||
|
func (s *Store) Exists(filePath string) bool {
|
||||||
|
fullPath := filepath.Join(s.basePath, filePath)
|
||||||
|
_, err := os.Stat(fullPath)
|
||||||
|
return err == nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// StoreTemp saves data to temporary storage for processing
|
||||||
|
func (s *Store) StoreTemp(filename string, data []byte) (string, error) {
|
||||||
|
tempDir := filepath.Join(s.basePath, "temp")
|
||||||
|
if err := os.MkdirAll(tempDir, 0755); err != nil {
|
||||||
|
return "", fmt.Errorf("failed to create temp directory: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Sanitize filename
|
||||||
|
sanitized := sanitizeFilename(filename)
|
||||||
|
tempPath := filepath.Join(tempDir, fmt.Sprintf("%d_%s", time.Now().Unix(), sanitized))
|
||||||
|
|
||||||
|
if err := os.WriteFile(tempPath, data, 0644); err != nil {
|
||||||
|
return "", fmt.Errorf("failed to write temp file: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return tempPath, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// CleanupTemp removes temporary files older than the specified duration
|
||||||
|
func (s *Store) CleanupTemp(maxAge time.Duration) error {
|
||||||
|
tempDir := filepath.Join(s.basePath, "temp")
|
||||||
|
|
||||||
|
entries, err := os.ReadDir(tempDir)
|
||||||
|
if err != nil {
|
||||||
|
if os.IsNotExist(err) {
|
||||||
|
return nil // No temp directory, nothing to clean
|
||||||
|
}
|
||||||
|
return fmt.Errorf("failed to read temp directory: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
cutoff := time.Now().Add(-maxAge)
|
||||||
|
|
||||||
|
for _, entry := range entries {
|
||||||
|
if entry.IsDir() {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
info, err := entry.Info()
|
||||||
|
if err != nil {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
if info.ModTime().Before(cutoff) {
|
||||||
|
filePath := filepath.Join(tempDir, entry.Name())
|
||||||
|
os.Remove(filePath) // Ignore errors, best effort cleanup
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetStats returns storage statistics
|
||||||
|
func (s *Store) GetStats() (*StorageStats, error) {
|
||||||
|
stats := &StorageStats{}
|
||||||
|
|
||||||
|
err := filepath.Walk(s.basePath, func(path string, info os.FileInfo, err error) error {
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
if !info.IsDir() {
|
||||||
|
stats.TotalFiles++
|
||||||
|
stats.TotalSize += info.Size()
|
||||||
|
|
||||||
|
if strings.HasSuffix(info.Name(), ".enc") {
|
||||||
|
stats.EncryptedFiles++
|
||||||
|
stats.EncryptedSize += info.Size()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
})
|
||||||
|
|
||||||
|
return stats, err
|
||||||
|
}
|
||||||
|
|
||||||
|
// StorageStats represents storage usage statistics
|
||||||
|
type StorageStats struct {
|
||||||
|
TotalFiles int `json:"total_files"`
|
||||||
|
TotalSize int64 `json:"total_size"`
|
||||||
|
EncryptedFiles int `json:"encrypted_files"`
|
||||||
|
EncryptedSize int64 `json:"encrypted_size"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Close cleanly shuts down the store
|
||||||
|
func (s *Store) Close() error {
|
||||||
|
s.encoder.Close()
|
||||||
|
s.decoder.Close()
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Helper functions
|
||||||
|
|
||||||
|
func sanitizeFilename(filename string) string {
|
||||||
|
// Replace unsafe characters
|
||||||
|
unsafe := []string{"/", "\\", ":", "*", "?", "\"", "<", ">", "|"}
|
||||||
|
safe := filename
|
||||||
|
|
||||||
|
for _, char := range unsafe {
|
||||||
|
safe = strings.ReplaceAll(safe, char, "_")
|
||||||
|
}
|
||||||
|
|
||||||
|
// Limit length
|
||||||
|
if len(safe) > 200 {
|
||||||
