feat(httpapi): add local audit log with portal dual-write

Локальный audit_log (миграции pg/sqlite), GET /v1/audit, запись на CRUD и async push в auth-portal (source_app=bgp).

Co-authored-by: Cursor <cursoragent@cursor.com>

.agents/skills/reui/SKILL.md

@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.agents/skills/reui/rules/cli.md

@@ -29,6 +29,8 @@ REUI_LICENSE_KEY=your-license-key
 }
 ```
 
+The shadcn CLI expands `${REUI_LICENSE_KEY}` from `.env.local` inside `components.json`, but an MCP client config never expands variables, so a ReUI MCP server config must carry the raw token instead (for example `reui_pat_your_token_here`).
+
 The MCP `get_project_context` tool returns the right config. Full guide: https://reui.io/docs/registry
 
 ## Installing

.agents/skills/reui/rules/components.md

@@ -1,6 +1,6 @@
 # ReUI components
 
-The 17 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `filters`, `frame`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 19 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
 
 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.
 
@@ -32,6 +32,34 @@ Common mistakes:
 - **Incorrect:** a raw `<table>` / hand-rolled pagination. **Correct:** use `data-grid`; read its API for sticky header, pagination, virtualization, row selection.
 - **Incorrect:** styling rows/cells with arbitrary classes. **Correct:** drive layout via `tableLayout` and the documented `ColumnMeta` (e.g. `cellClassName`, `headerTitle`).
 
+## event-calendar
+
+**Required:** events via `events`/`onEventsChange` (controlled) or `defaultEvents` (uncontrolled), plus a height on the root.
+**Shape:**
+
+```tsx
+<EventCalendar defaultEvents={events} defaultView="month" className="h-[560px]">
+  <EventCalendarNav />
+  <EventCalendarContent />
+</EventCalendar>
+```
+
+**Gotcha:** headless-first: `EventCalendarContent` renders the active view (month/week/day/days/agenda; a resource view activates when `resources` is passed) - there is no per-view JSX to compose. Events are `{ id, title, start, end (exclusive), allDay?, color?, recurrence?, resourceId? }`. Mutations flow through `onEventUpdate`/`canDropEvent` (return `false` to reject); the root needs an explicit height because it is a min-h-0 flex column.
+
+## gantt
+
+**Required:** `resources` (the left tree) plus bars via `events`/`defaultEvents` attached by `resourceId`.
+**Shape:**
+
+```tsx
+<Gantt defaultEvents={bars} resources={tasks} defaultScale="month" className="h-[480px]">
+  <GanttNav />
+  <GanttView />
+</Gantt>
+```
+
+**Gotcha:** bars move along the time axis only (never across rows) and are all-day spans with exclusive `end`; `progress` is 0-100. Scales are `day | week | month | quarter | year`. Zoom control, infinite scroll, summary rollups, and row checkboxes are ON by default - turn off what you do not need. Same `onEventUpdate`/`canDropEvent` commit pipeline as `event-calendar`; the root needs an explicit height.
+
 ## kanban
 
 **Required:** `value` (`Record<string, T[]>`), `onValueChange`, `getItemValue`

.claude/skills/reui/SKILL.md

@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.claude/skills/reui/rules/cli.md

@@ -29,6 +29,8 @@ REUI_LICENSE_KEY=your-license-key
 }
 ```
 
+The shadcn CLI expands `${REUI_LICENSE_KEY}` from `.env.local` inside `components.json`, but an MCP client config never expands variables, so a ReUI MCP server config must carry the raw token instead (for example `reui_pat_your_token_here`).
+
 The MCP `get_project_context` tool returns the right config. Full guide: https://reui.io/docs/registry
 
 ## Installing

.claude/skills/reui/rules/components.md

@@ -1,6 +1,6 @@
 # ReUI components
 
-The 17 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `filters`, `frame`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 19 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
 
 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.
 
@@ -32,6 +32,34 @@ Common mistakes:
 - **Incorrect:** a raw `<table>` / hand-rolled pagination. **Correct:** use `data-grid`; read its API for sticky header, pagination, virtualization, row selection.
 - **Incorrect:** styling rows/cells with arbitrary classes. **Correct:** drive layout via `tableLayout` and the documented `ColumnMeta` (e.g. `cellClassName`, `headerTitle`).
 
+## event-calendar
+
+**Required:** events via `events`/`onEventsChange` (controlled) or `defaultEvents` (uncontrolled), plus a height on the root.
+**Shape:**
+
+```tsx
+<EventCalendar defaultEvents={events} defaultView="month" className="h-[560px]">
+  <EventCalendarNav />
+  <EventCalendarContent />
+</EventCalendar>
+```
+
+**Gotcha:** headless-first: `EventCalendarContent` renders the active view (month/week/day/days/agenda; a resource view activates when `resources` is passed) - there is no per-view JSX to compose. Events are `{ id, title, start, end (exclusive), allDay?, color?, recurrence?, resourceId? }`. Mutations flow through `onEventUpdate`/`canDropEvent` (return `false` to reject); the root needs an explicit height because it is a min-h-0 flex column.
+
+## gantt
+
+**Required:** `resources` (the left tree) plus bars via `events`/`defaultEvents` attached by `resourceId`.
+**Shape:**
+
+```tsx
+<Gantt defaultEvents={bars} resources={tasks} defaultScale="month" className="h-[480px]">
+  <GanttNav />
+  <GanttView />
+</Gantt>
+```
+
+**Gotcha:** bars move along the time axis only (never across rows) and are all-day spans with exclusive `end`; `progress` is 0-100. Scales are `day | week | month | quarter | year`. Zoom control, infinite scroll, summary rollups, and row checkboxes are ON by default - turn off what you do not need. Same `onEventUpdate`/`canDropEvent` commit pipeline as `event-calendar`; the root needs an explicit height.
+
 ## kanban
 
 **Required:** `value` (`Record<string, T[]>`), `onValueChange`, `getItemValue`

.codegraph/daemon.pid

@@ -1,6 +0,0 @@
-{
-  "pid": 51184,
-  "version": "0.9.9",
-  "socketPath": "\\\\.\\pipe\\codegraph-97b92efdcc5351da",
-  "startedAt": 1784215907952
-}

.cursor/mcp.json.example

@@ -11,9 +11,9 @@
       ]
     },
     "reui": {
-      "url": "https://mcp.reui.io/api/mcp?style=base-nova",
+      "url": "https://mcp.reui.io",
       "headers": {
-        "X-Reui-Style": "base-nova"
+        "Authorization": "Bearer <REUI_LICENSE_KEY>"
       }
     }
   }

.cursor/rules/kpi-hybrid.mdc

@@ -0,0 +1,29 @@
+---
+description: Только hybrid KPI — KpiStatGrid / row tile DNA (stats-12). Запрет SectionCards и hand-roll.
+alwaysApply: true
+---
+
+# KPI hybrid — только kit (stats-12 DNA)
+
+Preview: [stats-12](https://reui.io/preview/base/stats-12). SoT DNA = EvoBGP. Markup в проекте: `apps/web/src/components/reui-kit/kpi-stat-grid.tsx`.
+
+Связанные: [`reui-mcp.mdc`](reui-mcp.mdc), [`web-shadcn.mdc`](web-shadcn.mdc).
+
+## MUST
+
+| Зона | Компонент / DNA |
+|------|-----------------|
+| KPI-полосы / dashboard metrics | только `reui-kit/KpiStatGrid` (через `OpsDashboard` / `DetailPanel.Metrics` при наличии) |
+| Markup | horizontal compact hybrid: icon left `Item` `size-10.5` `bg-muted` + `border-background` + shadow + `ItemMedia` + label/Badge + value ± `variant` |
+| Row icon tiles (data-grid) | та же DNA — semantic `text-*` на `bg-muted` |
+| Quick Actions | только `reui-kit/QuickActionGrid` (sibling hybrid DNA) |
+
+Импорты UI: `@evobgp/ui/components/*`.
+
+## NEVER
+
+- SectionCards / vertical-only KPI / hand-roll Frame/Card KPI
+- Другой size / radius / solid brand fill вместо `bg-muted`
+- `card-35` как замена stats-12 hybrid KPI
+- Копипаст ReUI block в route — adapt через `reui-kit/`
+- Голый lucide `size-4` в name-cell без hybrid tile

.cursor/rules/reui-mcp.mdc

@@ -0,0 +1,111 @@
+---
+description: ReUI PRO (@reui) — MCP user-reui, Frame surface, kit, license, матрица выбора
+alwaysApply: true
+---
+
+# ReUI MCP — обязательно (PRO + free)
+
+Проект: **Base UI** (`style: base-nova`), surface lock **`frame`**.
+
+Связанные: [`shadcn-mcp.mdc`](shadcn-mcp.mdc), [`web-shadcn.mdc`](web-shadcn.mdc), [`web-shadcn.mdc`](web-shadcn.mdc), [`docs/ui-design-contract.md`](docs/ui-design-contract.md).
+
+| Документ | URL |
+|----------|-----|
+| **llms.txt** | https://reui.io/llms.txt |
+| **Get Started** | https://reui.io/docs/get-started |
+| **Styling** | https://reui.io/docs/styling |
+| **MCP** | https://reui.io/docs/mcp |
+| **Blocks** | https://reui.io/blocks |
+| **Settings blocks** | https://reui.io/blocks/application/settings |
+| **License** | https://reui.io/docs/license-setup |
+| **Base UI components** | https://reui.io/docs/components/base/<name> |
+
+## Primary MCP
+
+1. **`user-reui`** — `search` / `compose_page` / `get_block` / `get_component` / `get_install_command` / `validate_usage` / `get_audit_checklist`
+2. **`plugin-shadcn-shadcn`** — primitives `@shadcn`; для `@reui` — вторично
+
+**Обязательно** цитировать `previewUrl` + `docsUrl` для каждой UI-зоны.
+
+## Когда ReUI vs shadcn
+
+| Задача | Registry | Импорт |
+|--------|----------|--------|
+| Button, Sheet, Field, Sidebar, Tabs | `@shadcn` | `@evobgp/ui/components/*` |
+| PRO pages/sections (settings, stats, auth, dashboard) | `@reui` blocks | adapt → `apps/web/src/components/` / `reui-kit/` |
+| Data Grid | `@reui` | `@/components/reui/data-grid/*` → `ResourcePage` |
+| Filters | `@reui` | `@/components/reui/filters` |
+| Frame surface | `@reui` | `@/components/reui/frame` |
+| KPI | block [stats-12](https://reui.io/preview/base/stats-12) | `reui-kit/KpiStatGrid` — см. [`kpi-hybrid.mdc`](kpi-hybrid.mdc) |
+| Quick Actions | Frame tiles sibling KPI | `reui-kit/QuickActionGrid` |
+| Semantic badge / alert | `@reui` | `@/components/reui/badge`, `@/components/reui/alert` |
+| Number / date / autocomplete / color / kanban | `@reui` | `@/components/reui/*` |
+
+**Сложные списки** — `ResourcePage` (Frame + data-grid + filters), не raw `<table>`, не DataGridCard.  
+**Quick Actions** — только `QuickActionGrid` (не Card / Button grid).
+
+## MCP workflow
+
+0. Codegraph / поиск существующих `reui-kit/*`, `@/components/reui/*`
+1. `user-reui` `search` (`surface: "frame"`, `category` при известном)
+2. Страница целиком → `compose_page`; секция → `get_block`
+3. `get_component` для API primitives из `componentsUsed`
+4. CLI из `apps/web`: `pnpm dlx shadcn@latest add @reui/<name> --yes`
+5. Post-add: shadcn imports → `@evobgp/ui/components/*`
+6. Adapt by reuse → kit / route
+7. `validate_usage` + `get_audit_checklist`
+
+## Размещение
+
+| Слой | Путь | Импорт |
+|------|------|--------|
+| shadcn | `packages/ui/src/components/` | `@evobgp/ui/components/*` |
+| ReUI CLI | `apps/web/src/components/reui/` | `@/components/reui/*` |
+| PRO blocks (reference) | `apps/web/src/components/blocks/` | adapt into kit, не копипаст в routes |
+| Kit | `apps/web/src/components/reui-kit/` | `@/components/reui-kit/*` |
+
+## Установленные ReUI (apps/web)
+
+**Components:** `frame`, `data-grid/*`, `filters`, `kanban`, `badge`, `alert`, `autocomplete`, `number-field`, `date-selector`, `color-picker`, `timeline`, `rating`, `phone-input`, `icon-stack`
+
+**Kit:** `ResourcePage`, `KpiStatGrid`, `QuickActionGrid`, `OpsDashboard`, `KanbanBoard`, `DetailPanel`, `SettingsShell`
+
+**Blocks (reference):** `stats-12`, `card-35`, `auth-13`, `app-shell-12`, `settings-16`, `settings-8`, `empty-state-12`, `form-7`, `data-grid-filtering-2`, `dashboard-1`, …
+
+## License
+
+```env
+# .env.local (gitignored)
+REUI_LICENSE_KEY=
+```
+
+`apps/web/components.json` → `@reui` с `Authorization: Bearer ${REUI_LICENSE_KEY}`.
+
+## Эталоны preview
+
+| Зона | Preview |
+|------|---------|
+| KPI / Quick Actions | https://reui.io/preview/base/stats-12 · https://reui.io/preview/base/card-12 |
+| List | https://reui.io/preview/base/data-grid-filtering-2 |
+| Settings | https://reui.io/preview/base/settings-16 |
+| Auth | https://reui.io/preview/base/auth-13 |
+| Shell | https://reui.io/preview/base/app-shell-12 |
+| Empty | https://reui.io/preview/base/empty-state-12 |
+
+## Запрещено
+
+- Копипаст с reui.io без CLI
+- ReUI в `packages/ui` / импорт как `@evobgp/ui`
+- Radix-варианты docs — только Base UI
+- Raw `bg-emerald-*` вместо ReUI `variant`
+- Hand-roll data-grid/filters/KPI/Quick Actions/settings rows при наличии `@reui` / kit
+- Смешивать Card и Frame на ops-экране
+- Ставить shadcn/ui blocks выше ReUI PRO
+
+## Чеклист
+
+- [ ] `user-reui` search/get_block + previewUrl
+- [ ] `surface: frame`
+- [ ] CLI add из `apps/web` при новом item
+- [ ] Kit / `@/components/reui` / `@evobgp/ui` — правильный слой
+- [ ] `pnpm --filter @evobgp/web run build`

