feat: Unified Banking CRM — Central hub + Multi-Channel Campaigns + Multi-Tenant Product Entitlements

.env.example

@@ -0,0 +1,149 @@
+# Payment Switch Platform - Environment Configuration
+# Copy this file to .env and update the values for your environment
+
+# =============================================================================
+# DATABASE CONFIGURATION (PostgreSQL)
+# =============================================================================
+DATABASE_URL=postgresql://payment_user:payment_pass_2024@localhost:5432/payment_switch_portal
+
+# =============================================================================
+# REDIS CONFIGURATION
+# =============================================================================
+REDIS_URL=redis://localhost:6379
+
+# =============================================================================
+# APPLICATION CONFIGURATION
+# =============================================================================
+NODE_ENV=development
+PORT=3000
+VITE_APP_ID=payment-switch
+VITE_APP_TITLE=Payment Switch
+
+# =============================================================================
+# KEYCLOAK AUTHENTICATION (OIDC)
+# =============================================================================
+# Keycloak server URL (internal Docker network or external URL)
+KEYCLOAK_URL=http://keycloak:8080
+# Keycloak realm name
+KEYCLOAK_REALM=payment-switch
+# Client ID for the portal application (public client)
+KEYCLOAK_CLIENT_ID=payment-switch-portal
+# Client secret (for confidential clients only)
+KEYCLOAK_CLIENT_SECRET=
+# Admin credentials for Keycloak management
+KEYCLOAK_ADMIN=admin
+KEYCLOAK_ADMIN_PASSWORD=admin_change_me
+
+# =============================================================================
+# APISIX API GATEWAY
+# =============================================================================
+# APISIX Admin API URL
+APISIX_ADMIN_URL=http://apisix:9180
+# APISIX Admin API Key (change in production)
+APISIX_ADMIN_KEY=edd1c9f034335f136f87ad84b625c8f1
+# APISIX client credentials for Keycloak
+KEYCLOAK_APISIX_CLIENT_SECRET=
+
+# =============================================================================
+# PERMIFY AUTHORIZATION (RBAC/ABAC)
+# =============================================================================
+# Permify gRPC endpoint
+PERMIFY_URL=http://permify:3476
+# Permify HTTP endpoint
+PERMIFY_HTTP_URL=http://permify:3478
+# Permify tenant ID (default: t1)
+PERMIFY_TENANT_ID=t1
+
+# =============================================================================
+# OPENAPPSEC WAF
+# =============================================================================
+# OpenAppSec WAF proxy URL
+OPENAPPSEC_URL=http://openappsec:8080
+# Enable learning mode (set to false in production after initial learning)
+OPENAPPSEC_LEARNING_MODE=true
+
+# =============================================================================
+# JWT CONFIGURATION
+# =============================================================================
+# Secret for signing JWT tokens (generate with: openssl rand -base64 32)
+JWT_SECRET=your-super-secret-jwt-key-change-in-production
+
+# =============================================================================
+# EXTERNAL SERVICES (Optional)
+# =============================================================================
+# SendGrid for email notifications
+SENDGRID_API_KEY=
+
+# Twilio for SMS notifications
+TWILIO_ACCOUNT_SID=
+TWILIO_AUTH_TOKEN=
+TWILIO_PHONE_NUMBER=
+
+# Smile Identity for KYC verification
+SMILE_IDENTITY_API_KEY=
+SMILE_IDENTITY_PARTNER_ID=
+
+# NIBSS for Nigerian banking integration
+NIBSS_API_KEY=
+NIBSS_SECRET_KEY=
+
+# =============================================================================
+# MOJALOOP INTEGRATION
+# =============================================================================
+MOJALOOP_HUB_URL=http://mojaloop-hub:4000
+MOJALOOP_PARTICIPANT_ID=payment-switch
+
+# =============================================================================
+# TIGERBEETLE LEDGER
+# =============================================================================
+TIGERBEETLE_ADDRESSES=tigerbeetle:3000
+TIGERBEETLE_CLUSTER_ID=0
+
+# =============================================================================
+# KAFKA EVENT STREAMING
+# =============================================================================
+KAFKA_BROKERS=kafka:9092
+KAFKA_CLIENT_ID=payment-switch
+
+# =============================================================================
+# OBJECT STORAGE (RustFS/MinIO compatible)
+# =============================================================================
+S3_ENDPOINT=http://rustfs:9000
+S3_ACCESS_KEY=minioadmin
+S3_SECRET_KEY=minioadmin
+S3_BUCKET=payment-switch
+
+# =============================================================================
+# OBSERVABILITY
+# =============================================================================
+# Prometheus metrics endpoint
+PROMETHEUS_ENABLED=true
+PROMETHEUS_PORT=9090
+
+# Grafana dashboard
+GRAFANA_ADMIN_USER=admin
+GRAFANA_ADMIN_PASSWORD=admin_change_me
+
+# OpenTelemetry tracing
+OTEL_EXPORTER_OTLP_ENDPOINT=http://jaeger:4318
+OTEL_SERVICE_NAME=payment-switch
+
+# =============================================================================
+# OLLAMA (Local LLM for VLM/OCR)
+# =============================================================================
+OLLAMA_URL=http://ollama:11434
+OLLAMA_MODEL=llava
+
+# =============================================================================
+# SECURITY
+# =============================================================================
+# Enable CORS (comma-separated origins)
+CORS_ORIGINS=http://localhost:3000,http://localhost:3001
+
+# Rate limiting
+RATE_LIMIT_WINDOW_MS=60000
+RATE_LIMIT_MAX_REQUESTS=100
+
+# Session configuration
+SESSION_COOKIE_SECURE=false
+SESSION_COOKIE_SAME_SITE=lax