|
safe = safe[:200]
|
||||||
|
}
|
||||||
|
|
||||||
|
return safe
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,134 @@
|
||||||
|
/* Deal Room Custom Styles */
|
||||||
|
|
||||||
|
/* HTMX Loading States */
|
||||||
|
.htmx-request {
|
||||||
|
opacity: 0.6;
|
||||||
|
}
|
||||||
|
|
||||||
|
.htmx-request.htmx-indicator {
|
||||||
|
opacity: 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Custom Components */
|
||||||
|
.deal-room-gradient {
|
||||||
|
background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
|
||||||
|
}
|
||||||
|
|
||||||
|
.file-drop-zone {
|
||||||
|
border: 2px dashed #cbd5e0;
|
||||||
|
border-radius: 0.5rem;
|
||||||
|
transition: all 0.3s ease;
|
||||||
|
}
|
||||||
|
|
||||||
|
.file-drop-zone:hover {
|
||||||
|
border-color: #667eea;
|
||||||
|
background-color: #f8fafc;
|
||||||
|
}
|
||||||
|
|
||||||
|
.file-drop-zone.dragover {
|
||||||
|
border-color: #667eea;
|
||||||
|
background-color: #edf2f7;
|
||||||
|
border-style: solid;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Document Icons */
|
||||||
|
.doc-icon {
|
||||||
|
display: inline-flex;
|
||||||
|
align-items: center;
|
||||||
|
justify-content: center;
|
||||||
|
width: 2rem;
|
||||||
|
height: 2rem;
|
||||||
|
border-radius: 0.25rem;
|
||||||
|
font-size: 0.75rem;
|
||||||
|
font-weight: 600;
|
||||||
|
color: white;
|
||||||
|
}
|
||||||
|
|
||||||
|
.doc-icon.pdf { background-color: #e53e3e; }
|
||||||
|
.doc-icon.doc { background-color: #3182ce; }
|
||||||
|
.doc-icon.xlsx { background-color: #38a169; }
|
||||||
|
.doc-icon.ppt { background-color: #d69e2e; }
|
||||||
|
.doc-icon.default { background-color: #718096; }
|
||||||
|
|
||||||
|
/* Activity Feed */
|
||||||
|
.activity-item {
|
||||||
|
position: relative;
|
||||||
|
padding-left: 2rem;
|
||||||
|
}
|
||||||
|
|
||||||
|
.activity-item::before {
|
||||||
|
content: '';
|
||||||
|
position: absolute;
|
||||||
|
left: 0.5rem;
|
||||||
|
top: 0.5rem;
|
||||||
|
width: 0.5rem;
|
||||||
|
height: 0.5rem;
|
||||||
|
border-radius: 50%;
|
||||||
|
background-color: #667eea;
|
||||||
|
}
|
||||||
|
|
||||||
|
.activity-item:not(:last-child)::after {
|
||||||
|
content: '';
|
||||||
|
position: absolute;
|
||||||
|
left: 0.75rem;
|
||||||
|
top: 1rem;
|
||||||
|
width: 0.125rem;
|
||||||
|
height: calc(100% + 1rem);
|
||||||
|
background-color: #e2e8f0;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Permissions Badges */
|
||||||
|
.permission-badge {
|
||||||
|
display: inline-flex;
|
||||||
|
align-items: center;
|
||||||
|
padding: 0.125rem 0.5rem;
|
||||||
|
border-radius: 0.375rem;
|
||||||
|
font-size: 0.75rem;
|
||||||
|
font-weight: 500;
|
||||||
|
}
|
||||||
|
|
||||||
|
.permission-badge.read { background-color: #bee3f8; color: #2a69ac; }
|
||||||
|
.permission-badge.write { background-color: #c6f6d5; color: #276749; }
|
||||||
|
.permission-badge.delete { background-color: #fed7d7; color: #c53030; }
|
||||||
|
.permission-badge.manage { background-color: #e9d8fd; color: #553c9a; }
|
||||||
|
|
||||||
|
/* Custom Scrollbars */
|
||||||
|
.custom-scrollbar::-webkit-scrollbar {
|
||||||
|
width: 0.5rem;
|
||||||
|
}
|
||||||
|
|
||||||
|
.custom-scrollbar::-webkit-scrollbar-track {
|
||||||
|
background: #f1f5f9;
|
||||||
|
border-radius: 0.25rem;
|
||||||
|
}
|
||||||
|
|
||||||
|
.custom-scrollbar::-webkit-scrollbar-thumb {
|
||||||
|
background: #cbd5e0;
|
||||||
|
border-radius: 0.25rem;
|
||||||
|
}
|
||||||
|
|
||||||
|
.custom-scrollbar::-webkit-scrollbar-thumb:hover {
|
||||||
|
background: #a0aec0;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Responsive Utilities */
|
||||||
|
@media (max-width: 768px) {