.cursor/rules/reui.mdc

@@ -11,7 +11,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.cursor/rules/web-shadcn.mdc

@@ -9,12 +9,12 @@ alwaysApply: false
 # Web UI — React + shadcn/ui + ReUI
 
 **Источники правды:**
+- **ReUI PRO first:** MCP `user-reui` ([`reui-mcp.mdc`](reui-mcp.mdc)) — pages / KPI / lists / settings / shell
+- shadcn primitives: MCP `plugin-shadcn-shadcn` (secondary)
+- ReUI Base UI: https://reui.io/docs/components/base/<name> · [llms.txt](https://reui.io/llms.txt)
 - shadcn/ui React: https://ui.shadcn.com/docs/components
-- ReUI Base UI: https://reui.io/docs/components/base/<name>
-- ReUI llms.txt: https://reui.io/llms.txt
-- MCP `plugin-shadcn-shadcn` (registries: `@shadcn`, `@reui`) — перед любой UI-задачей
 
-Общие правила Go/API: `.cursor/rules/engineering.mdc`. Стек ID: `.cursor/rules/context7-stack.mdc`.
+Иерархия: **ReUI PRO > shadcn**. Общие: `.cursor/rules/engineering.mdc`, `context7-stack.mdc`.
 
 ## Слои UI
 
@@ -23,18 +23,18 @@ alwaysApply: false
 | shadcn-примитивы | `packages/ui/src/components/` | output `shadcn add` (не трогать под кейс) |
 | ReUI enterprise | `apps/web/src/components/reui/` | output `shadcn add @reui/*` |
 | Shared обёртки | `apps/web/src/components/` | PageHeader, QueryState, ConfirmDialog, StatusBadge, LoadingButton |
-| ReUI kit | `apps/web/src/components/reui-kit/` | ResourcePage, KpiStatGrid, OpsDashboard, SettingsShell |
+| ReUI kit | `apps/web/src/components/reui-kit/` | ResourcePage, KpiStatGrid, QuickActionGrid, OpsDashboard, SettingsShell |
 | Роуты | `apps/web/src/routes/` | TanStack Router (file-based) |
 
-**Design contract:** [`docs/ui-design-contract.md`](../../docs/ui-design-contract.md). Surface: **frame**. KPI: [stats-12](https://reui.io/preview/base/stats-12). Lists: [data-grid-filtering-2](https://reui.io/preview/base/data-grid-filtering-2).
+**Design contract:** [`docs/ui-design-contract.md`](../../docs/ui-design-contract.md). Surface: **frame**. KPI hybrid SoT: [stats-12](https://reui.io/preview/base/stats-12). Lists: [data-grid-filtering-2](https://reui.io/preview/base/data-grid-filtering-2). Quick Actions: `QuickActionGrid`.
 
 Тема: `packages/ui/src/styles/globals.css`. CLI из `apps/web`: `pnpm dlx shadcn@latest add <component>`.
 
 ## Правила
 
-**WEB-01** | MUST | Перед новым UI — MCP `plugin-shadcn-shadcn`: `search_items_in_registries` → `get_item_examples_from_registries` → `get_add_command_for_items`. Только после — JSX.
-*Rationale:* единый источник правды и API.
-*Проверка:* review; нет самописных примитивов, если есть registry item.
+**WEB-01** | MUST | Перед новым UI — сначала MCP **`user-reui`** (`search` → `get_block` / `compose_page`, `surface: "frame"`) + cite `previewUrl`/`docsUrl`. Primitives — MCP `plugin-shadcn-shadcn`. Только после — JSX.
+*Rationale:* ReUI PRO выше shadcn; единый Frame surface.
+*Проверка:* review; [`reui-mcp.mdc`](reui-mcp.mdc).
 
 **WEB-02** | MUST | Отсутствующий shadcn-примитив — `pnpm dlx shadcn@latest add <component>` (из `apps/web`). ReUI — `pnpm dlx shadcn@latest add @reui/<name>`.
 *Проверка:* файлы в `packages/ui/src/components/` (для shadcn) или `apps/web/src/components/reui/` (для ReUI).
@@ -73,7 +73,7 @@ alwaysApply: false
 
 **WEB-14** | SHOULD | Нетривиальный UI — прочитать страницу компонента shadcn/ReUI (props, a11y).
 
-**WEB-15** | MUST | Сомнения — MCP `plugin-shadcn-shadcn` + shadcn CLI docs + `pnpm --filter @evobgp/web run typecheck`.
+**WEB-15** | MUST | Сомнения — MCP `user-reui` + `plugin-shadcn-shadcn` + docs + `pnpm --filter @evobgp/web run typecheck`.
 
 **WEB-16** | MUST | Подтверждение удаления — `ConfirmDialog` из `@/components/confirm-dialog`, не `window.confirm`.
 

.cursor/skills/reui/SKILL.md

@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.cursor/skills/reui/rules/cli.md

@@ -29,6 +29,8 @@ REUI_LICENSE_KEY=your-license-key
 }
 ```
 
+The shadcn CLI expands `${REUI_LICENSE_KEY}` from `.env.local` inside `components.json`, but an MCP client config never expands variables, so a ReUI MCP server config must carry the raw token instead (for example `reui_pat_your_token_here`).
+
 The MCP `get_project_context` tool returns the right config. Full guide: https://reui.io/docs/registry
 
 ## Installing

.cursor/skills/reui/rules/components.md

@@ -1,6 +1,6 @@
 # ReUI components
 
-The 17 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `filters`, `frame`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 19 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
 
 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.
 
@@ -32,6 +32,34 @@ Common mistakes:
 - **Incorrect:** a raw `<table>` / hand-rolled pagination. **Correct:** use `data-grid`; read its API for sticky header, pagination, virtualization, row selection.
 - **Incorrect:** styling rows/cells with arbitrary classes. **Correct:** drive layout via `tableLayout` and the documented `ColumnMeta` (e.g. `cellClassName`, `headerTitle`).
 
+## event-calendar
+
+**Required:** events via `events`/`onEventsChange` (controlled) or `defaultEvents` (uncontrolled), plus a height on the root.
+**Shape:**
+
+```tsx
+<EventCalendar defaultEvents={events} defaultView="month" className="h-[560px]">
+  <EventCalendarNav />
+  <EventCalendarContent />
+</EventCalendar>
+```
+
+**Gotcha:** headless-first: `EventCalendarContent` renders the active view (month/week/day/days/agenda; a resource view activates when `resources` is passed) - there is no per-view JSX to compose. Events are `{ id, title, start, end (exclusive), allDay?, color?, recurrence?, resourceId? }`. Mutations flow through `onEventUpdate`/`canDropEvent` (return `false` to reject); the root needs an explicit height because it is a min-h-0 flex column.
+
+## gantt
+
+**Required:** `resources` (the left tree) plus bars via `events`/`defaultEvents` attached by `resourceId`.
+**Shape:**
+
+```tsx
+<Gantt defaultEvents={bars} resources={tasks} defaultScale="month" className="h-[480px]">
+  <GanttNav />
+  <GanttView />
+</Gantt>
+```
+
+**Gotcha:** bars move along the time axis only (never across rows) and are all-day spans with exclusive `end`; `progress` is 0-100. Scales are `day | week | month | quarter | year`. Zoom control, infinite scroll, summary rollups, and row checkboxes are ON by default - turn off what you do not need. Same `onEventUpdate`/`canDropEvent` commit pipeline as `event-calendar`; the root needs an explicit height.
+
 ## kanban
 
 **Required:** `value` (`Record<string, T[]>`), `onValueChange`, `getItemValue`

.gitignore

@@ -28,3 +28,7 @@ Thumbs.db
 
 # Compose runtime log sidecar output (deploy/compose/runtime-logs)
 deploy/compose/runtime-logs/
+# Local MCP configs (may contain REUI license Bearer)
+.cursor/mcp.json
+.mcp.json
+.codegraph/daemon.pid

.mcp.json

@@ -1,16 +0,0 @@
-{
-  "mcpServers": {
-    "codegraph": {
-      "type": "stdio",
-      "command": "codegraph",
-      "args": [
-        "serve",
-        "--mcp"
-      ]
-    },
-    "reui": {
-      "type": "http",
-      "url": "https://mcp.reui.io/api/mcp"
-    }
-  }
-}

.opencode/skills/reui/SKILL.md

@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.opencode/skills/reui/rules/cli.md

@@ -29,6 +29,8 @@ REUI_LICENSE_KEY=your-license-key
 }
 ```
 
+The shadcn CLI expands `${REUI_LICENSE_KEY}` from `.env.local` inside `components.json`, but an MCP client config never expands variables, so a ReUI MCP server config must carry the raw token instead (for example `reui_pat_your_token_here`).
+
 The MCP `get_project_context` tool returns the right config. Full guide: https://reui.io/docs/registry
 
 ## Installing

.opencode/skills/reui/rules/components.md

@@ -1,6 +1,6 @@
 # ReUI components
 
-The 17 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `filters`, `frame`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 19 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
 
 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.
 
@@ -32,6 +32,34 @@ Common mistakes:
 - **Incorrect:** a raw `<table>` / hand-rolled pagination. **Correct:** use `data-grid`; read its API for sticky header, pagination, virtualization, row selection.
 - **Incorrect:** styling rows/cells with arbitrary classes. **Correct:** drive layout via `tableLayout` and the documented `ColumnMeta` (e.g. `cellClassName`, `headerTitle`).
 
+## event-calendar
+
+**Required:** events via `events`/`onEventsChange` (controlled) or `defaultEvents` (uncontrolled), plus a height on the root.
+**Shape:**
+
+```tsx
+<EventCalendar defaultEvents={events} defaultView="month" className="h-[560px]">
+  <EventCalendarNav />
+  <EventCalendarContent />
+</EventCalendar>
+```
+
+**Gotcha:** headless-first: `EventCalendarContent` renders the active view (month/week/day/days/agenda; a resource view activates when `resources` is passed) - there is no per-view JSX to compose. Events are `{ id, title, start, end (exclusive), allDay?, color?, recurrence?, resourceId? }`. Mutations flow through `onEventUpdate`/`canDropEvent` (return `false` to reject); the root needs an explicit height because it is a min-h-0 flex column.
+
+## gantt
+
+**Required:** `resources` (the left tree) plus bars via `events`/`defaultEvents` attached by `resourceId`.
+**Shape:**
+
+```tsx
+<Gantt defaultEvents={bars} resources={tasks} defaultScale="month" className="h-[480px]">
+  <GanttNav />
+  <GanttView />
+</Gantt>
+```
+
+**Gotcha:** bars move along the time axis only (never across rows) and are all-day spans with exclusive `end`; `progress` is 0-100. Scales are `day | week | month | quarter | year`. Zoom control, infinite scroll, summary rollups, and row checkboxes are ON by default - turn off what you do not need. Same `onEventUpdate`/`canDropEvent` commit pipeline as `event-calendar`; the root needs an explicit height.
+
 ## kanban
 
