Settings

Purpose

Tenant-scoped configuration: users, roles, SSO (Entra), API keys, audit visibility, and module-specific settings.

Key components

Layer	Path
Backend	Backend/internal/domain/settings/
Auth / SSO	Backend/internal/domain/auth/
RBAC	Backend/internal/domain/rbac/ + register_*.go
Frontend	Settings area in Cloud SPA

Removed / dead settings

Edge registration keys (Backend): claim-code flow replaced them. Assign is POST /internal/devices/assign (not tenant self-service keys).

Cloud SPA: routes under Settings → Edge registration keys may still exist in Frontend but call removed Backend APIs (404). Treat as dead UI — remove in a cleanup PR (TODO.md).

Flow: per-tenant SSO

sequenceDiagram
    participant Admin as Tenant admin
    participant SPA as Cloud SPA
    participant API as Cloud Backend
    participant Entra as Microsoft Entra ID

    Admin->>SPA: Configure SSO app registration
    SPA->>API: Save OIDC settings
    Note over SPA,Entra: User login redirects to Entra
    Entra->>API: OIDC callback
    API->>SPA: Issue JWT session

Debug scenarios

Issue	Check
SSO redirect loop	Redirect URI mismatch; MS_CLIENT_ID / tenant config
Permission missing	RBAC catalog vs route RequirePermission

Related

• SSO & Entra ID
• RBAC