|
||||||
|
.mobile-hidden {
|
||||||
|
display: none;
|
||||||
|
}
|
||||||
|
|
||||||
|
.mobile-full {
|
||||||
|
width: 100%;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Print Styles */
|
||||||
|
@media print {
|
||||||
|
.no-print {
|
||||||
|
display: none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.print-break {
|
||||||
|
page-break-before: always;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,110 @@
|
||||||
|
package templates
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"dealroom/internal/model"
|
||||||
|
)
|
||||||
|
|
||||||
|
templ Dashboard(user *model.User, dealRooms []*model.Entry) {
|
||||||
|
@Layout("Dashboard", user) {
|
||||||
|
<div class="space-y-8">
|
||||||
|
<!-- Welcome Section -->
|
||||||
|
<div class="bg-white shadow rounded-lg p-6">
|
||||||
|
<div class="flex items-center justify-between">
|
||||||
|
<div>
|
||||||
|
<h1 class="text-2xl font-bold text-gray-900">Welcome back, { user.Name }</h1>
|
||||||
|
<p class="text-gray-600 mt-1">You have access to { fmt.Sprintf("%d", len(dealRooms)) } deal rooms</p>
|
||||||
|
</div>
|
||||||
|
if user.Role == "admin" {
|
||||||
|
<button onclick="window.location.href='/deal-rooms/new'"
|
||||||
|
class="bg-indigo-600 hover:bg-indigo-700 text-white px-4 py-2 rounded-md text-sm font-medium transition-colors">
|
||||||
|
New Deal Room
|
||||||
|
</button>
|
||||||
|
}
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Deal Rooms Grid -->
|
||||||
|
<div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
|
||||||
|
for _, room := range dealRooms {
|
||||||
|
@DealRoomCard(room)
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(dealRooms) == 0 {
|
||||||
|
<div class="col-span-full">
|
||||||
|
<div class="text-center py-12">
|
||||||
|
<svg class="mx-auto h-12 w-12 text-gray-400" stroke="currentColor" fill="none" viewBox="0 0 48 48">
|
||||||
|
<path d="M34 40h10v-4a6 6 0 00-10.712-3.714M34 40H14m20 0v-4a9.971 9.971 0 00-.712-3.714M14 40H4v-4a6 6 0 0110.713-3.714M14 40v-4c0-1.313.253-2.566.713-3.714m0 0A9.971 9.971 0 0124 24c4.21 0 7.813 2.602 9.288 6.286" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
|
||||||
|
</svg>
|
||||||
|
<h3 class="mt-2 text-sm font-medium text-gray-900">No deal rooms</h3>
|
||||||
|
<p class="mt-1 text-sm text-gray-500">Get started by creating a new deal room or wait for an invitation.</p>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
}
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Recent Activity -->
|
||||||
|
<div class="bg-white shadow rounded-lg">
|
||||||
|
<div class="px-6 py-4 border-b border-gray-200">
|
||||||
|
<h2 class="text-lg font-medium text-gray-900">Recent Activity</h2>
|
||||||
|
</div>
|
||||||
|
<div class="divide-y divide-gray-200" hx-get="/api/activity/recent" hx-trigger="load">
|
||||||
|
<!-- Activity items will be loaded via HTMX -->
|
||||||
|
<div class="p-6 text-center text-gray-500">
|
||||||
|
<div class="animate-pulse">Loading recent activity...</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
templ DealRoomCard(room *model.Entry) {
|
||||||
|
<div class="bg-white shadow rounded-lg hover:shadow-md transition-shadow">
|
||||||
|
<div class="p-6">
|
||||||
|
<div class="flex items-center justify-between mb-4">
|
||||||
|
<h3 class="text-lg font-medium text-gray-900 truncate">{ room.Title }</h3>
|
||||||
|
<span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-green-100 text-green-800">
|
||||||
|
Active
|
||||||
|
</span>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Deal Room Details -->
|
||||||
|
<div class="space-y-2 text-sm text-gray-600 mb-4">
|
||||||
|
<div class="flex items-center">
|
||||||
