API Routes & RBAC Matrix

import { Request, Response, NextFunction } from 'express';
import { redis } from '../config/redis';
import { db } from '../config/database';

export async function tenantResolverMiddleware(
  req: Request & { tenant?: any },
  res: Response,
  next: NextFunction
) {
  try {
    // 1. Extract tenant identifier
    const subdomain = req.hostname.split('.')[0]; // trust1.gaudaan.in
    const headerTenantId = req.headers['x-tenant-id'] as string;
    const identifier = headerTenantId || subdomain;

    if (!identifier || identifier === 'api' || identifier === 'admin') {
      return next(); // Platform-level route
    }

    // 2. Check Redis cache (TTL: 5 minutes)
    const cacheKey = `tenant:${identifier}`;
    const cached = await redis.get(cacheKey);
    if (cached) {
      req.tenant = JSON.parse(cached);
      return next();
    }

    // 3. Database lookup
    const tenant = await db.query(
      `SELECT id, slug, name, status, plan_id, settings
       FROM tenants WHERE slug = $1 OR id::text = $1 LIMIT 1`,
      [identifier]
    );

    if (!tenant.rows[0]) {
      return res.status(404).json({ error: 'Tenant not found' });
    }

    if (tenant.rows[0].status === 'SUSPENDED') {
      return res.status(403).json({ error: 'Tenant suspended' });
    }

    // 4. Cache and attach
    await redis.setex(cacheKey, 300, JSON.stringify(tenant.rows[0]));
    req.tenant = tenant.rows[0];
    next();
  } catch (err) {
    next(err);
  }
}

import { Request, Response, NextFunction } from 'express';

type Role = 'PLATFORM_ADMIN' | 'TENANT_ADMIN' | 'FINANCE_MANAGER' | 'CONTENT_MANAGER' | 'APP_USER';

const PERMISSIONS: Record<string, Role[]> = {
  'tenant:create':   ['PLATFORM_ADMIN'],
  'tenant:update':   ['PLATFORM_ADMIN', 'TENANT_ADMIN'],
  'donation:read':   ['PLATFORM_ADMIN', 'TENANT_ADMIN', 'FINANCE_MANAGER', 'APP_USER'],
  'donation:export': ['PLATFORM_ADMIN', 'TENANT_ADMIN', 'FINANCE_MANAGER'],
  'gateway:config':  ['PLATFORM_ADMIN', 'TENANT_ADMIN'],
  'event:create':    ['PLATFORM_ADMIN', 'TENANT_ADMIN', 'CONTENT_MANAGER'],
  'audit:read':      ['PLATFORM_ADMIN', 'TENANT_ADMIN'],
};

export function requirePermission(permission: string) {
  return (req: Request & { user?: any }, res: Response, next: NextFunction) => {
    const userRole: Role = req.user?.role;
    const allowed = PERMISSIONS[permission];
    
    if (!userRole || !allowed?.includes(userRole)) {
      return res.status(403).json({ 
        error: 'Insufficient permissions',
        required: permission 
      });
    }
    next();
  };
}

export interface PaymentProvider {
  name: string;
  createOrder(params: CreateOrderParams): Promise<OrderResult>;
  verifySignature(params: VerifyParams): boolean;
  initiateRefund(params: RefundParams): Promise<RefundResult>;
  createRecurringMandate(params: MandateParams): Promise<MandateResult>;
  cancelMandate(mandateId: string): Promise<void>;
  processWebhook(payload: unknown, signature: string): Promise<WebhookEvent>;
}

// Razorpay implementation
export class RazorpayProvider implements PaymentProvider {
  name = 'razorpay';
  private keyId: string;
  private keySecret: string;

  constructor(private config: GatewayConfig) {
    // Keys are decrypted from DB on instantiation
    this.keyId = decrypt(config.key_id_encrypted);
    this.keySecret = decrypt(config.key_secret_encrypted);
  }

  async createOrder(params: CreateOrderParams): Promise<OrderResult> {
    const razorpay = new Razorpay({ key_id: this.keyId, key_secret: this.keySecret });
    const order = await razorpay.orders.create({
      amount: params.amount * 100, // paise
      currency: 'INR',
      receipt: params.idempotencyKey,
    });
    return { orderId: order.id, amount: params.amount };
  }

  verifySignature(params: VerifyParams): boolean {
    const expectedSig = crypto
      .createHmac('sha256', this.keySecret)
      .update(`${params.orderId}|${params.paymentId}`)
      .digest('hex');
    return expectedSig === params.signature;
  }
}