 **Required:** `value` (`Record<string, T[]>`), `onValueChange`, `getItemValue`

apps/web/.env.example

@@ -0,0 +1,28 @@
+# EvoBGP web (Vite) — переменные окружения.
+# Скопируйте в apps/web/.env.local (файл в .gitignore) и заполните.
+
+# ---------------------------------------------------------------------------
+# ReUI Pro/Ultimate — ключ с https://reui.io/account (для `pnpm dlx shadcn add @reui/*`)
+# ---------------------------------------------------------------------------
+# REUI_LICENSE_KEY=
+
+# ---------------------------------------------------------------------------
+# App Switcher — JSON с описанием шапки «Приложения» (fallback, когда portal
+# недоступен либо VITE_AUTH_ENABLED=false).
+# Схема: см. apps/web/src/lib/app-switcher-config.ts.
+# ---------------------------------------------------------------------------
+# VITE_APP_SWITCHER={"menuLabel":"Приложения","apps":[...]}
+
+# ---------------------------------------------------------------------------
+# Auth-portal SSO
+# ---------------------------------------------------------------------------
+# Включает JWT-гейт через auth-portal вместо локального evobgp_api_token.
+# Пример:
+#   VITE_AUTH_ENABLED=true
+#   VITE_AUTH_PORTAL_URL=https://auth.shnt.top
+#
+# Backend опционально может отдавать GET /v1/auth/config
+# ({ "required": true, "portal_url": "https://auth.shnt.top" }) —
+# ответ имеет приоритет над VITE_* и позволяет менять режим без пересборки.
+# VITE_AUTH_ENABLED=false
+# VITE_AUTH_PORTAL_URL=http://localhost:5175

apps/web/src/components/firewall/firewall-clients-grid.tsx

@@ -1,195 +0,0 @@
-import { ColumnDef } from '@tanstack/react-table'
-import { useMemo } from 'react'
-
-import { Button } from '@evobgp/ui/components/button'
-
-import { DataGridMutedCell, DataGridPrimaryCell } from '@/components/data-grid-cell'
-import { DataGridSection } from '@/components/data-grid-shell'
-import { ConfirmDialog } from '@/components/confirm-dialog'
-import { StatusBadge } from '@/components/status-badge'
-import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
-import { useClientDataGrid } from '@/hooks/use-client-data-grid'
-import type { FirewallClient } from '@/types/api'
-
-function formatPacketCount(value?: number | null): string | null {
-  if (value == null || value <= 0) return null
-  if (value >= 1_000_000) return `${(value / 1_000_000).toFixed(1)}M`
-  if (value >= 1_000) return `${(value / 1_000).toFixed(1)}k`
-  return String(value)
-}
-
-export interface FirewallClientsGridProps {
-  clients: FirewallClient[]
-  isLoading?: boolean
-  onApprove: (id: string) => void
-  onReject: (id: string) => void
-  approvePending?: boolean
-  rejectPending?: boolean
-  emptyTitle?: string
-}
-
-export function FirewallClientsGrid({
-  clients,
-  isLoading = false,
-  onApprove,
-  onReject,
-  approvePending = false,
-  rejectPending = false,
-  emptyTitle = 'Нет клиентов',
-}: FirewallClientsGridProps) {
-  const columns = useMemo<ColumnDef<FirewallClient>[]>(
-    () => [
-      {
-        accessorKey: 'name',
-        header: ({ column }) => <DataGridColumnHeader column={column} title="Имя" />,
-        cell: ({ row }) => (
-          <DataGridPrimaryCell
-            title={row.original.name}
-            subtitle={row.original.hostname || row.original.token_prefix}
-            accent="primary"
-          />
-        ),
-        meta: { headerTitle: 'Имя' },
-      },
-      {
-        accessorKey: 'status',
-        header: ({ column }) => <DataGridColumnHeader column={column} title="Статус" />,
-        cell: ({ row }) => <StatusBadge status={row.original.status} />,
-        meta: { headerTitle: 'Статус' },
-      },
-      {
-        id: 'last_seen_at',
-        accessorFn: (row) => row.last_seen_at ?? '',
-        header: ({ column }) => <DataGridColumnHeader column={column} title="Последняя активность" />,
-        cell: ({ row }) => (
-          <DataGridMutedCell>{row.original.last_seen_at?.slice(0, 19) ?? '—'}</DataGridMutedCell>
-        ),
-        sortingFn: (a, b) => {
-          const av = a.original.last_seen_at ?? ''
-          const bv = b.original.last_seen_at ?? ''
-          return av.localeCompare(bv)
-        },
-        meta: { headerTitle: 'Последняя активность' },
-      },
-      {
-        id: 'apply',
-        enableSorting: false,
-        header: 'Применение',
-        cell: ({ row }) => {
-          const c = row.original
-          return (
-            <span className="text-xs">
-              {c.last_apply_status ?? '—'}
-              {c.last_apply_prefix_count != null ? ` (${c.last_apply_prefix_count})` : ''}
-            </span>
-          )
-        },
-        meta: { headerTitle: 'Применение' },
-      },
-      {
-        id: 'packets',
-        enableSorting: false,
-        header: 'Пакеты',
-        cell: ({ row }) => {
-          const dropped = formatPacketCount(row.original.last_apply_packets_dropped)
-          const accepted = formatPacketCount(row.original.last_apply_packets_accepted)
-          if (!dropped && !accepted) {
-            return <span className="text-muted-foreground text-xs">—</span>
-          }
-          return (
-            <span className="text-muted-foreground text-xs">
-              {dropped ? <span className="text-destructive">↓{dropped}</span> : null}
-              {dropped && accepted ? ' · ' : null}
-              {accepted ? <span className="text-success">↑{accepted}</span> : null}
-            </span>
-          )
-        },
-        meta: { headerTitle: 'Пакеты' },
-      },
-      {
-        id: 'actions',
-        enableSorting: false,
-        header: () => null,
-        cell: ({ row }) => {
-          const c = row.original
-          return (
-            <div className="flex justify-end gap-2">
-              {c.status === 'pending' ? (
-                <>
-                  <Button
-                    size="sm"
-                    variant="outline"
-                    type="button"
-                    disabled={approvePending}
-                    onClick={() => onApprove(c.id)}
-                  >
-                    Одобрить
-                  </Button>
-                  <ConfirmDialog
-                    trigger={
-                      <Button
-                        size="sm"
-                        variant="outline"
-                        type="button"
-                        className="text-destructive"
-                        disabled={rejectPending}
-                      >
-                        Отклонить
-                      </Button>
-                    }
-                    title="Отклонить запрос?"
-                    description={`${c.name}${c.hostname ? ` (${c.hostname})` : ''} — запись будет удалена, токен перестанет работать.`}
-                    confirmLabel="Отклонить"
-                    destructive
-                    onConfirm={() => onReject(c.id)}
-                  />
-                </>
-              ) : null}
-              {c.status === 'approved' ? (
-                <ConfirmDialog
-                  trigger={
-                    <Button
-                      size="sm"
-                      variant="ghost"
-                      type="button"
-                      className="text-destructive"
-                      disabled={rejectPending}
-                    >
-                      Удалить
-                    </Button>
-                  }
-                  title="Удалить клиент?"
-                  description={`${c.name} — запись будет удалена, blocklist и токен перестанут работать.`}
-                  confirmLabel="Удалить"
-                  destructive
-                  onConfirm={() => onReject(c.id)}
-                />
-              ) : null}
-            </div>
-          )
-        },
-      },
-    ],
-    [approvePending, onApprove, onReject, rejectPending],
-  )
-
-  const { table, globalFilter, setGlobalFilter, filteredCount } = useClientDataGrid({
-    data: clients,
-    columns,
-    getSearchText: (row) =>
-      `${row.name} ${row.hostname ?? ''} ${row.token_prefix} ${row.status ?? ''}`,
-    getRowId: (row) => row.id,
-  })
-
-  return (
-    <DataGridSection
-      table={table}
-      recordCount={filteredCount}
-      isLoading={isLoading}
-      emptyMessage={emptyTitle}
-      searchValue={globalFilter}
-      onSearchChange={setGlobalFilter}
-      searchPlaceholder="Поиск клиентов…"
-    />
-  )
-}

apps/web/src/components/firewall/firewall-rule-create-dialog.tsx

@@ -1,101 +0,0 @@
-import { useEffect, useState } from 'react'
-
-import { Button } from '@evobgp/ui/components/button'
-import { Input } from '@evobgp/ui/components/input'
-import { Label } from '@evobgp/ui/components/label'
-
-import { FormDrawer } from '@/components/form-drawer'
-import { LoadingButton } from '@/components/loading-button'
-import { CommunitySelect } from '@/components/modules/community-select'
-import { SelectField } from '@/components/select-field'
-import { useCreateFirewallRule } from '@/queries/firewall'
-import type { BgpCommunity } from '@/types/api'
-
-const FIREWALL_ACTION_ITEMS = [
-  { value: 'block', label: 'block' },
-  { value: 'accept', label: 'accept' },
-] as const
-
-interface FirewallRuleCreateDialogProps {
-  open: boolean
-  onOpenChange: (open: boolean) => void
-  communities: BgpCommunity[]
-}
-
-export function FirewallRuleCreateDialog({
-  open,
-  onOpenChange,
-  communities,
-}: FirewallRuleCreateDialogProps) {
-  const createMutation = useCreateFirewallRule()
-  const [action, setAction] = useState<'block' | 'accept'>('block')
-  const [communityId, setCommunityId] = useState<string | null>(null)
-  const [comment, setComment] = useState('')
-
-  useEffect(() => {
-    if (!open) return
-    setAction('block')
-    setCommunityId(null)
-    setComment('')
-  }, [open])
-
-  async function save() {
-    try {
-      await createMutation.mutateAsync({
-        scope: 'tenant',
-        action,
-        community_id: communityId,
-        comment: comment.trim(),
-      })
-      onOpenChange(false)
-    } catch {
-      // toast handled in mutation
-    }
-  }
-
-  return (
-    <FormDrawer
-      open={open}
-      onOpenChange={onOpenChange}
-      title="Новое правило"
-      className="sm:max-w-md"
-      footer={
-        <>
-          <Button variant="outline" type="button" onClick={() => onOpenChange(false)}>
-            Отмена
-          </Button>
-          <LoadingButton type="button" onClick={save} loading={createMutation.isPending}>
-            Добавить
-          </LoadingButton>
-        </>
-      }
-    >
-      <SelectField
-        id="fw-rule-action"
-        label="Действие"
-        items={[...FIREWALL_ACTION_ITEMS]}
-        value={action}
-        placeholder="Выберите действие"
-        onValueChange={(v) => v && setAction(v as 'block' | 'accept')}
-      />
-      <CommunitySelect
-        id="fw-rule-community"
-        label="Community"
-        value={communityId}
-        onValueChange={setCommunityId}
-        communities={communities}
-        nullable
-        placeholder="Все communities"
-      />
-      <div className="flex flex-col gap-2">
-        <Label htmlFor="fw-rule-comment">Комментарий</Label>
-        <Input
-          id="fw-rule-comment"
-          placeholder="Комментарий"
-          value={comment}
-          onChange={(e) => setComment(e.target.value)}
-        />
-      </div>
-    </FormDrawer>
-  )
-}

apps/web/src/components/firewall/firewall-rules-grid.tsx

@@ -1,122 +0,0 @@
-import { ColumnDef } from '@tanstack/react-table'
-import { useMemo } from 'react'
-
-import { Button } from '@evobgp/ui/components/button'
-
-import { DataGridSection } from '@/components/data-grid-shell'
-import { ConfirmDialog } from '@/components/confirm-dialog'
-import { StatusBadge } from '@/components/status-badge'
-import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
-import { useClientDataGrid } from '@/hooks/use-client-data-grid'
-import { communityLabel } from '@/lib/modules/helpers'
-import type { BgpCommunity, FirewallRule } from '@/types/api'
-
-export interface FirewallRulesGridProps {
-  rules: FirewallRule[]
-  communities: BgpCommunity[]
-  isLoading?: boolean
-  onDelete: (id: string) => void
-  deletePending?: boolean
-  emptyTitle?: string
-}
-
-export function FirewallRulesGrid({
-  rules,
-  communities,
-  isLoading = false,
-  onDelete,
-  deletePending = false,
-  emptyTitle = 'Нет правил — blocklist пуст (default accept).',
-}: FirewallRulesGridProps) {
-  const columns = useMemo<ColumnDef<FirewallRule>[]>(
-    () => [
-      {
-        accessorKey: 'priority',
-        header: ({ column }) => <DataGridColumnHeader column={column} title="#" />,
-        cell: ({ row }) => row.original.priority,
-        meta: { headerTitle: '#' },
-      },
-      {
-        accessorKey: 'action',
-        header: ({ column }) => <DataGridColumnHeader column={column} title="Действие" />,
-        cell: ({ row }) => (
-          <StatusBadge status={row.original.action} label={row.original.action} />
-        ),
-        meta: { headerTitle: 'Действие' },
-      },
-      {
-        id: 'community',
-        enableSorting: false,
-        header: 'Community',
-        cell: ({ row }) => (
-          <span className="text-sm">
-            {row.original.community_id
-              ? communityLabel(row.original.community_id, communities)
-              : 'Все'}
-          </span>
-        ),
-        meta: { headerTitle: 'Community' },
-      },
-      {
-        accessorKey: 'comment',
-        enableSorting: false,
-        header: 'Комментарий',
-        cell: ({ row }) => row.original.comment || '—',
-        meta: { headerTitle: 'Комментарий' },
-      },
-      {
-        id: 'actions',
-        enableSorting: false,
-        header: () => null,
-        cell: ({ row }) => {
-          const r = row.original
-          return (
-            <ConfirmDialog
-              trigger={
-                <Button
-                  size="sm"
-                  variant="ghost"
-                  type="button"
-                  className="text-destructive"
-                  disabled={deletePending}
-                >
-                  Удалить
-                </Button>
-              }
-              title="Удалить правило?"
-              description={
-                r.comment
-                  ? `Правило #${r.priority} (${r.action}): ${r.comment}`
-                  : `Правило #${r.priority} (${r.action}) будет удалено.`
-              }
-              confirmLabel="Удалить"
-              destructive
-              onConfirm={() => onDelete(r.id)}
-            />
-          )
-        },
-      },
-    ],
-    [communities, deletePending, onDelete],
-  )
-
-  const { table, globalFilter, setGlobalFilter, filteredCount } = useClientDataGrid({
-    data: rules,
-    columns,
-    getSearchText: (row) =>
-      `${row.priority} ${row.action} ${row.comment ?? ''} ${communityLabel(row.community_id, communities)}`,
-    getRowId: (row) => row.id,
-  })
-
-  return (
-    <DataGridSection
-      table={table}
-      recordCount={filteredCount}
-      isLoading={isLoading}
-      emptyMessage={emptyTitle}
-      searchValue={globalFilter}
-      onSearchChange={setGlobalFilter}
-      searchPlaceholder="Поиск правил…"
-    />
-  )
-}

apps/web/src/components/layout/app-shell.tsx

@@ -9,7 +9,6 @@ import {
   BookText,
   KeyRound,
   ServerCog,
-  Shield,
   Search,
 } from 'lucide-react'
 
