327 lines
8.7 KiB
Markdown
327 lines
8.7 KiB
Markdown
# Deal Room
|
|
|
|
**Secure Investment Banking Document Sharing Platform**
|
|
|
|
Deal Room is a secure, invite-only document sharing platform designed for Investment Banking deal teams. Built with Go, it provides role-based access control, encrypted file storage, AI-powered document analysis, and comprehensive audit trails for sensitive financial transactions.
|
|
|
|
## Features
|
|
|
|
- 🔐 **Security First**: End-to-end encryption, RBAC, audit logging
|
|
- 📊 **AI-Enhanced**: Document analysis and semantic search via K2.5
|
|
- 🚀 **Production Ready**: Single binary deployment, zero dependencies
|
|
- 📱 **Modern UI**: HTMX + Tailwind CSS for responsive interface
|
|
- 👥 **Collaboration**: Threaded discussions, activity feeds, @mentions
|
|
- 📈 **Deal Tracking**: Pipeline management and stage tracking
|
|
|
|
## Tech Stack
|
|
|
|
- **Backend**: Go 1.22+ with SQLite (encrypted)
|
|
- **Frontend**: HTMX + Tailwind CSS (zero build process)
|
|
- **Templates**: templ (type-safe Go HTML templates)
|
|
- **Storage**: AES-256-GCM encrypted files with zstd compression
|
|
- **AI**: K2.5 integration for document analysis and embeddings
|
|
|
|
## Quick Start
|
|
|
|
### Prerequisites
|
|
|
|
- Go 1.22 or later
|
|
- Make (optional, but recommended)
|
|
|
|
### Development Setup
|
|
|
|
1. **Clone and setup**:
|
|
```bash
|
|
git clone <repository-url>
|
|
cd dealroom
|
|
make setup
|
|
```
|
|
|
|
2. **Install dependencies**:
|
|
```bash
|
|
make install
|
|
```
|
|
|
|
3. **Run in development mode**:
|
|
```bash
|
|
make dev
|
|
```
|
|
|
|
4. **Access the application**:
|
|
- Open http://localhost:8080
|
|
- Default admin user will be created on first run
|
|
|
|
### Production Deployment
|
|
|
|
1. **Build the binary**:
|
|
```bash
|
|
make build
|
|
```
|
|
|
|
2. **Configure environment variables**:
|
|
```bash
|
|
export DB_KEY="your-32-byte-encryption-key"
|
|
export SESSION_SECRET="your-session-secret"
|
|
export BASE_URL="https://dealroom.yourcompany.com"
|
|
# See Configuration section for all variables
|
|
```
|
|
|
|
3. **Run the application**:
|
|
```bash
|
|
./bin/dealroom
|
|
```
|
|
|
|
### Docker Deployment
|
|
|
|
1. **Build and run with Docker**:
|
|
```bash
|
|
make docker-run
|
|
```
|
|
|
|
2. **Or use Docker Compose** (see `docker-compose.yml`):
|
|
```bash
|
|
docker-compose up -d
|
|
```
|
|
|
|
## Configuration
|
|
|
|
Configure the application using environment variables:
|
|
|
|
### Required Settings
|
|
```bash
|
|
DB_KEY=your-32-byte-encryption-key # Database encryption key
|
|
SESSION_SECRET=your-session-secret # Session cookie encryption
|
|
BASE_URL=https://dealroom.company.com # Public URL for magic links
|
|
```
|
|
|
|
### Database & Storage
|
|
```bash
|
|
DB_PATH=/data/db/dealroom.db # SQLite database path
|
|
FILES_PATH=/data/files # Encrypted file storage
|
|
BACKUP_PATH=/data/backups # Backup directory
|
|
```
|
|
|
|
### AI Integration
|
|
```bash
|
|
K25_API_URL=http://k2.5:8080 # K2.5 API endpoint
|
|
K25_API_KEY=your-k2.5-api-key # K2.5 API key
|
|
```
|
|
|
|
### Email (Magic Links)
|
|
```bash
|
|
SMTP_HOST=smtp.company.com # SMTP server
|
|
SMTP_USER=dealroom@company.com # SMTP username
|
|
SMTP_PASS=your-smtp-password # SMTP password
|
|
```
|
|
|
|
### Server
|
|
```bash
|
|
PORT=8080 # HTTP port (default: 8080)
|
|
```
|
|
|
|
## Architecture
|
|
|
|
Deal Room follows the **inou pattern** for data-centric design:
|
|
|
|
- **Unified Data Model**: All content types (deal rooms, documents, notes) stored as typed JSON in the `entries` table
|
|
- **RBAC Engine**: Bitmask permissions (read=1, write=2, delete=4, manage=8) with inheritance
|
|
- **Encrypted Storage**: Files encrypted with AES-256-GCM and compressed with zstd
|
|
- **AI Pipeline**: Document analysis and embeddings for semantic search
|
|
|
|
### Database Schema
|
|
|
|
```sql
|
|
-- Users and authentication
|
|
users (id, email, name, role, created_at, ...)
