Capability matrix¶
What exists on the platform, on one page. Every row points at a real module, a real endpoint group and a real UI page — nothing "planned".
Backend modules (bounded contexts)¶
The backend consists of 25 usecase modules from platform-core. Each has the
handler → usecase → repository → domain layering and is mounted under
/api/v1/<module>.
| Module | What it does | API prefix | Permission |
|---|---|---|---|
auth |
eID sign-in (QR / deep link / national-ID push), Google linking, refresh, logout | /v1/auth |
public |
users |
User reads/writes, /me profile |
/v1/users |
authenticated |
rbac |
Dynamic roles and permission catalogue | /v1/rbac |
roles.manage |
org |
Organisations, membership, state-registry lookup | /v1/org |
authenticated (RLS) |
gov |
Government services portal and officer queue | /v1/gov |
authenticated · gov.review |
registry |
Service registry, evidence, life events, once-only | /v1/registry |
registry.view/manage |
catalog |
Public read side of the registry | /v1/catalog |
authenticated |
relay |
Forwarding requests to downstream agencies, SLA tracking | /v1/relay |
relay.view/manage |
gateway |
API gateway — service catalogue and telemetry | /v1/gateway |
gateway.manage |
applications |
OAuth2 client (RP) registry, secret rotation, service grants | /v1/applications |
gateway.manage |
provider |
Front end of the OIDC login / consent / logout challenges | /v1/provider |
mixed |
oidc |
The issuer itself — discovery, JWKS, token, introspection | /oauth2/*, /.well-known/* |
public (per protocol) |
sso |
This app acting as a client of Gerege SSO | /v1/sso |
public |
eidprofile |
Citizen eID PKI profile (organisations, certificates, devices, activity) | /v1/users/me/eid |
authenticated |
eidproxy |
Proxying eID data to registered apps | /v1/eid, /v1/eid-org |
OAuth scope |
sign |
PAdES PDF signing, status, download | /v1/sign |
authenticated |
assets |
Signature image, organisation stamp, Latin name | /v1/me |
authenticated |
gspace |
Gerege Space — the platform's own SFTP storage, per-user quota | /v1/gspace |
authenticated |
integrations |
Google Drive/Meet, Dropbox (tokens AES-256-GCM) | /v1/integrations |
authenticated (RLS) |
ai |
Gemini chat, STT, TTS, translation | /v1/ai |
authenticated |
ai (public) |
Anonymous landing-page chat, streaming and TTS | /v1/public/ai |
public |
audit |
Hash-chained, append-only audit log | /v1/audit |
admin |
security |
Security-event ingest and read | /v1/security |
authenticated · admin |
site |
Site-wide appearance (accent / font / density / theme) | /v1/site |
settings.manage |
theme |
Named theme CRUD and activation | /v1/themes |
settings.manage |
core |
Gerege Core (USER FIND / ORG FIND) wrapper | /v1/core |
admin |
superadmin |
Managing admin users, invites, access mode | /v1/superadmin |
super admin |
admin |
Managing users, AI prompts, knowledge base | /v1/admin |
users.manage, settings.manage |
Permission catalogue¶
Permissions live in the permissions table and are bound to roles through
role_permissions. Migrations install the catalogue:
| Permission | Category | What it unlocks |
|---|---|---|
dashboard.view |
general | Dashboard |
settings.manage |
general | Settings, themes, AI prompts |
users.manage |
administration | User management |
roles.manage |
administration | Roles and permissions |
gateway.manage |
administration | API gateway, applications |
registry.view / registry.manage |
administration | Service registry |
relay.view / relay.manage |
administration | Relay dashboard and routing |
gov.catalog |
administration | Managing the service catalogue |
gov.review |
management | Reviewing citizen applications (officer) |
manager.view |
management | Manager area |
personal.view |
personal | Personal area (/me/*) |
The admin role resolves to the entire catalogue automatically — it has no
explicit rows. See RBAC & super admin.
Frontend surfaces¶
The Next.js app has four personas. Every page renders in four languages
(mn / en / zh / ru) through useT() and lib/i18n.ts.
| Page | What |
|---|---|
/me/dashboard |
Overview |
/me/services · /me/applications |
Service catalogue, my applications |
/me/references |
Certificates |
/me/appointments · /me/payments |
Appointments, payments |
/me/notifications |
Notifications |
/me/organizations |
Organisations and eID-verified membership |
/me/eid/{id,certificates,devices,logs,security,sign} |
eID PKI console |
/me/integrations |
Google Drive/Meet, Dropbox, Gerege Space |
/me/ai · /me/translate |
AI chat, live translation |
/me/profile · /me/settings |
Profile, settings |
| Page | What |
|---|---|
/manager/dashboard |
Manager overview |
/manager/requests |
Citizen application queue (gov.review) |
/manager/users |
User list |
| Page | What |
|---|---|
/admin/dashboard |
System overview |
/admin/users · /admin/roles |
Users, roles and permissions |
/admin/applications |
OAuth client (RP) registry |
/admin/gateway/{overview,services,logs} |
API gateway |
/admin/registry/{services,evidences} |
Service registry |
/admin/relay/{config,[id]} |
Relay routing, SLA |
/admin/audit · /admin/security |
Audit, security events |
/admin/themes · /admin/settings |
Appearance, AI prompts |
/admin/core |
Gerege Core lookups |
| Page | What |
|---|---|
/superadmin/onboard |
MFA onboarding wizard |
/superadmin/login |
Separate sign-in |
/admin/superadmin |
Managing admin users and invites |
OIDC and RP surfaces¶
| Surface | Path | Notes |
|---|---|---|
| Discovery | /.well-known/openid-configuration |
Issuer metadata |
| JWKS | /.well-known/jwks.json |
RS256 public keys |
| Authorize / Token | /oauth2/auth · /oauth2/token |
code flow only, PKCE S256 |
| Introspect / Revoke | /oauth2/introspect · /oauth2/revoke |
RFC 7662 / 7009 |
| End session | /oauth2/sessions/logout |
RP-initiated logout |
| UserInfo | /userinfo |
GET and POST |
| Client admin API | /admin/api/v1/... |
Admin key (loopback) |
| Sign relay | /rp/sign/* |
eID signing relay for third-party RPs |
What is deliberately absent¶
To avoid misunderstanding, these do not exist:
- Password sign-in, registration, password reset, e-mail OTP — identity only ever comes from eID / Google / SSO.
- An ORM — all SQL is hand-written and parameterised.
- An API to configure the guardrails — the base AI safety layer is compiled in and cannot be changed from the database.