@@ -45,8 +44,9 @@ import type { ComponentType, CSSProperties, ReactNode } from 'react'
 import { AppSwitcher } from '@/components/app-switcher'
 import { AppsMenu } from '@/components/layout/apps-menu'
 import { CommandPalette, type CommandPaletteItem } from '@/components/layout/command-palette'
+import { NavUser } from '@/components/layout/nav-user'
 import { SystemMonitorPopover } from '@/components/layout/system-monitor-popover'
-import { ModeToggle } from '@/components/mode-toggle'
+import { can, isAuthEnabled, permissionForPath } from '@/lib/auth'
 
 interface NavItem {
   to: string
@@ -54,6 +54,8 @@ interface NavItem {
   icon: ComponentType<{ className?: string }>
   description?: string
   search?: Record<string, string>
+  /** Explicit permission override; when omitted derived from `to`. */
+  permission?: string
 }
 
 interface NavGroup {
@@ -86,7 +88,6 @@ const NAV_GROUPS: NavGroup[] = [
     label: 'Операции',
     items: [
       { to: '/operations', label: 'Операции', icon: Cog, description: 'Ревизии и apply', search: { tab: 'revisions' } },
-      { to: '/firewall', label: 'Файрвол', icon: Shield, description: 'Клиенты и правила' },
       { to: '/schedule', label: 'Задачи', icon: ListChecks, description: 'Расписание refresh' },
       { to: '/monitoring', label: 'Мониторинг', icon: Activity, description: 'Health и BIRD', search: { tab: 'system' } },
     ],
@@ -103,6 +104,18 @@ const NAV_GROUPS: NavGroup[] = [
 
 const ALL_NAV_ITEMS = NAV_GROUPS.flatMap((g) => g.items)
 
+/** Nav visible for the current claim (or all items when portal auth is off). */
+function useVisibleNavGroups(): NavGroup[] {
+  if (!isAuthEnabled()) return NAV_GROUPS
+  return NAV_GROUPS.map((group) => ({
+    ...group,
+    items: group.items.filter((item) => {
+      const perm = item.permission ?? permissionForPath(item.to)
+      return !perm || can(perm)
+    }),
+  })).filter((group) => group.items.length > 0)
+}
+
 const ROUTE_LABELS: Record<string, string> = Object.fromEntries(
   ALL_NAV_ITEMS.map((i) => [i.to, i.label]),
 )
@@ -127,6 +140,7 @@ const COMMAND_ITEMS: CommandPaletteItem[] = ALL_NAV_ITEMS.map((item) => ({
  */
 export function AppShell({ children }: { children: ReactNode }) {
   const pathname = useRouterState({ select: (s) => s.location.pathname })
+  const visibleGroups = useVisibleNavGroups()
   const activeItem =
     ALL_NAV_ITEMS.find((i) => pathname === i.to || (i.to !== '/' && pathname.startsWith(`${i.to}/`))) ??
     ALL_NAV_ITEMS[0]
@@ -152,7 +166,7 @@ export function AppShell({ children }: { children: ReactNode }) {
             <AppSwitcher />
           </SidebarHeader>
           <SidebarContent>
-            {NAV_GROUPS.map((group) => (
+            {visibleGroups.map((group) => (
               <SidebarGroup key={group.label}>
                 <SidebarGroupLabel>{group.label}</SidebarGroupLabel>
                 <SidebarGroupContent>
@@ -178,7 +192,9 @@ export function AppShell({ children }: { children: ReactNode }) {
               </SidebarGroup>
             ))}
           </SidebarContent>
-          <SidebarFooter />
+          <SidebarFooter>
+            <NavUser />
+          </SidebarFooter>
         </Sidebar>
         <SidebarInset>
           <header className="bg-background sticky top-0 z-10 flex h-12 shrink-0 items-center gap-2 border-b px-4 md:px-6">
@@ -202,7 +218,6 @@ export function AppShell({ children }: { children: ReactNode }) {
             <div className="ml-auto flex items-center gap-2">
               <AppsMenu />
               <SystemMonitorPopover />
-              <ModeToggle />
             </div>
           </header>
           <main className="flex flex-1 flex-col gap-4 px-4 py-4 md:gap-6 md:px-6 md:py-5">

apps/web/src/components/layout/apps-menu.tsx

@@ -15,6 +15,7 @@ import {
   CURRENT_APP_ID,
 } from '@/lib/app-switcher-config'
 import { useAppSwitcherConfig } from '@/hooks/use-app-switcher'
+import { authPortalUrl, isAuthEnabled } from '@/lib/auth'
 
 /** Header apps grid — app-shell-12 AppsMenu. @see https://reui.io/preview/base/app-shell-12 */
 export function AppsMenu() {
@@ -79,13 +80,23 @@ export function AppsMenu() {
             })}
           </div>
           <DropdownMenuSeparator />
-          <DropdownMenuItem
-            nativeButton={false}
-            render={<Link to="/settings" search={{ tab: 'connection' }} />}
-            className="justify-center text-sm font-medium"
-          >
-            Настройки
-          </DropdownMenuItem>
+          {isAuthEnabled() ? (
+            <DropdownMenuItem
+              nativeButton={false}
+              render={<a href={authPortalUrl()} />}
+              className="justify-center text-sm font-medium"
+            >
+              Настроить на портале
+            </DropdownMenuItem>
+          ) : (
+            <DropdownMenuItem
+              nativeButton={false}
+              render={<Link to="/settings" search={{ tab: 'connection' }} />}
+              className="justify-center text-sm font-medium"
+            >
+              Настройки
+            </DropdownMenuItem>
+          )}
         </DropdownMenuGroup>
       </DropdownMenuContent>
     </DropdownMenu>

apps/web/src/components/layout/nav-user.tsx

@@ -0,0 +1,229 @@
+import { Link } from '@tanstack/react-router'
+import { useEffect, useState } from 'react'
+import { useTheme } from 'next-themes'
+import {
+  ChevronsUpDownIcon,
+  ExternalLinkIcon,
+  LogOutIcon,
+  MonitorIcon,
+  MoonIcon,
+  PaletteIcon,
+  SettingsIcon,
+  SunIcon,
+} from 'lucide-react'
+
+import { cn } from '@evobgp/ui/lib/utils'
+import { Avatar, AvatarFallback } from '@evobgp/ui/components/avatar'
+import { Button } from '@evobgp/ui/components/button'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuGroup,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@evobgp/ui/components/dropdown-menu'
+import {
+  SidebarMenu,
+  SidebarMenuButton,
+  SidebarMenuItem,
+  useSidebar,
+} from '@evobgp/ui/components/sidebar'
+
+import { setToken as setApiToken, TOKEN_STORAGE_KEY } from '@/lib/api-client'
+import {
+  authPortalUrl,
+  clearPortalToken,
+  getClaims,
+  isAuthEnabled,
+  redirectToPortalLogout,
+  resetPortalHandoff,
+} from '@/lib/auth'
+
+/** Sidebar footer account menu — ReUI app-shell-1 NavUser. @see https://reui.io/preview/base/app-shell-1 */
+
+const THEMES = [
+  {
+    value: 'light',
+    label: 'Светлая',
+    icon: <SunIcon className="size-3.5" aria-hidden />,
+  },
+  {
+    value: 'dark',
+    label: 'Тёмная',
+    icon: <MoonIcon className="size-3.5" aria-hidden />,
+  },
+  {
+    value: 'system',
+    label: 'Системная',
+    icon: <MonitorIcon className="size-3.5" aria-hidden />,
+  },
+] as const
+
+function ThemeSegmentedToggle() {
+  const { theme, setTheme } = useTheme()
+  const [mounted, setMounted] = useState(false)
+
+  useEffect(() => {
+    setMounted(true)
+  }, [])
+
+  const currentTheme = mounted ? (theme ?? 'system') : 'system'
+
+  return (
+    <div
+      role="radiogroup"
+      aria-label="Тема"
+      className="bg-muted/60 inline-flex items-center gap-0.5 rounded-full p-0.5"
+      onClick={(e) => e.stopPropagation()}
+      onPointerDown={(e) => e.stopPropagation()}
+    >
+      {THEMES.map(({ value, label, icon }) => {
+        const isActive = currentTheme === value
+        return (
+          <Button
+            key={value}
+            type="button"
+            role="radio"
+            aria-checked={isActive}
+            aria-label={label}
+            variant="ghost"
+            size="icon-xs"
+            onClick={() => setTheme(value)}
+            className={cn(
+              'rounded-full',
+              isActive
+                ? 'bg-background text-foreground shadow-sm'
+                : 'text-muted-foreground hover:text-foreground',
+            )}
+          >
+            {icon}
+          </Button>
+        )
+      })}
+    </div>
+  )
+}
+
+function initials(source: string): string {
+  const base = source.trim()
+  if (!base) return '?'
+  const parts = base.split(/\s+/).filter(Boolean)
+  if (parts.length >= 2) {
+    return `${parts[0]![0] ?? ''}${parts[1]![0] ?? ''}`.toUpperCase()
+  }
+  return base.slice(0, 2).toUpperCase()
+}
+
+export function NavUser() {
+  const { isMobile } = useSidebar()
+  const authOn = isAuthEnabled()
+  const claims = getClaims()
+
+  const name = claims?.name?.trim() || (authOn ? 'Пользователь' : 'Гость')
+  const email =
+    claims?.email?.trim() || (authOn ? '' : 'локальный API-токен')
+  const fallback = initials(name || email)
+
+  function handleSignOut() {
+    if (authOn) {
+      clearPortalToken()
+      resetPortalHandoff()
+      redirectToPortalLogout()
+      return
+    }
+    setApiToken(null)
+    if (typeof window !== 'undefined') {
+      window.localStorage.removeItem(TOKEN_STORAGE_KEY)
+      window.location.assign('/settings?tab=connection&reason=token-required')
+    }
+  }
+
+  return (
+    <SidebarMenu>
+      <SidebarMenuItem>
+        <DropdownMenu>
+          <DropdownMenuTrigger
+            render={
+              <SidebarMenuButton
+                size="lg"
+                className="data-popup-open:bg-sidebar-accent data-popup-open:text-sidebar-accent-foreground"
+              />
+            }
+          >
+            <Avatar className="size-8 rounded-lg">
+              <AvatarFallback className="rounded-lg text-xs">{fallback}</AvatarFallback>
+            </Avatar>
+            <div className="grid flex-1 text-left text-sm leading-tight">
+              <span className="truncate font-semibold">{name}</span>
+              <span className="truncate text-xs text-muted-foreground">
+                {email || '—'}
+              </span>
+            </div>
+            <ChevronsUpDownIcon className="ml-auto size-4" />
+          </DropdownMenuTrigger>
+          <DropdownMenuContent
+            className="w-(--anchor-width) min-w-56 rounded-lg"
+            side={isMobile ? 'bottom' : 'right'}
+            align="end"
+            sideOffset={4}
+          >
+            <DropdownMenuGroup>
+              <DropdownMenuLabel className="flex items-center gap-2 py-2 font-normal text-foreground">
+                <Avatar className="size-8 rounded-lg">
+                  <AvatarFallback className="rounded-lg text-xs">
+                    {fallback}
+                  </AvatarFallback>
+                </Avatar>
+                <div className="grid min-w-0 flex-1 text-left text-sm leading-tight">
+                  <span className="truncate font-semibold">{name}</span>
+                  <span className="truncate text-xs text-muted-foreground">
+                    {email || '—'}
+                  </span>
+                </div>
+              </DropdownMenuLabel>
+            </DropdownMenuGroup>
+
+            <DropdownMenuSeparator />
+
+            <DropdownMenuGroup>
+              <DropdownMenuItem
+                nativeButton={false}
+                render={<Link to="/settings" search={{ tab: 'connection' }} />}
+              >
+                <SettingsIcon aria-hidden />
+                Настройки UI
+              </DropdownMenuItem>
+              {authOn ? (
+                <DropdownMenuItem
+                  nativeButton={false}
+                  render={<a href={authPortalUrl()} />}
+                >
+                  <ExternalLinkIcon aria-hidden />
+                  Открыть Auth Portal
+                </DropdownMenuItem>
+              ) : null}
+              <DropdownMenuItem className="cursor-default focus:bg-transparent">
+                <PaletteIcon aria-hidden />
+                Тема
+                <div className="ml-auto">
+                  <ThemeSegmentedToggle />
+                </div>
+              </DropdownMenuItem>
+            </DropdownMenuGroup>
+
+            <DropdownMenuSeparator />
+
+            <DropdownMenuGroup>
+              <DropdownMenuItem onClick={handleSignOut}>
+                <LogOutIcon aria-hidden />
+                {authOn ? 'Выйти' : 'Сбросить токен'}
+              </DropdownMenuItem>
+            </DropdownMenuGroup>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </SidebarMenuItem>
+    </SidebarMenu>
+  )
+}

