Skip to content

Capability map

This page lists every capability that actually exists in the code — module, API prefix, UI surface, required permission. Follow the links for the details.

Where does the code live?

All backend capabilities live in the platform-core Go module (v0.3.4). This repository's backend/cmd/api/main.go boots that foundation and names it ServiceName = "gerege-pos" — a reference deployment with no routes of its own. The frontend (Next.js BFF) lives entirely in this repository.

Module map

Module What it does API prefix UI surface Permission
Authentication eID (QR · App2App · national-ID push), Google link, Gerege SSO /api/v1/auth/*, /api/v1/sso/* /login, /auth/eid/callback public
OIDC provider The platform is itself an identity provider /.well-known/*, /oauth2/*, /userinfo /oauth/login, /oauth/consent public (client auth)
eID PKI profile Organisations, certificates, devices, activity /api/v1/users/me/eid/* /me/eid/* signed in
eID Service Proxy Apps call eID services through a proxy /api/v1/eid/*, /api/v1/eid-org/* — (m2m) svc:* grant
Organisations Create, look up, members and roles /api/v1/org/* /me/organizations signed in
Citizen services Applications, references, notifications, payments, appointments /api/v1/gov/* /me/services, /me/applications signed in
Officer queue Assign and decide applications /api/v1/gov/officer/* /manager/requests gov.review
Service registry Passports, versions, evidence, once-only /api/v1/registry/* /admin/registry/* registry.view · registry.manage
Public catalogue Anonymous service listing /api/v1/catalog/* landing page public
Relay Route requests between platforms /api/v1/relay/* /admin/relay/* relay.view · relay.manage
API Gateway Service catalogue + request telemetry /api/v1/gateway/* /admin/gateway/* gateway.manage
App registry Create OAuth clients, rotate secrets /api/v1/applications/* /admin/applications gateway.manage
Digital signing PAdES PDF signing (eID /v3) /api/v1/sign/*, /rp/sign/* /me/eid/sign signed in
Personal assets Signature image, Latin name, org stamp /api/v1/me/* /me/profile signed in
Gerege Space The platform's own SFTP storage /api/v1/gspace/* /me/integrations signed in
Integrations Google Drive/Meet, Dropbox OAuth links /api/v1/integrations/* /me/integrations signed in
AI assistant Chat, STT, TTS, translation /api/v1/ai/* /me/ai, /me/translate signed in
Public AI Anonymous chat + streaming replies /api/v1/public/ai/* landing assistant public (rate limited)
RBAC Dynamic role + permission catalogue /api/v1/rbac/* /admin/roles roles.manage
Admin Users, AI prompts, knowledge base /api/v1/admin/* /admin/* users.manage · settings.manage
Super admin Appoint admins, invites, access mode /api/v1/superadmin/* /admin/superadmin superadmin
Appearance Site-wide accent/font/density/theme /api/v1/site/*, /api/v1/themes/* /admin/themes settings.manage
Audit Hash-chained log + integrity check /api/v1/audit/* /admin/audit admin
Security events Collect client-side security signals /api/v1/security/events /admin/security signed in (listing: admin)

Permission catalogue

The 13 permissions defined in domain_rbac.go:

Permission Meaning
dashboard.view View the admin/manager dashboard
settings.manage Manage system settings, AI prompts, appearance
users.manage List users, change roles, activate/deactivate
roles.manage RBAC — manage roles and permissions
personal.view The user's own area
manager.view The manager area
gateway.manage Manage gateway services and app registrations
relay.view View the relay dashboard
relay.manage Manage relay platforms and routing
gov.review Review and decide citizen applications
gov.catalog Manage the public service catalogue
registry.view View the service registry and once-only board
registry.manage Manage service passports, evidence, versions

Four base roles: superadmin → admin → manager → user. admin auto-resolves to every permission in the catalogue, so it never needs individual grants.

Rate limits

Values fixed in code (cmd/api/server/server.go):

Limiter Rate Burst Scope
authRateLimiter 5/min 5 /auth/eid/start, /auth/google, /auth/refresh, /auth/logout, superadmin onboarding
pollRateLimiter 1/sec 30 eID long-poll (/auth/eid/poll, /auth/status/{sid})
aiRateLimiter 20/min 10 /ai/chat, /ai/stt, /ai/tts, /ai/translate
publicAIRateLimiter 6/min 3 /public/ai/chat, /public/ai/chat/stream
publicTTSRateLimiter 20/min 8 /public/ai/tts
govWriteRateLimiter 30/min 15 gov writes, eID profile writes, assets, gspace

TRUSTED_PROXIES

Limits are per client IP. In the nginx → BFF → api topology the api only ever sees the BFF's IP, so without TRUSTED_PROXIES all traffic collapses into one bucket. Left empty, the api logs a boot warning — see Configuration.

When each feature turns on

Most capabilities are fail-closed — without credentials they switch off rather than pretend to work.

Capability Turns on when Otherwise
eID login EID_RP_UUID + EID_RP_SECRET Button hidden
Google link GOOGLE_CLIENT_ID + SECRET Button hidden
Gerege SSO (RP) SSO_ISSUER + SSO_CLIENT_ID + SECRET SSO flow disabled
OIDC provider OAUTH_ISSUER + SSO_STATE_KEY Discovery returns 404
AI assistant GEMINI_API_KEY AI endpoints return 500
Semantic knowledge search pgvector + embedding model Falls back to ILIKE
Gerege Space GSPACE_HOST + credentials Card disabled
eID Service Proxy SSO proxy configuration Routes not mounted
/metrics, /swagger OBSERVABILITY_TOKEN 404 in production

Where to go next