|
|
|
|
-- Unified content storage
|
|
entries (id, deal_room_id, entry_type, title, content, file_path, ...)
|
|
|
|
-- Role-based access control
|
|
access (id, entry_id, user_id, permissions, granted_by, ...)
|
|
|
|
-- Session management
|
|
sessions (token, user_id, expires_at, ...)
|
|
|
|
-- Audit trail
|
|
audit_log (id, user_id, entry_id, action, details, ...)
|
|
```
|
|
|
|
### File Storage
|
|
|
|
```
|
|
data/
|
|
├── db/dealroom.db # Encrypted SQLite database
|
|
├── files/ # Encrypted file storage
|
|
│ ├── 2024/01/ # Date-based partitioning
|
|
│ │ ├── entry1.enc # AES-256-GCM + zstd
|
|
│ │ └── entry2.enc
|
|
│ └── temp/ # Temporary upload staging
|
|
└── backups/ # Automated backups
|
|
```
|
|
|
|
## API Reference
|
|
|
|
### Authentication
|
|
- `POST /auth/login` - Magic link login
|
|
- `GET /auth/verify/{token}` - Verify login token
|
|
- `POST /auth/logout` - End session
|
|
|
|
### Deal Rooms
|
|
- `GET /api/deal-rooms` - List accessible deal rooms
|
|
- `POST /api/deal-rooms` - Create new deal room
|
|
- `GET /api/deal-rooms/{id}` - Get deal room details
|
|
- `PUT /api/deal-rooms/{id}` - Update deal room
|
|
|
|
### Documents & Content
|
|
- `GET /api/entries` - List entries with permissions
|
|
- `POST /api/entries` - Create entry (document/note)
|
|
- `GET /api/entries/{id}` - Get entry details
|
|
- `GET /api/entries/{id}/file` - Download file
|
|
|
|
### Access Control
|
|
- `GET /api/entries/{id}/access` - List permissions
|
|
- `POST /api/entries/{id}/access` - Grant access
|
|
- `DELETE /api/entries/{id}/access/{user}` - Revoke access
|
|
|
|
### Search & AI
|
|
- `GET /api/search?q={query}` - Semantic search
|
|
- `POST /api/analyze/{id}` - Trigger AI analysis
|
|
|
|
## Development
|
|
|
|
### Project Structure
|
|
|
|
```
|
|
dealroom/
|
|
├── cmd/dealroom/ # Application entry point
|
|
│ └── main.go
|
|
├── internal/ # Internal packages
|
|
│ ├── db/ # Database layer & migrations
|
|
│ ├── model/ # Data models
|
|
│ ├── rbac/ # Role-based access control
|
|
│ ├── store/ # Encrypted file storage
|
|
│ ├── handler/ # HTTP handlers
|
|
│ └── ai/ # K2.5 integration
|
|
├── templates/ # templ templates
|
|
│ ├── layout.templ
|
|
│ ├── dashboard.templ
|
|
│ └── ...