apps/web/src/components/mode-toggle.tsx

@@ -1,29 +0,0 @@
-import { Moon, Sun } from 'lucide-react'
-import { useTheme } from 'next-themes'
-
-import { Button } from '@evobgp/ui/components/button'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
-} from '@evobgp/ui/components/dropdown-menu'
-
-export function ModeToggle() {
-  const { setTheme } = useTheme()
-
-  return (
-    <DropdownMenu>
-      <DropdownMenuTrigger render={<Button variant="ghost" size="icon" />}>
-        <Sun className="size-5 scale-100 rotate-0 transition-all dark:scale-0 dark:-rotate-90" />
-        <Moon className="absolute size-5 scale-0 rotate-90 transition-all dark:scale-100 dark:rotate-0" />
-        <span className="sr-only">Сменить тему</span>
-      </DropdownMenuTrigger>
-      <DropdownMenuContent align="end">
-        <DropdownMenuItem onClick={() => setTheme('light')}>Светлая</DropdownMenuItem>
-        <DropdownMenuItem onClick={() => setTheme('dark')}>Тёмная</DropdownMenuItem>
-        <DropdownMenuItem onClick={() => setTheme('system')}>Системная</DropdownMenuItem>
-      </DropdownMenuContent>
-    </DropdownMenu>
-  )
-}

apps/web/src/components/reui-kit/kpi-cols.ts

@@ -0,0 +1,10 @@
+/** Shared grid column classes for hybrid KPI / Quick Actions tiles. */
+export function kpiCols(count: number): string {
+  if (count <= 1) return 'grid-cols-1'
+  if (count === 2) return 'grid-cols-1 @xl:grid-cols-2'
+  if (count === 3) return 'grid-cols-1 @3xl:grid-cols-3'
+  if (count === 4) return 'grid-cols-1 @3xl:grid-cols-2 @6xl:grid-cols-4'
+  if (count === 5) return 'grid-cols-2 @3xl:grid-cols-3 xl:grid-cols-5'
+  if (count === 6) return 'grid-cols-2 sm:grid-cols-3 xl:grid-cols-6'
+  return 'grid-cols-2 sm:grid-cols-3 lg:grid-cols-4'
+}

apps/web/src/components/reui-kit/kpi-stat-grid.tsx

@@ -4,6 +4,7 @@ import { Link } from '@tanstack/react-router'
 import { Frame, FramePanel } from '@/components/reui/frame'
 import { Badge } from '@/components/reui/badge'
 import { cn } from '@evobgp/ui/lib/utils'
+import { kpiCols } from './kpi-cols'
 import { Item, ItemMedia } from '@evobgp/ui/components/item'
 import { Skeleton } from '@evobgp/ui/components/skeleton'
 
@@ -47,16 +48,6 @@ const VALUE_VARIANT_CLASS: Record<KpiStatVariant, string> = {
   destructive: 'text-destructive',
 }
 
-function kpiCols(count: number): string {
-  if (count <= 1) return 'grid-cols-1'
-  if (count === 2) return 'grid-cols-1 @xl:grid-cols-2'
-  if (count === 3) return 'grid-cols-1 @3xl:grid-cols-3'
-  if (count === 4) return 'grid-cols-1 @3xl:grid-cols-2 @6xl:grid-cols-4'
-  if (count === 5) return 'grid-cols-2 @3xl:grid-cols-3 xl:grid-cols-5'
-  if (count === 6) return 'grid-cols-2 sm:grid-cols-3 xl:grid-cols-6'
-  return 'grid-cols-2 sm:grid-cols-3 lg:grid-cols-4'
-}
-
 function handleCardKeyDown(onActivate: () => void, event: KeyboardEvent<HTMLDivElement>) {
   if (event.key === 'Enter' || event.key === ' ') {
     event.preventDefault()

apps/web/src/components/reui-kit/quick-action-grid.tsx

@@ -10,6 +10,7 @@ import {
 import { Badge } from '@/components/reui/badge'
 import { Item, ItemMedia } from '@evobgp/ui/components/item'
 import { cn } from '@evobgp/ui/lib/utils'
+import { kpiCols } from './kpi-cols'
 
 export interface QuickActionItem {
   id: string
@@ -30,16 +31,6 @@ interface QuickActionGridProps {
 
 const DEFAULT_ICON_CLASS = 'text-muted-foreground [&_svg]:text-current'
 
-function kpiCols(count: number): string {
-  if (count <= 1) return 'grid-cols-1'
-  if (count === 2) return 'grid-cols-1 @xl:grid-cols-2'
-  if (count === 3) return 'grid-cols-1 @3xl:grid-cols-3'
-  if (count === 4) return 'grid-cols-1 @3xl:grid-cols-2 @6xl:grid-cols-4'
-  if (count === 5) return 'grid-cols-2 @3xl:grid-cols-3 xl:grid-cols-5'
-  if (count === 6) return 'grid-cols-2 sm:grid-cols-3 xl:grid-cols-6'
-  return 'grid-cols-2 sm:grid-cols-3 lg:grid-cols-4'
-}
-
 function QuickActionBody({ action }: { action: QuickActionItem }) {
   return (
     <div className="relative z-10 flex h-full items-start gap-3">

apps/web/src/hooks/use-app-switcher.ts

@@ -1,19 +1,42 @@
+import { useMemo } from 'react'
+import { useQuery } from '@tanstack/react-query'
+
 import {
   DEFAULT_APP_SWITCHER_CONFIG,
-  getAppSwitcherConfig,
   getAppUrl as getAppUrlFromConfig,
   type AppSwitcherConfig,
 } from '@/lib/app-switcher-config'
+import { appSwitcherQueryOptions } from '@/queries/app-switcher'
+import { getClaims, isAuthEnabled } from '@/lib/auth'
 
-/** Env-backed app switcher (no DB API in EvoBGP v1). */
+/**
+ * Portal-first switcher: tries `/api/v1/app-switcher` and filters entries by
+ * the current JWT `apps` claim; falls back to `VITE_APP_SWITCHER`/defaults
+ * when auth-portal is disabled or unavailable.
+ */
 export function useAppSwitcherConfig(): {
   config: AppSwitcherConfig
   isLoading: boolean
 } {
-  return {
-    config: getAppSwitcherConfig(),
-    isLoading: false,
-  }
+  const authOn = isAuthEnabled()
+  const { data, isLoading } = useQuery({
+    ...appSwitcherQueryOptions(),
+    enabled: authOn,
+  })
+  const claims = getClaims()
+
+  const config = useMemo<AppSwitcherConfig>(() => {
+    const raw = data ?? DEFAULT_APP_SWITCHER_CONFIG
+    if (!authOn) return raw
+    const allowed = claims?.apps
+    if (!allowed?.length) return raw
+    const set = new Set(allowed)
+    const apps = raw.apps.filter((a) => set.has(a.id))
+    if (!apps.length) return raw
+    return { ...raw, apps }
+  }, [data, authOn, claims?.apps])
+
+  return { config, isLoading: authOn && isLoading }
 }
 
 export function useAppUrl(appId: string): string | undefined {

apps/web/src/lib/api-client.ts

@@ -30,8 +30,19 @@ export function normalizeApiToken(raw: string): string {
   return t
 }
 
+/** Portal JWT storage key mirrored from `@/lib/auth`. Kept local to avoid a
+ * cycle when `auth` starts pulling from `api-client` for the config endpoint. */
+const PORTAL_TOKEN_STORAGE_KEY = 'evobgp_portal_token'
+
+/**
+ * Bearer selection: portal JWT wins over the legacy API-key. When auth-portal
+ * is disabled or hasn't issued a token yet we fall back to the local API-key
+ * (`evobgp_api_token`) so curl-style tooling keeps working.
+ */
 function getToken(): string | null {
   if (typeof window === 'undefined') return null
+  const portal = window.localStorage.getItem(PORTAL_TOKEN_STORAGE_KEY)
+  if (portal && portal.trim()) return portal.trim()
   const raw = window.localStorage.getItem(TOKEN_STORAGE_KEY)
   if (!raw) return null
   const normalized = normalizeApiToken(raw)

apps/web/src/lib/app-switcher-config.ts

@@ -8,7 +8,9 @@ import {
 } from 'lucide-react'
 import { z } from 'zod'
 
-export const CURRENT_APP_ID = 'evobgp'
+import { CURRENT_APP_ID } from '@/lib/auth'
+
+export { CURRENT_APP_ID }
 
 const appSwitcherIconSchema = z.enum(['server', 'cloud', 'globe', 'dashboard', 'chart'])
 
@@ -44,7 +46,7 @@ export const DEFAULT_APP_SWITCHER_CONFIG: AppSwitcherConfig = {
   menuLabel: 'Приложения',
   apps: [
     {
-      id: 'vps-tracker',
+      id: 'vps',
       name: 'VPS Tracker',
       subtitle: 'Учёт виртуальных серверов',
       url: 'http://192.168.100.67:3001',
@@ -60,7 +62,7 @@ export const DEFAULT_APP_SWITCHER_CONFIG: AppSwitcherConfig = {
       shortcut: '⌘2',
     },
     {
-      id: 'evobgp',
+      id: 'bgp',
       name: 'EvoBGP',
       subtitle: 'BGP маршрутизация',
       url: 'http://192.168.100.67:3000',