.env.staging.example

@@ -0,0 +1,114 @@
+# ===== Staging Environment Configuration =====
+# Copy this file to .env.staging and fill in your values
+
+# ===== Core Configuration =====
+NODE_ENV=staging
+PORT=3000
+BASE_URL=https://staging.yourdomain.com
+
+# ===== Database =====
+# Use staging database (separate from production)
+DATABASE_URL=postgresql://staging_user:staging_password@db:5432/payment_switch_staging
+
+# Database credentials for Docker Compose
+DB_ROOT_PASSWORD=staging_root_password_change_me
+DB_USER=staging_user
+DB_PASSWORD=staging_password_change_me
+
+# ===== Authentication =====
+# Generate with: openssl rand -base64 48
+JWT_SECRET=staging_jwt_secret_change_me_to_random_64_chars
+
+# Manus OAuth (use staging/test app if available)
+OAUTH_SERVER_URL=https://api.manus.im
+VITE_OAUTH_PORTAL_URL=https://auth.manus.im
+VITE_APP_ID=your_manus_app_id_here
+OWNER_OPEN_ID=your_owner_openid_here
+OWNER_NAME=Your Name
+
+# ===== Application =====
+VITE_APP_TITLE="Payment Switch Platform (Staging)"
+VITE_APP_LOGO=https://staging.yourdomain.com/logo.png
+VITE_ANALYTICS_ENDPOINT=https://analytics.yourdomain.com
+VITE_ANALYTICS_WEBSITE_ID=staging_website_id
+
+# ===== External APIs (Use Sandbox/Test Credentials) =====
+
+# Twilio (SMS) - Use test credentials
+TWILIO_ACCOUNT_SID=ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+TWILIO_AUTH_TOKEN=your_test_auth_token
+TWILIO_PHONE_NUMBER=+1234567890
+
+# SendGrid (Email) - Use test account
+SENDGRID_API_KEY=SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+SENDGRID_FROM_EMAIL=staging@yourdomain.com
+SENDGRID_FROM_NAME="Payment Switch Platform (Staging)"
+
+# OR use Resend
+# RESEND_API_KEY=re_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+# RESEND_FROM_EMAIL=staging@yourdomain.com
+
+# Smile Identity (KYC) - Use sandbox environment
+SMILE_IDENTITY_PARTNER_ID=your_partner_id
+SMILE_IDENTITY_API_KEY=your_sandbox_api_key
+SMILE_IDENTITY_ENVIRONMENT=sandbox
+
+# NIBSS (Nigerian Banking) - Use sandbox environment
+NIBSS_ORGANIZATION_CODE=your_org_code
+NIBSS_API_KEY=your_sandbox_api_key
+NIBSS_ENVIRONMENT=sandbox
+NIBSS_CERT_PATH=/app/certs/nibss_staging_cert.pem
+NIBSS_KEY_PATH=/app/certs/nibss_staging_key.pem
+
+# Coinbase Commerce (Crypto) - Use test mode
+COINBASE_COMMERCE_API_KEY=your_test_api_key
+COINBASE_COMMERCE_WEBHOOK_SECRET=your_test_webhook_secret
+
+# Circle (USDC) - Use sandbox environment
+CIRCLE_API_KEY=your_sandbox_api_key
+CIRCLE_ENVIRONMENT=sandbox
+
+# ===== Security =====
+# More lenient rate limits for testing
+RATE_LIMIT_WINDOW_MS=900000  # 15 minutes
+RATE_LIMIT_MAX_REQUESTS=200  # Higher limit for testing
+SESSION_DURATION_DAYS=7
+SESSION_DURATION_REMEMBER_DAYS=30
+IDLE_TIMEOUT_MINUTES=30  # Longer timeout for testing
+
+# ===== Monitoring & Logging =====
+# Use staging Sentry project if available
+SENTRY_DSN=https://xxx@xxx.ingest.sentry.io/xxx
+LOG_LEVEL=debug  # More verbose logging in staging
+ENABLE_METRICS=true
+
+# ===== Storage =====
+BUILT_IN_FORGE_API_URL=https://api.manus.im
+BUILT_IN_FORGE_API_KEY=your_staging_api_key
+VITE_FRONTEND_FORGE_API_KEY=your_staging_frontend_key
+VITE_FRONTEND_FORGE_API_URL=https://api.manus.im
+
+# ===== Feature Flags (Optional) =====
+# Enable/disable features for testing
+ENABLE_2FA=true
+ENABLE_TRUSTED_DEVICES=true
+ENABLE_ACCOUNT_RECOVERY=true
+ENABLE_LOGIN_NOTIFICATIONS=true
+ENABLE_RATE_ALERTS=true
+ENABLE_OCR_AUTO_CORRECTION=true
+
+# ===== Testing & Debugging =====
+# Enable additional debugging features in staging
+ENABLE_DEBUG_LOGS=true
+ENABLE_API_LOGGING=true
+ENABLE_SQL_LOGGING=false  # Set to true for database debugging
+DISABLE_RATE_LIMITING=false  # Set to true to disable rate limiting for testing
+
+# ===== Staging-Specific Settings =====
+# Allow test data generation
+ALLOW_TEST_DATA_GENERATION=true
+# Skip certain validations for testing
+SKIP_EMAIL_VERIFICATION=false
+SKIP_PHONE_VERIFICATION=false
+# Use mock external services when credentials not available
+USE_MOCK_SERVICES=false