|
<svg class="h-4 w-4 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
||||||
|
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 21V5a2 2 0 00-2-2H7a2 2 0 00-2 2v16m14 0h2m-2 0h-4m-5 0H9m0 0H7m2 0v-5a2 2 0 012-2h2a2 2 0 012 2v5"/>
|
||||||
|
</svg>
|
||||||
|
Target Company
|
||||||
|
</div>
|
||||||
|
<div class="flex items-center">
|
||||||
|
<svg class="h-4 w-4 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
||||||
|
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8c-1.657 0-3 .895-3 2s1.343 2 3 2 3 .895 3 2-1.343 2-3 2m0-8c1.11 0 2.08.402 2.599 1M12 8V7m0 1v8m0 0v1m0-1c-1.11 0-2.08-.402-2.599-1"/>
|
||||||
|
</svg>
|
||||||
|
Deal Value
|
||||||
|
</div>
|
||||||
|
<div class="flex items-center">
|
||||||
|
<svg class="h-4 w-4 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
||||||
|
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 7V3m8 4V3m-9 8h10M5 21h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v12a2 2 0 002 2z"/>
|
||||||
|
</svg>
|
||||||
|
{ room.CreatedAt.Format("Jan 2, 2006") }
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="flex items-center justify-between">
|
||||||
|
<button onclick={ templ.SafeScript("window.location.href='/deal-rooms/" + room.ID + "'") }
|
||||||
|
class="text-indigo-600 hover:text-indigo-500 text-sm font-medium">
|
||||||
|
View Details →
|
||||||
|
</button>
|
||||||
|
<div class="flex -space-x-2">
|
||||||
|
<!-- Participant avatars would go here -->
|
||||||
|
<div class="w-6 h-6 bg-gray-300 rounded-full border-2 border-white"></div>
|
||||||
|
<div class="w-6 h-6 bg-gray-300 rounded-full border-2 border-white"></div>
|
||||||
|
<div class="w-6 h-6 bg-gray-300 rounded-full border-2 border-white flex items-center justify-center">
|
||||||
|
<span class="text-xs text-gray-600">+3</span>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,79 @@
|
||||||
|
package templates
|
||||||
|
|
||||||
|
import "dealroom/internal/model"
|
||||||
|
|
||||||
|
templ Layout(title string, user *model.User) {
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html lang="en">
|
||||||
|
<head>
|
||||||
|
<meta charset="UTF-8"/>
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
|
||||||
|
<title>{ title } - Deal Room</title>
|
||||||
|
<script src="https://unpkg.com/htmx.org@1.9.10"></script>
|
||||||
|
<script src="https://cdn.tailwindcss.com"></script>
|
||||||
|
<style>
|
||||||
|
/* Custom styles for Deal Room */
|
||||||
|
.deal-room-gradient {
|
||||||
|
background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
|
||||||
|
}
|
||||||
|
</style>
|
||||||
|
</head>
|
||||||
|
<body class="bg-gray-50 min-h-screen">
|
||||||
|
if user != nil {
|
||||||
|
@Navigation(user)
|
||||||
|
}
|
||||||
|
<main class="container mx-auto px-4 py-8">
|
||||||
|
{ children... }
|
||||||
|
</main>
|
||||||
|
@Footer()
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
}
|
||||||
|
|
||||||
|
templ Navigation(user *model.User) {
|
||||||
|
<nav class="deal-room-gradient shadow-lg">
|
||||||
|
<div class="container mx-auto px-4">
|
||||||
|
<div class="flex justify-between items-center py-4">
|
||||||
|
<div class="flex items-center space-x-4">
|
||||||
|
<h1 class="text-white text-xl font-bold">Deal Room</h1>
|
||||||
|
<div class="hidden md:flex space-x-6">
|
||||||
|
<a href="/" class="text-white hover:text-gray-200 transition-colors">Dashboard</a>
|
||||||
|
<a href="/activity" class="text-white hover:text-gray-200 transition-colors">Activity</a>
|
||||||
|
if user.Role == "admin" {
|
||||||
|
<a href="/admin" class="text-white hover:text-gray-200 transition-colors">Admin</a>
|
||||||
|
}
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<div class="flex items-center space-x-4">