apps/web/src/lib/auth.ts

@@ -0,0 +1,326 @@
+/**
+ * Portal JWT SSO integration for EvoBGP UI.
+ *
+ * Two independent auth channels:
+ *  - Portal JWT (this module) — SSO from auth-portal, used to gate UI + Bearer
+ *    to EvoBGP API when the API accepts portal-issued tokens.
+ *  - Local API key (see `@/lib/api-client`) — legacy `evobgp_api_token`
+ *    in localStorage; used when auth-portal is disabled or as a fallback.
+ *
+ * `VITE_AUTH_ENABLED=false` → keep the API-key gate.
+ * `VITE_AUTH_ENABLED=true`  → require portal JWT; API-key kept only for tools
+ *                             (curl/dev) and as backup.
+ */
+
+const TOKEN_KEY = 'evobgp_portal_token'
+const HANDOFF_KEY = 'evobgp_portal_401_handoff'
+const HANDOFF_AT_KEY = 'evobgp_portal_handoff_at'
+/** Min gap between portal handoffs — breaks SSO↔401 redirect storms. */
+const HANDOFF_COOLDOWN_MS = 12_000
+
+/** EvoBGP is `bgp` in the auth-portal registry (see APP_IDS). */
+export const CURRENT_APP_ID = 'bgp'
+
+export type AccessClaims = {
+  sub: string
+  email: string
+  name: string
+  apps: string[]
+  permissions: string[]
+  is_admin?: boolean
+  iss?: string
+  exp?: number
+}
+
+export type RuntimeAuthConfig = {
+  required: boolean
+  portalUrl: string
+}
+
+let runtimeConfig: RuntimeAuthConfig | null = null
+let runtimeConfigPromise: Promise<RuntimeAuthConfig> | null = null
+
+function viteAuthEnabled(): boolean {
+  return (
+    import.meta.env.VITE_AUTH_ENABLED === 'true' ||
+    import.meta.env.VITE_AUTH_ENABLED === '1'
+  )
+}
+
+function vitePortalUrl(): string {
+  return (import.meta.env.VITE_AUTH_PORTAL_URL ?? 'http://localhost:5175').replace(
+    /\/$/,
+    '',
+  )
+}
+
+/**
+ * Load auth mode from EvoBGP API (Docker-friendly). Falls back to VITE_* flags
+ * when the endpoint isn't implemented (404) or the API is unreachable.
+ *
+ * Note: EvoBGP uses `/v1/...` (not `/api/v1/...`).
+ */
+export async function ensureAuthConfig(): Promise<RuntimeAuthConfig> {
+  if (runtimeConfig) return runtimeConfig
+  if (runtimeConfigPromise) return runtimeConfigPromise
+
+  runtimeConfigPromise = (async () => {
+    try {
+      const res = await fetch('/v1/auth/config', {
+        headers: { Accept: 'application/json' },
+      })
+      if (res.ok) {
+        const data = (await res.json()) as {
+          required?: boolean
+          portal_url?: string
+        }
+        runtimeConfig = {
+          required: Boolean(data.required) || viteAuthEnabled(),
+          portalUrl: (data.portal_url || vitePortalUrl()).replace(/\/$/, ''),
+        }
+        return runtimeConfig
+      }
+    } catch {
+      /* ignore — fall through to vite defaults */
+    }
+    runtimeConfig = {
+      required: viteAuthEnabled(),
+      portalUrl: vitePortalUrl(),
+    }
+    return runtimeConfig
+  })().finally(() => {
+    runtimeConfigPromise = null
+  })
+
+  return runtimeConfigPromise
+}
+
+export function getAuthConfigSync(): RuntimeAuthConfig | null {
+  return runtimeConfig
+}
+
+export function getPortalToken(): string | null {
+  if (typeof window === 'undefined') return null
+  return window.localStorage.getItem(TOKEN_KEY)
+}
+
+export function setPortalToken(token: string): void {
+  if (typeof window === 'undefined') return
+  window.localStorage.setItem(TOKEN_KEY, token)
+}
+
+export function clearPortalToken(): void {
+  if (typeof window === 'undefined') return
+  window.localStorage.removeItem(TOKEN_KEY)
+}
+
+export function isAuthEnabled(): boolean {
+  if (runtimeConfig) return runtimeConfig.required
+  return viteAuthEnabled()
+}
+
+export function authPortalUrl(): string {
+  if (runtimeConfig?.portalUrl) return runtimeConfig.portalUrl
+  return vitePortalUrl()
+}
+
+export function isPortalHandoffCoolingDown(): boolean {
+  if (typeof window === 'undefined') return false
+  const raw = window.sessionStorage.getItem(HANDOFF_AT_KEY)
+  if (!raw) return false
+  const at = Number(raw)
+  if (!Number.isFinite(at)) return false
+  return Date.now() - at < HANDOFF_COOLDOWN_MS
+}
+
+export function markPortalHandoff(): void {
+  if (typeof window === 'undefined') return
+  window.sessionStorage.setItem(HANDOFF_KEY, '1')
+  window.sessionStorage.setItem(HANDOFF_AT_KEY, String(Date.now()))
+}
+
+export function clearPortalHandoffFlag(): void {
+  if (typeof window === 'undefined') return
+  window.sessionStorage.removeItem(HANDOFF_KEY)
+}
+
+/** Clear cooldown too — use on intentional logout so next login is allowed. */
+export function resetPortalHandoff(): void {
+  if (typeof window === 'undefined') return
+  window.sessionStorage.removeItem(HANDOFF_KEY)
+  window.sessionStorage.removeItem(HANDOFF_AT_KEY)
+}
+
+export function hasPortalHandoffFlag(): boolean {
+  if (typeof window === 'undefined') return false
+  return window.sessionStorage.getItem(HANDOFF_KEY) === '1'
+}
+
+/**
+ * Redirect to auth-portal SSO. Returns false if cooldown blocks the handoff
+ * (clears local token) — prevents infinite SSO when API rejects JWT.
+ */
+export function redirectToPortalLogin(returnTo?: string): boolean {
+  if (typeof window === 'undefined') return false
+  if (isPortalHandoffCoolingDown()) {
+    clearPortalToken()
+    return false
+  }
+  markPortalHandoff()
+  const callback = returnTo ?? `${window.location.origin}/auth/callback`
+  const url = new URL(authPortalUrl())
+  url.searchParams.set('return_to', callback)
+  window.location.assign(url.toString())
+  return true
+}
+
+/** End portal SSO session (refresh cookie + portal token). */
+export function redirectToPortalLogout(): void {
+  clearPortalToken()
+  resetPortalHandoff()
+  if (typeof window === 'undefined') return
+  window.location.assign(`${authPortalUrl()}/logout`)
+}
+
+export function parseHashToken(hash: string): {
+  accessToken: string | null
+  expiresAt: string | null
+} {
+  const raw = hash.startsWith('#') ? hash.slice(1) : hash
+  const params = new URLSearchParams(raw)
+  return {
+    accessToken: params.get('access_token'),
+    expiresAt: params.get('expires_at'),
+  }
+}
+
+export function decodeClaims(token: string): AccessClaims | null {
+  try {
+    const parts = token.split('.')
+    if (parts.length < 2) return null
+    const json = atob(parts[1]!.replace(/-/g, '+').replace(/_/g, '/'))
+    const payload = JSON.parse(json) as Record<string, unknown>
+    return {
+      sub: String(payload.sub ?? ''),
+      email: String(payload.email ?? ''),
+      name: String(payload.name ?? ''),
+      apps: Array.isArray(payload.apps) ? payload.apps.map(String) : [],
+      permissions: Array.isArray(payload.permissions)
+        ? payload.permissions.map(String)
+        : [],
+      is_admin: Boolean(payload.is_admin),
+      iss: payload.iss ? String(payload.iss) : undefined,
+      exp: typeof payload.exp === 'number' ? payload.exp : undefined,
+    }
+  } catch {
+    return null
+  }
+}
+
+export function getClaims(): AccessClaims | null {
+  const token = getPortalToken()
+  if (!token) return null
+  const claims = decodeClaims(token)
+  if (!claims) return null
+  if (claims.exp && claims.exp * 1000 < Date.now()) {
+    clearPortalToken()
+    return null
+  }
+  return claims
+}
+
+export function hasPermission(
+  granted: readonly string[],
+  required: string,
+): boolean {
+  if (granted.includes(required)) return true
+  const parts = required.split(':')
+  if (parts.length !== 3) return false
+  const [app, section, action] = parts
+  if (action === 'read') {
+    return (
+      granted.includes(`${app}:${section}:write`) ||
+      granted.includes(`${app}:${section}:admin`)
+    )
+  }
+  if (action === 'write') {
+    return granted.includes(`${app}:${section}:admin`)
+  }
+  return false
+}
+
+/** Access-check: pass when portal auth is disabled or claim grants required. */
+export function can(required: string): boolean {
+  if (!isAuthEnabled()) return true
+  const claims = getClaims()
+  if (!claims) return false
+  if (!claims.apps.includes(CURRENT_APP_ID)) return false
+  if (claims.is_admin) return true
+  return hasPermission(claims.permissions, required)
+}
+
+/**
+ * Whether /v1/auth/session may manage API keys (`bgp:access:admin`).
+ * Mirrors backend `requirePerm` for JWT (is_admin / permissions) and API-key operator.
+ */
+export function sessionCanManageApiKeys(session: {
+  role?: string
+  kind?: string
+  is_admin?: boolean
+  permissions?: readonly string[]
+} | null | undefined): boolean {
+  if (!session) return false
+  const jwtPath =
+    session.kind === 'jwt' ||
+    session.is_admin === true ||
+    (session.permissions?.length ?? 0) > 0
+  if (jwtPath) {
+    return (
+      session.is_admin === true ||
+      hasPermission(session.permissions ?? [], 'bgp:access:admin')
+    )
+  }
+  return session.role === 'operator'
+}
+
+/** Nav path → minimum permission to show the item. Sync with app-shell NAV. */
+export function permissionForPath(pathname: string): string | null {
+  if (pathname === '/' || pathname.startsWith('/dashboard')) {
+    return 'bgp:dashboard:read'
+  }
+  if (pathname.startsWith('/modules')) return 'bgp:modules:read'
+  if (pathname.startsWith('/lookup')) return 'bgp:lookup:read'
+  if (pathname.startsWith('/network')) return 'bgp:network:read'
+  if (pathname.startsWith('/directories')) return 'bgp:directories:read'
+  if (pathname.startsWith('/operations')) return 'bgp:operations:read'
+  if (pathname.startsWith('/schedule')) return 'bgp:schedule:read'
+  if (pathname.startsWith('/monitoring')) return 'bgp:monitoring:read'
+  if (pathname.startsWith('/access')) return 'bgp:access:admin'
+  if (pathname.startsWith('/tenant-settings')) return 'bgp:tenant_settings:admin'
+  if (pathname.startsWith('/settings')) return 'bgp:settings:read'
+  return null
+}
+
+const FALLBACK_PATH = '/dashboard'
+
+/** First path in the sidebar the current user may open. */
+export function firstAllowedPath(): string {
+  const candidates: readonly string[] = [
+    '/dashboard',
+    '/modules',
+    '/lookup',
+    '/network',
+    '/directories',
+    '/operations',
+    '/schedule',
+    '/monitoring',
+    '/access',
+    '/tenant-settings',
+    '/settings',
+  ]
+  for (const path of candidates) {
+    const perm = permissionForPath(path)
+    if (!perm || can(perm)) return path
+  }
+  return FALLBACK_PATH
+}

apps/web/src/queries/app-switcher.ts

@@ -0,0 +1,32 @@
+import { queryOptions } from '@tanstack/react-query'
+
+import { ensureAuthConfig } from '@/lib/auth'
+import {
+  DEFAULT_APP_SWITCHER_CONFIG,
+  parseAppSwitcherConfig,
+  type AppSwitcherConfig,
+} from '@/lib/app-switcher-config'
+
+export const appSwitcherQueryKey = ['app-switcher', 'portal'] as const
+
+/** Portal contract shape: `{ menuLabel, apps: [{ id, name, url, icon, enabled }] }`. */
+async function fetchPortalAppSwitcher(): Promise<AppSwitcherConfig> {
+  const { portalUrl } = await ensureAuthConfig()
+  const base = portalUrl.replace(/\/$/, '')
+  const res = await fetch(`${base}/api/v1/app-switcher`, {
+    headers: { Accept: 'application/json' },
+  })
+  if (!res.ok) throw new Error(`app-switcher ${res.status}`)
+  const raw = (await res.json()) as unknown
+  return parseAppSwitcherConfig(JSON.stringify(raw))
+}
+
+export function appSwitcherQueryOptions() {
+  return queryOptions({
+    queryKey: appSwitcherQueryKey,
+    queryFn: fetchPortalAppSwitcher,
+    staleTime: 60_000,
+    placeholderData: DEFAULT_APP_SWITCHER_CONFIG,
+    retry: 1,
+  })
+}

apps/web/src/queries/firewall.ts

@@ -1,102 +0,0 @@
-import { queryOptions, useMutation, useQueryClient } from '@tanstack/react-query'
-import { toast } from 'sonner'
-
-import { apiJSON } from '@/lib/api-client'
-import type {
-  FirewallClient,
-  FirewallClientsResponse,
-  FirewallInstallContext,
-  FirewallRule,
-  FirewallRulesResponse,
-} from '@/types/api'
-
-export const firewallKeys = {
-  all: ['firewall'] as const,
-  clients: () => [...firewallKeys.all, 'clients'] as const,
-  installContext: () => [...firewallKeys.all, 'install-context'] as const,
-  rules: (scope: string, clientId?: string) =>
-    [...firewallKeys.all, 'rules', scope, clientId ?? ''] as const,
-}
-
-export function firewallInstallContextQueryOptions() {
-  return queryOptions<FirewallInstallContext>({
-    queryKey: firewallKeys.installContext(),
-    queryFn: () => apiJSON<FirewallInstallContext>('/v1/firewall/install-context'),
-    staleTime: 60_000,
-    retry: false,
-  })
-}
-
-export function firewallClientsQueryOptions() {
-  return queryOptions<FirewallClientsResponse>({
-    queryKey: firewallKeys.clients(),
-    queryFn: () => apiJSON<FirewallClientsResponse>('/v1/firewall/clients'),
-    staleTime: 15_000,
-  })
-}
-
-export function firewallRulesQueryOptions(scope: 'tenant' | 'client', clientId?: string) {
-  const qs =
-    scope === 'client' && clientId
-      ? `?scope=client&client_id=${encodeURIComponent(clientId)}`
-      : '?scope=tenant'
-  return queryOptions<FirewallRulesResponse>({
-    queryKey: firewallKeys.rules(scope, clientId),
-    queryFn: () => apiJSON<FirewallRulesResponse>(`/v1/firewall/rules${qs}`),
-    staleTime: 15_000,
-  })
-}
-
-export function useApproveFirewallClient() {
-  const qc = useQueryClient()
-  return useMutation({
-    mutationFn: (id: string) =>
-      apiJSON<FirewallClient>(`/v1/firewall/clients/${id}/approve`, { method: 'POST' }),
-    onSuccess: () => {
-      toast.success('Клиент одобрен')
-      void qc.invalidateQueries({ queryKey: firewallKeys.clients() })
-    },
-    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось одобрить'),
-  })
-}
-
-export function useDeleteFirewallClient() {
-  const qc = useQueryClient()
-  return useMutation({
-    mutationFn: (id: string) =>
-      apiJSON<void>(`/v1/firewall/clients/${id}`, { method: 'DELETE' }),
-    onSuccess: () => {
-      toast.success('Клиент удалён')
-      void qc.invalidateQueries({ queryKey: firewallKeys.clients() })
-    },
-    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось удалить'),
-  })
-}
-
-export function useCreateFirewallRule() {
-  const qc = useQueryClient()
-  return useMutation({
-    mutationFn: (body: Record<string, unknown>) =>
-      apiJSON<FirewallRule>('/v1/firewall/rules', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(body),
-      }),
-    onSuccess: () => {
-      toast.success('Правило добавлено')
-      void qc.invalidateQueries({ queryKey: firewallKeys.all })
-    },
-    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось добавить правило'),
-  })
-}
-
-export function useDeleteFirewallRule() {
-  const qc = useQueryClient()
-  return useMutation({
-    mutationFn: (id: string) =>
-      apiJSON<void>(`/v1/firewall/rules/${id}`, { method: 'DELETE' }),
-    onSuccess: () => {
-      void qc.invalidateQueries({ queryKey: firewallKeys.all })
-    },
-  })
-}

apps/web/src/routes/_auth.tsx

@@ -1,15 +1,69 @@
 import { createFileRoute, Outlet, redirect } from '@tanstack/react-router'
 
 import { normalizeApiToken, TOKEN_STORAGE_KEY } from '@/lib/api-client'
+import {
+  can,
+  ensureAuthConfig,
+  firstAllowedPath,
+  getClaims,
+  getPortalToken,
+  permissionForPath,
+  redirectToPortalLogin,
+} from '@/lib/auth'
 
+/**
+ * Two-mode gate:
+ *  - VITE_AUTH_ENABLED / API `/v1/auth/config { required: true }`
+ *      → require auth-portal JWT (SSO) + section permission via `can()`.
+ *  - Off → keep legacy `evobgp_api_token` gate (redirect to /settings if empty).
+ */
 export const Route = createFileRoute('/_auth')({
-  beforeLoad: ({ location }) => {
-    // Настройки доступны без токена — сюда попадают при первом входе (в т.ч. для `dev`).
+  beforeLoad: async ({ location }) => {
+    const cfg = await ensureAuthConfig()
+
+    if (cfg.required) {
+      const token = getPortalToken()
+      const claims = getClaims()
+      if (!token || !claims) {
+        const ok = redirectToPortalLogin(
+          `${window.location.origin}/auth/callback`,
+        )
+        if (!ok) {
+          throw redirect({
+            to: '/auth/callback',
+            search: { error: 'sso_loop' },
+          })
+        }
+        await new Promise(() => {})
+        return
+      }
+      if (!claims.apps.includes('bgp')) {
+        throw redirect({
+          to: '/auth/callback',
+          search: { error: 'sso_loop' },
+        })
+      }
+      const perm = permissionForPath(location.pathname)
+      if (perm && !can(perm)) {
+        const fallback = firstAllowedPath()
+        if (fallback !== location.pathname) {
+          throw redirect({ to: fallback as '/dashboard' })
+        }
+      }
+      return
+    }
+
+    // Settings available without token — first-run onboarding (incl. `dev`).
     if (location.pathname === '/settings') return
     const raw =
-      typeof window !== 'undefined' ? window.localStorage.getItem(TOKEN_STORAGE_KEY) : null
+      typeof window !== 'undefined'
+        ? window.localStorage.getItem(TOKEN_STORAGE_KEY)
+        : null
     if (!raw || !normalizeApiToken(raw)) {
-      throw redirect({ to: '/settings', search: { tab: 'connection', reason: 'token-required' } })
+      throw redirect({
+        to: '/settings',
+        search: { tab: 'connection', reason: 'token-required' },
+      })
     }
   },
   component: AuthLayout,

apps/web/src/routes/_auth/access.tsx

@@ -11,6 +11,7 @@ import { PageHeader } from '@/components/page-header'
 import { Badge } from '@/components/reui/badge'
 import { SectionCards, type SectionCardItem } from '@/components/section-cards'
 import { SectionCardsSkeleton } from '@/components/skeletons'
+import { sessionCanManageApiKeys } from '@/lib/auth'
 import { authSessionQueryOptions } from '@/queries/auth'
 import { apiKeysQueryOptions } from '@/queries/api-keys'
 
@@ -21,11 +22,11 @@ export const Route = createFileRoute('/_auth/access')({
 function AccessComponent() {
   const sessionQuery = useQuery(authSessionQueryOptions())
   const session = sessionQuery.data ?? null
-  const isOperator = session?.role === 'operator'
+  const canManageKeys = sessionCanManageApiKeys(session)
 
   const keysQuery = useQuery({
     ...apiKeysQueryOptions(),
-    enabled: isOperator,
+    enabled: canManageKeys,
   })
 
   const keys = keysQuery.data ?? []
@@ -73,16 +74,31 @@ function AccessComponent() {
 
   function refetchAll() {
     void sessionQuery.refetch()
-    if (isOperator) void keysQuery.refetch()
+    if (canManageKeys) void keysQuery.refetch()
   }
 
+  const sessionKindLabel =
+    session?.kind === 'jwt' ? 'Portal JWT' : session?.kind === 'apikey' ? 'API-ключ' : null
+
+  const sessionAccessLabel = (() => {
+    if (!session) return null
+    if (session.kind === 'jwt' || session.is_admin || (session.permissions?.length ?? 0) > 0) {
+      if (session.is_admin) return 'admin (portal)'
+      if (sessionCanManageApiKeys(session)) return 'bgp:access:admin'
+      return session.permissions?.length
+        ? session.permissions.slice(0, 3).join(', ')
+        : 'без access:admin'
+    }
+    return session.role || '—'
+  })()
+
   return (
     <div className="flex flex-col gap-6">
       <PageHeader
         title="Права доступа"
         description="API-ключи control plane и текущая сессия Bearer-токена."
         actions={
-          isOperator ? (
+          canManageKeys ? (
             <Button variant="outline" size="sm" onClick={refetchAll} disabled={refreshing}>
               <RefreshCw className={refreshing ? 'animate-spin' : ''} />
               Обновить
@@ -94,36 +110,48 @@ function AccessComponent() {
       {session ? (
         <PanelCard
           title="Текущая сессия"
-          description="Tenant и роль ключа, с которым открыта панель."
+          description="Tenant и права текущего Bearer (API-ключ или portal JWT)."
           contentClassName="grid gap-3 py-4 text-sm sm:grid-cols-2"
         >
+          <div>
+            <p className="text-muted-foreground">Tenant</p>
+            <p className="break-all font-mono text-xs">{session.tenant_id}</p>
+          </div>
+          <div>
+            <p className="text-muted-foreground">Доступ</p>
+            <p className="font-mono text-xs">{sessionAccessLabel}</p>
+          </div>
+          {sessionKindLabel ? (
             <div>
-              <p className="text-muted-foreground">Tenant</p>
-              <p className="break-all font-mono text-xs">{session.tenant_id}</p>
+              <p className="text-muted-foreground">Тип</p>
+              <p className="font-mono text-xs">{sessionKindLabel}</p>
             </div>
+          ) : null}
+          {session.email ? (
             <div>
-              <p className="text-muted-foreground">Роль</p>
-              <p className="font-mono">{session.role}</p>
+              <p className="text-muted-foreground">Email</p>
+              <p className="break-all text-xs">{session.email}</p>
             </div>
+          ) : null}
         </PanelCard>
       ) : (
         <PanelCard contentClassName="py-4 text-sm text-muted-foreground">
-            Не удалось определить сессию. Укажите токен в{' '}
-            <Link
-              to="/settings"
-              search={{ tab: 'connection' }}
-              className="text-primary underline-offset-4 hover:underline"
-            >
-              настройках
-            </Link>{' '}
-            (для dev-окружения — <code className="text-xs">dev</code> при включённом demo-seed).
-            {sessionQuery.isError && sessionQuery.error instanceof Error ? (
-              <span className="mt-2 block text-destructive">{sessionQuery.error.message}</span>
-            ) : null}
+          Не удалось определить сессию. Укажите токен в{' '}
+          <Link
+            to="/settings"
+            search={{ tab: 'connection' }}
+            className="text-primary underline-offset-4 hover:underline"
+          >
+            настройках
+          </Link>{' '}
+          (для dev-окружения — <code className="text-xs">dev</code> при включённом demo-seed).
+          {sessionQuery.isError && sessionQuery.error instanceof Error ? (
+            <span className="mt-2 block text-destructive">{sessionQuery.error.message}</span>
+          ) : null}
         </PanelCard>
       )}
 
-      {isOperator ? (
+      {canManageKeys ? (
         <>
           {keysQuery.isLoading ? (
             <SectionCardsSkeleton count={3} />
@@ -140,10 +168,9 @@ function AccessComponent() {
         </>
       ) : session ? (
         <PanelCard contentClassName="py-4 text-sm text-muted-foreground">
-          Управление API-ключами доступно только роли <strong>operator</strong>. Текущая роль:{' '}
-          <span className="font-mono">{session.role}</span>. Для выдачи ключей войдите с
-          operator-ключом или создайте ключ через API / переменную{' '}
-          <code className="text-xs">EVOBGP_API_KEYS</code>.
+          Управление API-ключами доступно роли <strong>operator</strong> (API-ключ) или portal JWT
+          с <strong>is_admin</strong> / правом <code className="text-xs">bgp:access:admin</code>.
+          Текущий доступ: <span className="font-mono">{sessionAccessLabel}</span>.
         </PanelCard>
       ) : null}
     </div>