|
|
├── static/ # Static assets
|
|
├── migrations/ # Database migrations
|
|
├── Dockerfile
|
|
├── Makefile
|
|
└── README.md
|
|
```
|
|
|
|
### Available Commands
|
|
|
|
```bash
|
|
make build # Build the application
|
|
make dev # Run in development mode
|
|
make test # Run tests
|
|
make lint # Run linter
|
|
make docker # Build Docker image
|
|
make migrate # Run database migrations
|
|
make clean # Clean build artifacts
|
|
make setup # Setup development environment
|
|
```
|
|
|
|
### Running Tests
|
|
|
|
```bash
|
|
# Run all tests
|
|
make test
|
|
|
|
# Run with coverage
|
|
make test-coverage
|
|
|
|
# Run benchmarks
|
|
make bench
|
|
```
|
|
|
|
### Code Quality
|
|
|
|
```bash
|
|
# Format code
|
|
make fmt
|
|
|
|
# Run linter
|
|
make lint
|
|
|
|
# Security scan
|
|
make security
|
|
```
|
|
|
|
## Security
|
|
|
|
Deal Room implements defense-in-depth security:
|
|
|
|
### Data Protection
|
|
- **Encryption at Rest**: AES-256-GCM for files, encrypted SQLite
|
|
- **Encryption in Transit**: HTTPS only, HSTS headers
|
|
- **Key Management**: Configurable encryption keys
|
|
- **File Access**: No direct file serving, all through API
|
|
|
|
### Access Control
|
|
- **RBAC**: Entry-level permissions with inheritance
|
|
- **Least Privilege**: Users see only what they have access to
|
|
- **Magic Links**: Passwordless email-based authentication
|
|
- **Session Management**: Secure HTTP-only cookies
|
|
|
|
### Audit & Compliance
|
|
- **Audit Trail**: All actions logged with user attribution
|
|
- **Activity Feeds**: Real-time activity monitoring
|
|
- **Access Reviews**: Permission management interface
|
|
- **Data Retention**: Configurable retention policies
|
|
|
|
## Production Considerations
|
|
|
|
### Performance
|
|
- **Concurrent Users**: ~100-200 with SQLite
|
|
- **File Storage**: Limited by disk space
|
|
- **Database Size**: Efficient up to ~100GB
|
|
- **Response Times**: <200ms for page loads
|
|
|
|
### Scalability
|
|
For higher scale requirements:
|
|
- **Database**: Migrate to PostgreSQL
|
|
- **File Storage**: Use S3-compatible object storage
|
|
- **Search**: Dedicated vector database (Pinecone, Weaviate)
|
|
- **Caching**: Add Redis for sessions and queries
|
|
|
|
### Monitoring
|
|
- Health checks at `/health`
|
|
- Metrics endpoint at `/metrics` (when enabled)
|
|
- Structured logging with levels
|
|
- Audit trail for compliance
|
|
|
|
## Contributing
|
|
|
|
1. Fork the repository
|
|
2. Create a feature branch
|
|
3. Make your changes
|
|
4. Add tests for new functionality
|
|
5. Run the test suite: `make test`
|
|
6. Submit a pull request
|
|
|
|
### Code Style
|
|
- Follow standard Go formatting (`make fmt`)
|
|
- Use meaningful variable names
|
|
- Add comments for public functions
|
|
- Keep functions focused and small
|
|
|
|
## License
|
|
|
|
This project is proprietary software owned by Misha Muskepo and licensed for use by authorized parties only.
|
|
|
|
## Support
|
|
|
|
For support or questions:
|
|
- **Owner**: Misha Muskepo (michael@muskepo.com)
|
|
- **Tech Lead**: James
|
|
- **Documentation**: See `SPEC.md` for detailed architecture
|
|
|
|
---
|
|
|
|
**Deal Room** - Secure, AI-Enhanced Investment Banking Platform |