|
||||||
|
<span class="text-white">{ user.Name }</span>
|
||||||
|
<div class="relative group">
|
||||||
|
if user.AvatarURL != nil {
|
||||||
|
<img src={ *user.AvatarURL } alt="Avatar" class="w-8 h-8 rounded-full"/>
|
||||||
|
} else {
|
||||||
|
<div class="w-8 h-8 bg-white bg-opacity-20 rounded-full flex items-center justify-center">
|
||||||
|
<span class="text-white text-sm font-medium">{ string([]rune(user.Name)[0]) }</span>
|
||||||
|
</div>
|
||||||
|
}
|
||||||
|
<div class="absolute right-0 mt-2 w-48 bg-white rounded-md shadow-lg opacity-0 invisible group-hover:opacity-100 group-hover:visible transition-all duration-200 z-10">
|
||||||
|
<div class="py-1">
|
||||||
|
<a href="/profile" class="block px-4 py-2 text-sm text-gray-700 hover:bg-gray-100">Profile</a>
|
||||||
|
<a href="/auth/logout" class="block px-4 py-2 text-sm text-gray-700 hover:bg-gray-100">Logout</a>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</nav>
|
||||||
|
}
|
||||||
|
|
||||||
|
templ Footer() {
|
||||||
|
<footer class="bg-gray-800 text-white mt-12">
|
||||||
|
<div class="container mx-auto px-4 py-6">
|
||||||
|
<div class="flex justify-between items-center">
|
||||||
|
<p class="text-sm">© 2024 Deal Room. All rights reserved.</p>
|
||||||
|
<p class="text-xs text-gray-400">Secure • Encrypted • Auditable</p>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</footer>
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,52 @@
|
||||||
|
package templates
|
||||||
|
|
||||||
|
templ LoginPage(message string) {
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html lang="en">
|
||||||
|
<head>
|
||||||
|
<meta charset="UTF-8"/>
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
|
||||||
|
<title>Login - Deal Room</title>
|
||||||
|
<script src="https://unpkg.com/htmx.org@1.9.10"></script>
|
||||||
|
<script src="https://cdn.tailwindcss.com"></script>
|
||||||
|
</head>
|
||||||
|
<body class="bg-gray-50 min-h-screen flex items-center justify-center">
|
||||||
|
<div class="max-w-md w-full space-y-8">
|
||||||
|
<div class="text-center">
|
||||||
|
<h1 class="text-4xl font-bold text-gray-900 mb-2">Deal Room</h1>
|
||||||
|
<h2 class="text-xl text-gray-600">Secure Investment Banking Platform</h2>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="bg-white py-8 px-6 shadow-xl rounded-lg">
|
||||||
|
<form hx-post="/auth/login" hx-target="#message" class="space-y-6">
|
||||||
|
<div>
|
||||||
|
<label for="email" class="block text-sm font-medium text-gray-700">Email address</label>
|
||||||
|
<input id="email" name="email" type="email" autocomplete="email" required
|
||||||
|
class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-indigo-500 focus:border-indigo-500"/>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div>
|
||||||
|
<button type="submit"
|
||||||
|
class="w-full flex justify-center py-2 px-4 border border-transparent rounded-md shadow-sm text-sm font-medium text-white bg-indigo-600 hover:bg-indigo-700 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500">
|
||||||
|
Send Magic Link
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
</form>
|
||||||
|
|
||||||
|
<div id="message" class="mt-4">
|
||||||
|
if message != "" {
|
||||||
|
<div class="bg-blue-50 border-l-4 border-blue-400 p-4">
|
||||||
|
<p class="text-blue-700">{ message }</p>
|
||||||
|
</div>
|
||||||
|
}
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="text-center text-sm text-gray-500">
|
||||||
|
<p>Secure, passwordless authentication</p>
|
||||||
|
<p class="mt-1">Check your email for the login link</p>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue