School ERP — Complete Module-Wise Functionalities

PART A — Core Platform & Infrastructure

1. Authentication & Login

 Dual authentication schemes: MVC cookie-based login (Web UI) and JWT Bearer (REST
API).
 Login page with role-aware redirect to the correct portal.
 Public auth API endpoints for login, forgot password, and reset password. These are
exempt from tenant resolution so they work before a tenant is known.
 Reset Password is Implemented. (Tenent and SuperAdmin Level)
 Forgot password is implemented at the API level only (used by mobile clients)
 Login attempt tracking (success/failure recorded for security monitoring).
 Tenant/account claims injected into the authenticated identity on login.

2. Authorization — Roles & Permissions

 Role-based access control with roles: SuperAdmin, Admin, Teacher, Student, Parent,
Accountant, HR, Hostel Warden, Librarian, Transport Manager.
 Identity framework for users, roles, claims, logins, and tokens.
 Permission groups and role–permission mapping at module/action level.
 Fine-grained feature access enforcement (action-level permission checks).
 Resource-level ownership checks (e.g., a teacher can only modify their own data).
 Super Admin can edit/assign permissions and roles per account (tenant).
 Role-based authorization enforced across all area controllers.

3. Session & Cookie Management

 Auth cookie: 8-hour expiry with sliding expiration.

 Session: 30-minute idle timeout; HTTP Only cookie marked essential.
 Session initialized before the authentication pipeline so impersonation/session data is
available.
 Cookie policy with HTTP Only and environment-aware secure flags.
 Login, logout, and access-denied paths configured centrally.

4. Rate Limiting & Brute-Force Protection

 Global limiter: 200 requests per minute per IP (sliding window).

  Dedicated login policy: 5 requests per 2 minutes per IP on the login endpoint.
 Rejected requests return HTTP 429 with a JSON error message.
 Client IP resolved with reverse-proxy support via the `X-Forwarded-For` header.
 Middleware order: security headers → rate limiter → HTTPS redirect → session → auth →
impersonation → authorization → tenant guard.

5. Password Policy & Account Lockout

 Strong password policy: min 10 characters, at least 4 unique characters, requires digit,
lowercase, uppercase, and special character.
 Account lockout: 5 failed attempts → 5-minute lockout, enabled for new users.
 Email uniqueness enforced.
 Force-password-change flag on user accounts (must-change-password flow).
 Passwords hashed using secure identity default hashing.

6. API Token (JWT) Authentication & Validation

 JWT Bearer authentication for API clients.

 Issuer signing key required (minimum key length enforced).
 Issuer and audience validated; token lifetime validated with zero clock skew.
 Token issuance, validation, and expiry inspection support.
 Default authorization policy accepts both cookie (MVC) and Bearer (API) schemes.

7. Multi-Tenancy (Tenant Resolution, Guard & Context)

 Single codebase with tenant-scoped data isolation via account id.

 API requests require an `X-Tenant-Code` header; the active account is resolved by account
code or slug, and tenant claims are injected into the request (400 for missing header, 404
for invalid/inactive tenant).
 Public auth paths are exempt from tenant resolution (login, forgot password, reset
password; registration is whitelisted but not implemented). Tenant guard runs after
authentication to scope access to the correct account.
 Active tenant context propagated throughout the request.
 Tenant id added to structured logs.

8. Tenant Switching & Super Admin Impersonation

 Super Admin can switch between tenant accounts.

 Impersonation stores the switched account id in session; when a SuperAdmin is
authenticated, the impersonated account context is applied to the request.
  Seamless "switch account / return" workflow from the Super Admin portal.

9. Security Headers, HSTS & HTTPS Enforcement

 Security headers added to every response:

- `X-Frame-Options: DENY`
- `X-Content-Type-Options: nosniff`
- `X-XSS-Protection: 1; mode=block`
- `Referrer-Policy: strict-origin-when-cross-origin`
- Full Content-Security-Policy (restrictive default source, allowlisted CDNs for
scripts/styles/fonts, frames restricted to self, object/base/form restricted).
 HTTPS redirection enabled outside Development; HSTS applied.
 Global rate limiter runs before HTTPS redirect.

10. Global Error Handling & Exception Logging

 Global exception handler returning standard problem-details responses.

 Centralized exception types: business-rule, not-found, validation, unauthorized, forbidden,
and tenant errors.
 Consistent JSON error responses for APIs; user-friendly error page for MVC.
 Errors enriched with tenant id and user id where available.

11. Structured Logging

 Structured logging configured from environment-based settings.

 Log enrichment: request context, machine name, thread id.
 HTTP request logging includes user id, tenant id, status code, and elapsed time.
 Startup fatal errors logged and flushed safely.

12. Request Validation

 Automatic validation on all request payloads.

 Validators for every module: academic setup, attendance (student/staff), exams (terms,
definitions, schemes, components, mark entry), fees, hostel visitors, recruitment
(postings, candidates), staff (create/edit/qualifications), students (create/edit/contacts),
tenants (account creation).
 Shared rules reused across validators (e.g., name/phone/email).

13. Caching
  In-memory cache and distributed memory cache registered.
 Short-lived output caching on key read-heavy screens (student, staff, parent, account lists).
 Anonymous and per-user cache variation where applicable.

14. Reverse-Proxy IP Detection (X-Forwarded-For)

 Client IP resolution falls back to the `X-Forwarded-For` header for reverse-proxy/load-

balancer scenarios (used by rate limiting).


15. API Documentation (Swagger / OpenAPI, Dev)

 Swagger UI (Development only) with API grouped by area/controller.

 Request duration display and try-it-out enabled.
 Security definitions: Bearer JWT and `X-Tenant-Code` header.
 REST API endpoints for auth, announcements, events, notifications, parent, student, and
teacher.

16. API Keys Management

 API key management for external/integration access.

 Key issuance, validation, and deactivation support.

17. Audit Logs

 Records user actions and changes across the system.

 Super Admin audit viewer (searchable/paged).
 Traceability for sensitive operations across modules.

18. Login Attempts & Security Monitoring

 Each login attempt (success/failure) is recorded.

 Super Admin security screen lists login attempts (pagination) for monitoring.
 Works with lockout and rate limiting for brute-force defence.

19. IP Allowlisting

 Allowlisted IP management per account.

 Restrict access to management endpoints per account/IP.
20. Data Backup & Restore Logs

 Records scheduled/manual backups.

 Super Admin backup viewer.

21. Support Tickets / Helpdesk

 Ticket creation, categorization, priority/status.

 Threaded ticket messages and resolution.
 Role-based handling and support reports.

PART B — Super Admin / Platform Administration

22. Account (Tenant) Management

 Create/update accounts with name, slug, account code, status, and usage limits.
 Account provisioning for onboarding (default users, roles, settings).
 Onboard School workflow and onboarding queue to manage pending/processing school
onboardings.
 Tenant health monitoring.
 Account dashboard with usage metrics.
 Deactivation and soft-delete of accounts.
 Platform-level (non-tenant) data store.

23. User Management

 Create, edit, activate/deactivate platform and tenant users.

 Assign users to accounts and roles.
 Force password change support.
 Account/user linking (e.g., staff account ↔ user).

24. Role Management

 Role and role-claim management.

 Create custom roles per tenant.
 Role assignment to users.
25. Permission Groups & Role–Permission Mapping

 Centralized permission catalog.

 Grouped permission presentation for UI.
 Role–permission assignment screens; enforced on actions.

26. Subscription Plans, Trials & Plan Limits

 Plans with validity days, trial fields, and feature/usage limits.

 Default plan catalog seeded.
 Plan assignment and renewal tracking per account.

27. Billing & Invoices

 Invoice generation against subscriptions/usage.

 Account usage-based billing.
 Billing operations and history per account.

28. Payment Processing & Webhooks

 Payment management integration for student fee payments and subscription payments.
 Webhook handling and reconciliation logging.
 Payment status tracking and receipts.

29. SMTP / Email Settings

 Per-tenant SMTP configuration managed by Super Admin.

 Transactional emails via SMTP.
 Templates for receipts, notifications, password reset.

30. Platform-Wide Reports & Dashboard

 Super Admin dashboard: accounts, usage, revenue, subscription status.

 Analytics, Revenue, and Financial reporting screens.
 Tenant Reports per account.
 Tenant Health monitoring.

31. Audit Log Viewer

  Paged, filterable audit trail across all accounts.

32. Backup Log Viewer

 View backup history and status per account.

33. Security Monitoring Viewer

 Login attempts list, lockouts, and security events.

PART C — Academic Core

34. Academic Setup

 Academic Sessions: create/update, mark current session.

 Classes: Create/Update, class teacher per site/account, soft-delete support.
 Sections: sections within classes, site association.
 Subjects: subject master; class–subject assignment.
 Sites / Branches: create, edit, view, delete sites/branches (name, code, address, city,
state); site limits enforced per subscription plan; classes/sections/students linked to sites.
 Class teacher assignment per class.
 Validation enforces uniqueness and required fields.

35. Student Management

 Admission and registration with comprehensive validation.

 Enrolment into class/section for an academic session.
 Bulk promotion/Separate promotion of students to the next class/section.
 Multiple/emergency contacts per student.
 Photo/avatar and document handling.
 Search, filter, pagination, edit, archive (soft-delete), transfer support.
 Site association (multi-site schools).
 Efficient queries and pagination.

36. Staff Management

 Staff Create/Update soft delete with profile, department/designation, and role mapping.
 Qualifications and documents.
  Staff–subject assignment for teaching staff.
 Staff ↔ user account linking for portal access.
 Create/edit validation and lookup lists for departments/designations.

37. Attendance

 Student attendance: daily marking per class/section; per-student rows

Present/Absent/Late, remarks).
 Staff attendance: daily staff marking.
 Hostel attendance and Transport attendance tracking.
 Summary views (day, month, calendar) and percentage analytics.
 Attendance history per student/staff and date-range reports.
 Validation for attendance rows and marking.

38. Exams & Results

 Exam terms, exam definitions (name, term, session), and schemes (max marks, pass
marks, weightage).
 Exam components (internal/external splits) and subject mapping.
 Mark entry: per student/subject with automatic grade computation (marks →
grade/remarks) subject teacher assignment for Mark Entry vie teacher & admin.
 Student exam registration, Auto register defined class Active Student.
 Result generation: auto-generate result summaries (aggregates, percentages, pass/fail,
grades).
 Manage results: review/edit published results and corrections.
 Result analytics and merit list generation.
 Grade settings: configurable grade bands/ranges.
 Result card generation and publishing.
 Validation for terms, definitions, schemes, components, and mark entry.

39. Timetable Management

 Class timetable creation with subject/teacher assignment.

 Class Teacher Assignment for Student leave Request.
 Teacher (staff) timetable view.
 Periods configuration management.
 Day-of-week scheduling.
 Views for students, teachers, and parents.
 Conflict avoidance on assignment.
40. Homework Management

 Teacher creates homework with title, description, due date, Class section assigment.
 Students submit work; submissions tracked, with Attachment upload feature.
 Parent and teacher visibility of assignments/submissions.

PART D — Administration Modules

41. Fee Management

 Fee heads, fee groups, and fee structures per class/session with details.
 Class fee assignment and Student invoice generation.
 Fee collection with receipt generation (PDF).
 Fee ledger per student, dues, and defaulter tracking.
 Fine handling and fine-waived with discount support (incl. on library book issues).
 Session Syncing with Validation for collection, fee heads, and fee structures.

42. Finance & Expense Management

 Expense categories and expense recording.

 Financial summaries and expense reports.
 Receipts daily/monthly summaries (Accountant portal).
 Integration with fee income for financial snapshots.

43. Payroll & Salaries

 Salary structures(Duplicate structure for same staff protection) and salary grades.
 Staff salary configuration.
 Payroll processing and salary payments with duplicate-payment protection.
 Payslip generation (PDF).
 Payroll reports and payment history.

44. Library Management

 Book catalog with categories and unique-index protection.

 Issue/Return with due dates and session tracking.
 Members: student and staff registration.
  Late-return fines with fine-waived support.
 Library dashboard, reports, and session-filtered views.

45. Hostel Management

 Hostels, rooms, and beds create update & soft delete.

 Student hostel allotment.
 Hostel attendance tracking.
 Visitor management with registration/log tracking.
 Hostel fees and maintenance records.
 Warden portal with hostels, rooms, students, fees, notices, leave, reports.

46. Transport Management

 Vehicles, routes, and route stops create update delete.

 Drivers/staff management.
 Student transport assignment.
 Transport attendance and fee tracking.
 Vehicle maintenance records and transport reports.
 Transport Manager portal (vehicles, routes, students, fees, maintenance, reports).

47. Inventory / Asset Management

 Asset categories and units create/update/delete.

 Asset register with quantity tracking.
 Asset movements/transfers (validation on unit movement, e.g. issued unit need to be
returned first before assigning to another).
 Inventory levels and usage reports.

48. Recruitment & HR Management

 Job postings creation/publishing; candidate application handling.

 Interview scheduling and tracking.
 Validation for postings and candidates.
 HR portal: employees, documents, notices, performance, payroll, reports.

49. Gallery Management

 Album creation and image upload with categorization.

 Visibility for parent/student/teacher portals.
  Used Supabase cloud platform for Gallery and Homework with Validation on File type and
size limit

50. Communication

 Messages between teachers, parents, and students with seen time feature.
 Notifications with preferences and an inbox.
 Announcements and Events published to portals.
 Email notifications via SMTP.
 API endpoints for announcements, events, and notifications.

51. Leave Management

 Staff leave: Create applications, view balances & history, session-aware accrual.
 Leave types, application/approval workflow, pending and on-leave-today counts.
 Student leave with teacher/admin approval and Staff leave with hr/admin approval
rejection.
 Leave reports per staff/student; session-wise tracking.

53. Reports & Analytics

 Fee collection and defaulter reports.

 Salary and financial summary reports.
 Attendance and exam/result analytics.
 Receipts daily/monthly summaries.
 Transport, hostel, and library reports.
 Filterable by session, class, date range; paginated and export-friendly.

54. Settings & Configuration

 Account/site profile settings.

 SMTP configuration (Super Admin + tenant).
 Security settings: IP allowlist, login attempts, force-password-change.
 Notification preferences.

PART E — Role-Based
55. Super Admin Portal

 Dashboard: platform-level overview — total schools, active/inactive tenants, usage

metrics, open support tickets, revenue and subscription status.
 Accounts / Schools:
- Create / Onboard a new school (name, slug, account code, subscription plan, admin
contact) with validation — unique slug and account code, valid admin email, plan
availability.
- View / Search all schools with filters (status, plan) and pagination.
- Update school profile, status, assigned plan and usage limits.
- Deactivate / Reactivate and soft-delete a school.
 Onboarding Queue: view pending/processing school onboardings; retry or resolve failed
onboarding attempts.
 Users: Create user (validated email uniqueness and password policy), assign to account
and roles; Update; Activate / Deactivate; force password change.
 Roles: Create / Update / Delete custom roles with name validation (required, unique, max
length).
 Permissions: assign / remove permission groups per role; validation — role must exist,
permission ids must be valid.
 Subscription Plans: Create / Update / Delete plans (name, price, validity days, trial
settings, feature/usage limits) with validation of numeric ranges and unique names.
 Billing & Payments: view invoices, payments, and webhook logs; reconcile payments
against invoices.
 SMTP Settings: configure per tenant (host, port, credentials, from address) with
validation; test email send.
 Security Monitoring: view login attempts (paged, filterable); add / remove IP allowlist
entries with IP format validation; view audit logs and backup logs.
 Support Tickets: view / filter tickets by account, status, priority; update status; assign;
reply to ticket threads.
 Tenant Switching: switch into any school account to operate as that tenant; return to the
platform view.
 Reports: platform analytics, revenue, financial, and per-tenant reports.

56. Admin Portal

- Academic Setup:

 Academic Sessions: Create / Update / Delete and mark current session; validation —
unique name, valid start/end dates.
 Sites / Branches: Create / Update / Delete (name, code, address, city, state); validation —
required fields, unique code, subscription plan site limit enforced.
 Classes: Create / Update / Delete (name, site, session); validation — required name,
uniqueness within site/session.
  Sections: Create / Update / Delete (name, class, site); validation — required name,
uniqueness per class.
 Subjects: Create / Update / Delete (name, code); validation — required fields, unique
code.
 Assign Subjects: assign / remove subjects to/from classes with validation of valid
subject/class ids.
 Class Teacher: assign / change the class teacher for a class.

- Students:

 Create / admit a student (name, DOB, gender, contacts, site, class/section) with
comprehensive validation — required fields, valid dates, valid site/class/section.
 Update student profile; archive / soft-delete; transfer between classes/sections.
 Bulk Promote: promote students to the next class/section in one action with validation of
the target session and class.
 Contacts: add / update / delete primary and emergency contacts.
 Documents: upload / remove photo and documents (cloud storage).

- Staff:

 Create staff (name, department, email/phone, role mapping) with validation; Update;
delete / deactivate.
 Qualifications: add / update / delete qualification records with validation (institution,
year, certificate).
 Assign Subjects: assign / remove teaching subjects for staff.
 Departments: Create / Update / Delete departments with name validation and
uniqueness.
 Roles (school-level): Create / Update / Delete roles and assign them to staff.
 Parents: Create / Update parent accounts, link / unlink children, deactivate.

- Timetable:

 Periods: Create / Update / Delete period definitions (name, start/end time) with
validation.
 Class Timetable: Create / Update / Delete entries; assign subject and teacher; conflict
validation on assignment.
 Teacher Timetable: view staff-wise timetable.

- Attendance:

 Mark student attendance per class/section/date (rows with Present/Absent/Late and

remarks) with validation — date required, each row has a valid status.
 Edit wrongly marked entries.
 View student reports and monthly registers; mark staff attendance.

- Exams & Results:

  Exam Terms: Create / Update / Delete with validation.
 Exam Definitions: Create / Update / Delete (name, term, session) with validation.
 Exam Schemes: Create / Update / Delete (max marks, pass marks, weightage) with
numeric validation.
 Components / Subject Mapping: Create / Update / Delete components; map subjects to
exams.
 Mark Entry: enter per-student marks with validation (within max marks, pass-mark rules);
grades auto-computed.
 Register Students: register / auto-register enrolled students for an exam.
 Generate Results: generate summaries (percentages, pass/fail, grades).
 Manage / Correct Results: review, edit and correct published results.
 Analytics / Merit List / Grade Settings: result analytics, merit list generation, and
configurable grade bands.

- Fees:

 Fee Heads: Create / Update / Delete (name, amount, frequency) with validation.
 Fee Groups / Structures: Create / Update / Delete with validation; structure details per
class/session.
 Student Fee Assignment: assign / update / remove fees for students; invoice generation.
 Collect Fee: record payments with validation (student, amount, mode); PDF receipt
generation.
 Ledger / Defaulters: view student ledger and defaulter list.
 Finance: Create / Update / Delete expense categories and expenses (category, amount,
date) with validation; view financial summaries.
 Payroll: configure salary structures and grades with validation; process payroll; record
salary payments (duplicate-payment protected); generate payslips (PDF).

- Library:

 Books: Create / Update / Delete books and categories with validation (unique ISBN/title
where applicable).
 Issue / Return: issue book to member (validation — membership active, book available,
due date), return, renew.
 Members: add / update / delete members (student/staff).
 Fines: calculate / collect / waive late-return fines.

- Hostel:

 Hostels / Rooms / Beds: Create / Update / Delete with validation.

 Allotment: assign / change / remove student hostel allotment.
 Attendance / Visitors / Fees / Maintenance: mark hostel attendance; register / log
visitors; record fees and maintenance items with validation.

- Transport:
  Vehicles: Create / Update / Delete (registration no, capacity) with validation.
 Routes / Stops: Create / Update / Delete with validation.
 Allotment: assign / change / remove students to routes; record attendance, fees,
maintenance.

- Inventory / Assets: Create / Update / Delete asset categories, units, assets (with quantity);
record asset movements/transfers with validation.

- Gallery: Create / Update / Delete albums; upload / delete images (cloud storage); captions.

- Communication: publish / update / delete announcements; create / send notifications; view

events.

- Leave: approve / reject staff leave; manage student leave applications.

- Reports: attendance, fees, salary, results, finance, and operational reports (filterable by session,
class, date range).

- Settings: site/profile configuration, notification preferences, security settings (IP allowlist, login
attempts, force-password-change).

57. Teacher Portal

- Dashboard: overview of assigned classes, pending attendance/exam tasks, and notifications.

- Students: view student lists of assigned classes/sections (read-only).

- Attendance: mark / edit attendance per class/section/date with validation; view

day/week/month registers and reports.

- Exams: view exam definitions; mark entry per subject with validation and auto-grade
computation; report cards.

- Homework: create / update homework (title, description, due date, attachments) with
validation; view student submissions and marks.

- Timetable: view own and class timetables.

- Communication: send / receive messages; view announcements and events.

- Leave: apply leave (validated dates/type); view balances and history.

- Student Leave: approve / reject student leave applications.

- Profile: view / edit own profile; change password.

58. Student Portal

- Dashboard: personal summary — attendance percentage, upcoming exams, pending
fees/homework.

- Profile: view own profile and academic details.

- Attendance: view own attendance summary, history, and monthly calendar.

- Timetable: view class timetable.

- Exams: view exam schedule; view marks, results, and result card.

- Fees: view fee dashboard, ledger, and receipts (downloadable).

- Homework: view assignments; submit work with file upload validation; view status.

- Library: view available books and own issue history.

- Leave: apply leave (validated dates); view history and balances.

- Notifications: view inbox; mark read.

59. Parent Portal

- Dashboard: overview of all linked children.

- Children: view each child's profile and class/section.

- Attendance: per-child attendance summary and monthly calendar.

- Exams / Results: per-child exam details and result cards.

- Fees: per-child fee dashboard, ledger, online payment, and receipts.

- Homework: view child's assignments and submission status.

- Timetable / Transport: view child's timetable and transport details.

- Announcements / Events / Gallery: view school communications and gallery.

- Messages: send / receive messages with teachers.

60. Accountant Portal

- Dashboard: financial overview — collections, receivables, expenses.

- Fees: collect fee payments (student, amount, mode) with validation; view collections, student
ledger, and defaulters.

- Receipts: view / search receipts; daily and monthly summaries; reprint receipts.

- Payroll: view salary structures and payments; process salary payments; view / download
payslips.
- Finance: record / update / delete expenses and categories with validation.

- Leave: apply leave; view history and balances.

- Reports: fee collection, defaulters, salary, and financial summary reports.

## 61. HR Portal

- Dashboard: HR overview — employee count, leave, pending approvals.

- Employees: Create / Update / Delete employee records with validation; view directory.

- Attendance: mark / view staff attendance.

- Leave: manage / approve / reject staff leave; view balances.

- Payroll: view / manage payroll records.

- Documents: upload / delete employee documents.

- Notices: publish / update / delete internal notices.

- Performance: record / update performance entries with validation.

- Recruitment: Create / Update / Delete job postings with validation; manage candidates
(applications, status); schedule interviews.

- Reports: HR reports (employees, leave, recruitment, attendance).

62. Hostel Warden Portal

- Dashboard: hostel occupancy and attendance overview.

- Hostels: Create / Update / Delete hostels with validation.

- Rooms & Beds: Create / Update / Delete rooms and beds with validation (capacity, status).

- Students: assign / change / remove hostel allotment for students.

- Attendance: mark / view hostel attendance with validation.

- Hostel Fees: record / collect / view hostel fee payments.

- Maintenance: Create / Update / Delete maintenance records with validation.

- Visitors: register / log visitor entries with validation; in/out tracking.

- Notices: publish / update / delete hostel notices.

- Leave: apply leave; view history and balances.

- Reports: hostel reports (occupancy, attendance, fees, visitors).

63. Librarian Portal

- Dashboard: library overview — books issued, overdue, fines.

- Books: Create / Update / Delete books and categories with validation (unique ISBN/title,
author, category).

- Issue / Return: issue books to members (validation — active membership, availability, due
date); return and renew.

- Members: add / update / delete members (student/staff).

- Fines: calculate / collect / waive fines.

- Leave: apply leave; view history and balances.

- Reports: library reports (issues, returns, overdue, fines).

64. Transport Manager Portal

- Dashboard: fleet and route overview.

- Vehicles: Create / Update / Delete vehicles with validation (registration no, capacity, route).

- Routes: Create / Update / Delete routes and route stops with validation.

- Students: assign / change / remove student transport allotment.

- Drivers & Staff: Create / Update / Delete driver/staff records with validation.

- Attendance: mark / view transport attendance with validation.

- Transport Fees: record / collect / view transport fee payments.

- Maintenance: Create / Update / Delete vehicle maintenance records with validation.

- Leave: apply leave; view history and balances.

- Reports: transport reports (fleet, routes, attendance, fees, maintenance).

# PART F — Cross-Cutting Technical Notes

- Stack: .NET 8 ([Link] Core MVC + REST API), SQL Server, Identity framework, JWT Bearer,
FluentValidation, Serilog, Swagger (dev).

- Storage: Cloud object storage (Supabase) for images/documents; 10 MB upload limit.

- Multitenancy: account/slug scoping, `X-Tenant-Code` header for APIs, tenant switch +
impersonation.

- Security summary: 8h sliding cookie, 30-min idle session, JWT with zero clock-skew, 200
req/min global + 5/2-min login rate limits (HTTP 429), 5-attempt/5-min lockout, 10-char
password policy, security headers + CSP + HSTS, IP allowlist, audit + login-attempt logs.

- Observability: Structured request logging with tenant/user enrichment; global exception

handler returning standard problem details.