Harden auth + tenant security + creatives scaffold #1

Marketing · 2026-09-21T10:19:13Z

Marketing commented

2026-09-21 10:19:13 +00:00

Summary

Auth middleware on APIs; tenant-scoped KPIs/chat/simulate
Scrub secrets from .env.example; security/ops docs
Creatives SQL + API + dashboard UI

Test plan

Redeploy Dokploy from this branch or merge to main
curl /api/health
Login marketing@ / admin
KPIs + chat require session
Apply sql/creatives.sql before creatives UI

## Summary - Auth middleware on APIs; tenant-scoped KPIs/chat/simulate - Scrub secrets from .env.example; security/ops docs - Creatives SQL + API + dashboard UI ## Test plan - [ ] Redeploy Dokploy from this branch or merge to main - [ ] curl /api/health - [ ] Login marketing@ / admin - [ ] KPIs + chat require session - [ ] Apply sql/creatives.sql before creatives UI

Marketing added 3 commits 2026-09-21 10:19:13 +00:00

fix(security): harden auth, tenant scoping, and scrub secrets 2df3fe6983

Require session on APIs, scope KPIs/activos/simulate to the user tenant, strip real JWTs from .env.example, and add health/smoke/docs for 4Ventures ops.

Co-authored-by: Cursor <cursoragent@cursor.com>

feat: operator docs, Gitea push guide, and creatives API scaffold 6e3d561f4b

Unblock ops with marketing@ provisioning steps and start multi-tenant creatives against Supabase RLS.

Co-authored-by: Cursor <cursoragent@cursor.com>

feat(creatives): wire dashboard list/create to /api/creatives 989ed3c8c0

Co-authored-by: Cursor <cursoragent@cursor.com>

Marketing merged commit ec642b057a into main

2026-09-21 10:22:54 +00:00

Marketing referenced this issue from a commit

2026-09-21 10:22:56 +00:00

Merge pull request 'Harden auth + tenant security + creatives scaffold' (#1) from harden/auth-tenant-security into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Marketing/4ventures-client-portal#1