apps/web/src/routes/_auth/firewall.tsx

@@ -1,276 +0,0 @@
-import { createFileRoute } from '@tanstack/react-router'
-import { useQuery } from '@tanstack/react-query'
-import { Copy, Plus, RefreshCw, Shield } from 'lucide-react'
-import { useEffect, useMemo, useState } from 'react'
-import { toast } from 'sonner'
-
-import { Button } from '@evobgp/ui/components/button'
-import { PanelCard } from '@/components/panel-card'
-import { Input } from '@evobgp/ui/components/input'
-import { Label } from '@evobgp/ui/components/label'
-import { BadgeTabs, TabsContent } from '@/components/badge-tabs'
-import { DataGridCard } from '@/components/data-grid-shell'
-import { FirewallClientsGrid } from '@/components/firewall/firewall-clients-grid'
-import { FirewallRuleCreateDialog } from '@/components/firewall/firewall-rule-create-dialog'
-import { FirewallRulesGrid } from '@/components/firewall/firewall-rules-grid'
-import { PageHeader } from '@/components/page-header'
-import { QueryState } from '@/components/query-state'
-import { TableSkeleton } from '@/components/skeletons'
-import { directoriesCommunitiesQueryOptions } from '@/queries/directories'
-import {
-  firewallClientsQueryOptions,
-  firewallInstallContextQueryOptions,
-  firewallRulesQueryOptions,
-  useApproveFirewallClient,
-  useDeleteFirewallClient,
-  useDeleteFirewallRule,
-} from '@/queries/firewall'
-
-function httpsOrigin(origin: string): string {
-  try {
-    const u = new URL(origin)
-    u.protocol = 'https:'
-    return u.origin
-  } catch {
-    return origin.replace(/^http:/i, 'https:')
-  }
-}
-
-export const Route = createFileRoute('/_auth/firewall')({
-  component: FirewallPage,
-})
-
-function FirewallPage() {
-  const installCtxQ = useQuery(firewallInstallContextQueryOptions())
-  const communitiesQ = useQuery(directoriesCommunitiesQueryOptions())
-  const clientsQ = useQuery(firewallClientsQueryOptions())
-  const rulesQ = useQuery(firewallRulesQueryOptions('tenant'))
-  const approve = useApproveFirewallClient()
-  const deleteClient = useDeleteFirewallClient()
-  const deleteRule = useDeleteFirewallRule()
-
-  const installCtx = installCtxQ.data
-
-  const [clientName, setClientName] = useState('web-01')
-  const [cpUrl, setCpUrl] = useState(() =>
-    typeof window !== 'undefined' ? httpsOrigin(window.location.origin) : 'https://api.example.com',
-  )
-  const [seed, setSeed] = useState('')
-  const [createRuleOpen, setCreateRuleOpen] = useState(false)
-
-  useEffect(() => {
-    if (installCtx?.suggested_cp_url) {
-      setCpUrl(httpsOrigin(installCtx.suggested_cp_url))
-    }
-    if (installCtx?.bundle_seed) {
-      setSeed(installCtx.bundle_seed)
-    }
-  }, [installCtx?.bundle_seed, installCtx?.suggested_cp_url])
-
-  const communities = communitiesQ.data?.items ?? []
-
-  const { activeClients, pending } = useMemo(() => {
-    const all = clientsQ.data?.items ?? []
-    return {
-      activeClients: all.filter((c) => c.status !== 'revoked'),
-      pending: all.filter((c) => c.status === 'pending'),
-    }
-  }, [clientsQ.data?.items])
-  const rules = rulesQ.data?.items ?? []
-
-  const installCmd = useMemo(() => {
-    const s = seed.trim() || '<bundle_seed_hex>'
-    return `curl -fsSL ${cpUrl.replace(/\/$/, '')}/v1/firewall/install.sh | \\
-  EVOBGP_CP_URL=${cpUrl.replace(/\/$/, '')} \\
-  EVOBGP_SEED=${s} \\
-  EVOBGP_CLIENT_NAME="${clientName}" \\
-  bash`
-  }, [clientName, cpUrl, seed])
-
-  async function copyInstall() {
-    if (!seed.trim()) {
-      toast.error(
-        installCtx?.bundle_seed_configured === false
-          ? 'На CP не задан EVOBGP_BUNDLE_SEED_HEX'
-          : 'Seed бандла недоступен (нужна роль оператора)',
-      )
-      return
-    }
-    try {
-      await navigator.clipboard.writeText(installCmd)
-      toast.success('Команда скопирована')
-    } catch {
-      toast.error('Не удалось скопировать')
-    }
-  }
-
-  return (
-    <div className="flex flex-col gap-6">
-      <PageHeader
-        title="Файрвол: blocklist"
-        description="Linux-серверы: синхронизация CIDR по policy block/accept"
-        actions={
-          <Button
-            variant="outline"
-            size="sm"
-            onClick={() => {
-              void clientsQ.refetch()
-              void rulesQ.refetch()
-            }}
-            disabled={clientsQ.isFetching}
-          >
-            <RefreshCw className={clientsQ.isFetching ? 'animate-spin' : ''} />
-            Обновить
-          </Button>
-        }
-      />
-
-      <PanelCard
-        title={
-          <span className="flex items-center gap-2">
-            <Shield className="size-4" />
-            Установка на сервер
-          </span>
-        }
-        description="Команда для root на целевом Linux (bash, curl). После регистрации — одобрите клиента во вкладке «Запросы»."
-        contentClassName="flex flex-col gap-4 py-4"
-      >
-          <div className="grid gap-4 sm:grid-cols-3">
-            <div className="space-y-2">
-              <Label htmlFor="fw-name">Имя сервера</Label>
-              <Input id="fw-name" value={clientName} onChange={(e) => setClientName(e.target.value)} />
-            </div>
-            <div className="space-y-2">
-              <Label htmlFor="fw-url">URL API</Label>
-              <Input id="fw-url" value={cpUrl} onChange={(e) => setCpUrl(e.target.value)} />
-            </div>
-            <div className="space-y-2">
-              <Label htmlFor="fw-seed">Seed бандла</Label>
-              <Input
-                id="fw-seed"
-                type="password"
-                readOnly
-                placeholder="EVOBGP_BUNDLE_SEED_HEX"
-                value={seed}
-                className="font-mono text-xs"
-              />
-              <p className="text-muted-foreground text-xs">
-                {installCtxQ.isLoading
-                  ? 'Загрузка с плоскости управления…'
-                  : installCtx?.bundle_seed_configured
-                    ? 'Из переменной EVOBGP_BUNDLE_SEED_HEX на CP (docker compose / .env)'
-                    : 'На CP не задан EVOBGP_BUNDLE_SEED_HEX — регистрация невозможна'}
-              </p>
-            </div>
-          </div>
-          <pre className="overflow-x-auto rounded-md border bg-muted/40 p-3 text-xs">{installCmd}</pre>
-          <Button variant="outline" size="sm" className="w-fit" onClick={copyInstall}>
-            <Copy />
-            Копировать команду
-          </Button>
-        </PanelCard>
-
-      <BadgeTabs
-        defaultValue="clients"
-        items={[
-          { value: 'clients', label: 'Клиенты', count: activeClients.length },
-          { value: 'rules', label: 'Правила', count: rules.length, badgeVariant: 'info-light' },
-          {
-            value: 'requests',
-            label: 'Запросы',
-            count: pending.length,
-            badgeVariant: pending.length > 0 ? 'warning-light' : 'primary-light',
-          },
-        ]}
-      >
-        <TabsContent value="clients" className="mt-0">
-          <DataGridCard title="Клиенты" description="Активные Linux-серверы с синхронизацией списка блокировок">
-            <QueryState
-              data={clientsQ.data}
-              isLoading={clientsQ.isLoading}
-              isError={clientsQ.isError}
-              error={clientsQ.error}
-              onRetry={() => void clientsQ.refetch()}
-              skeleton={<TableSkeleton rows={5} cols={6} />}
-            >
-              {() => (
-                <FirewallClientsGrid
-                  clients={activeClients}
-                  isLoading={clientsQ.isFetching && !clientsQ.isLoading}
-                  onApprove={(id) => approve.mutate(id)}
-                  onReject={(id) => deleteClient.mutate(id)}
-                  approvePending={approve.isPending}
-                  rejectPending={deleteClient.isPending}
-                />
-              )}
-            </QueryState>
-          </DataGridCard>
-        </TabsContent>
-
-        <TabsContent value="rules" className="mt-0">
-          <DataGridCard
-            title="Правила"
-            actions={
-              <Button size="sm" type="button" onClick={() => setCreateRuleOpen(true)}>
-                <Plus />
-                Добавить правило
-              </Button>
-            }
-          >
-            <QueryState
-              data={rulesQ.data}
-              isLoading={rulesQ.isLoading}
-              isError={rulesQ.isError}
-              error={rulesQ.error}
-              onRetry={() => void rulesQ.refetch()}
-              skeleton={<TableSkeleton rows={5} cols={5} />}
-            >
-              {() => (
-                <FirewallRulesGrid
-                  rules={rules}
-                  communities={communities}
-                  isLoading={rulesQ.isFetching && !rulesQ.isLoading}
-                  onDelete={(id) => deleteRule.mutate(id)}
-                  deletePending={deleteRule.isPending}
-                />
-              )}
-            </QueryState>
-          </DataGridCard>
-          <FirewallRuleCreateDialog
-            open={createRuleOpen}
-            onOpenChange={setCreateRuleOpen}
-            communities={communities}
-          />
-        </TabsContent>
-
-        <TabsContent value="requests" className="mt-0">
-          <DataGridCard
-            title="Запросы"
-            description="Запросы на регистрацию — одобрите или отклоните новые клиенты"
-          >
-            <QueryState
-              data={clientsQ.data}
-              isLoading={clientsQ.isLoading}
-              isError={clientsQ.isError}
-              error={clientsQ.error}
-              onRetry={() => void clientsQ.refetch()}
-              skeleton={<TableSkeleton rows={3} cols={6} />}
-            >
-              {() => (
-                <FirewallClientsGrid
-                  clients={pending}
-                  isLoading={clientsQ.isFetching && !clientsQ.isLoading}
-                  onApprove={(id) => approve.mutate(id)}
-                  onReject={(id) => deleteClient.mutate(id)}
-                  approvePending={approve.isPending}
-                  rejectPending={deleteClient.isPending}
-                  emptyTitle="Нет ожидающих запросов"
-                />
-              )}
-            </QueryState>
-          </DataGridCard>
-        </TabsContent>
-      </BadgeTabs>
-    </div>
-  )
-}

apps/web/src/routes/auth.callback.tsx

@@ -0,0 +1,83 @@
+import { createFileRoute, redirect } from '@tanstack/react-router'
+
+import {
+  authPortalUrl,
+  clearPortalHandoffFlag,
+  clearPortalToken,
+  ensureAuthConfig,
+  firstAllowedPath,
+  getClaims,
+  getPortalToken,
+  parseHashToken,
+  redirectToPortalLogin,
+  setPortalToken,
+} from '@/lib/auth'
+
+/**
+ * SSO callback — reads `#access_token=…&expires_at=…` returned by auth-portal,
+ * stores the JWT, and drops the user on the first allowed page.
+ *
+ * If the hash is empty (direct visit / already logged in) the route re-runs the
+ * portal handshake; the cool-down guard prevents redirect storms.
+ */
+export const Route = createFileRoute('/auth/callback')({
+  validateSearch: (search: Record<string, unknown>) => ({
+    error: typeof search.error === 'string' ? search.error : undefined,
+  }),
+  beforeLoad: async ({ search }) => {
+    await ensureAuthConfig()
+
+    if (search.error === 'sso_loop') return
+
+    if (typeof window === 'undefined') return
+
+    const { accessToken } = parseHashToken(window.location.hash)
+    if (accessToken) {
+      setPortalToken(accessToken)
+      clearPortalHandoffFlag()
+      const claims = getClaims()
+      if (!claims) {
+        clearPortalToken()
+        window.location.assign(authPortalUrl())
+        await new Promise(() => {})
+        return
+      }
+      throw redirect({ to: firstAllowedPath() as '/dashboard' })
+    }
+
+    if (getPortalToken() && getClaims()) {
+      clearPortalHandoffFlag()
+      throw redirect({ to: firstAllowedPath() as '/dashboard' })
+    }
+
+    const ok = redirectToPortalLogin(`${window.location.origin}/auth/callback`)
+    if (!ok) {
+      throw redirect({
+        to: '/auth/callback',
+        search: { error: 'sso_loop' },
+      })
+    }
+    await new Promise(() => {})
+  },
+  component: AuthCallbackPage,
+})
+
+function AuthCallbackPage() {
+  const { error } = Route.useSearch()
+  if (error === 'sso_loop') {
+    return (
+      <div className="flex min-h-svh flex-col items-center justify-center gap-3 p-6 text-center">
+        <h1 className="text-lg font-semibold">Сессия не принята</h1>
+        <p className="text-muted-foreground max-w-md text-sm">
+          Повторный вход через auth-portal остановлен (защита от цикла редиректов).
+          Обычно это несовпадение JWT_SECRET / ISSUER или просроченный токен.
+          Войдите заново на portal, затем откройте EvoBGP.
+        </p>
+        <a className="text-primary text-sm underline" href={authPortalUrl()}>
+          Открыть Auth Portal
+        </a>
+      </div>
+    )
+  }
+  return null
+}

apps/web/src/types/api.ts

@@ -341,13 +341,20 @@ export type JobsResponse = Page<JobRow>
 export type AppSettings = Record<string, unknown>
 
 // ---- Auth / API keys ----
+export type ApiKeyRole = 'viewer' | 'editor' | 'operator' | 'node'
+
+/** GET /v1/auth/session — API key has role; portal JWT uses kind/permissions/is_admin. */
 export type AuthSession = {
   tenant_id: string
-  role: 'viewer' | 'editor' | 'operator' | 'node'
+  /** API-key role; empty for portal JWT sessions. */
+  role: ApiKeyRole | ''
+  kind?: 'apikey' | 'jwt'
+  user_id?: string
+  email?: string
+  permissions?: string[]
+  is_admin?: boolean
 }
 
-export type ApiKeyRole = AuthSession['role']
-
 export type ApiKey = {
   id: string
   name: string
@@ -375,41 +382,5 @@ export type AsyncJobAccepted = {
   job_id: string
 }
 
-// ---- Firewall blocklist ----
-export type FirewallClient = {
-  id: string
-  name: string
-  hostname?: string
-  token_prefix: string
-  status: 'pending' | 'approved' | 'revoked'
-  last_seen_at?: string | null
-  last_seen_at_source?: string
-  last_apply_at?: string | null
-  last_apply_status?: string
-  last_apply_prefix_count?: number
-  last_apply_packets_dropped?: number
-  last_apply_packets_accepted?: number
-  last_apply_source?: string
-  client_version?: string
-  created_at: string
-}
-
-export type FirewallClientsResponse = { items: FirewallClient[] }
-
-export type FirewallRule = {
-  id: string
-  client_id?: string | null
-  priority: number
-  action: 'block' | 'accept'
-  community_id?: string | null
-  comment?: string
-}
-
-export type FirewallRulesResponse = { items: FirewallRule[] }
-
-export type FirewallInstallContext = {
-  bundle_seed: string
-  bundle_seed_configured: boolean
-  suggested_cp_url: string
-  install_sh_url: string
-}
+// Firewall blocklist types removed — the firewall subsystem moved to the standalone
+// EvoFirewall service. See docs/firewall.md.

apps/web/src/vite-env.d.ts

@@ -2,6 +2,10 @@
 
 interface ImportMetaEnv {
   readonly VITE_APP_SWITCHER?: string
+  /** '1' | 'true' → require auth-portal JWT; иначе — локальный API-токен. */
+  readonly VITE_AUTH_ENABLED?: string
+  /** URL auth-portal (SSO). Пример: http://192.168.100.67:5175 или https://auth.shnt.top. */
+  readonly VITE_AUTH_PORTAL_URL?: string
 }
 
 interface ImportMeta {

cmd/evobgp-all/main.go

@@ -37,6 +37,12 @@ func main() {
 		BundleSeedHex:           strings.TrimSpace(os.Getenv("EVOBGP_BUNDLE_SEED_HEX")),
 		CORSAllowedOrigins:      strings.TrimSpace(os.Getenv("EVOBGP_CORS_ORIGINS")),
 		RuntimeLogsPolicyTenant: cfg.RuntimeLogsPolicyTenant,
+		JWTSecret:               firstNonEmpty(os.Getenv("EVOBGP_AUTH_JWT_SECRET"), os.Getenv("AUTH_JWT_SECRET")),
+		AuthIssuer:              firstNonEmpty(os.Getenv("EVOBGP_AUTH_ISSUER"), os.Getenv("AUTH_ISSUER")),
+		AuthPortalURL:           firstNonEmpty(os.Getenv("EVOBGP_AUTH_PORTAL_URL"), os.Getenv("AUTH_PORTAL_URL")),
+		PortalTenantID:          strings.TrimSpace(os.Getenv("EVOBGP_PORTAL_TENANT_ID")),
+		AuthRequired:            boolFromEnv("EVOBGP_AUTH_REQUIRED", "AUTH_REQUIRED"),
+		AuditIngestSecret:       firstNonEmpty(os.Getenv("EVOBGP_AUTH_AUDIT_INGEST_SECRET"), os.Getenv("AUTH_AUDIT_INGEST_SECRET")),
 	}
 	srv, err := httpapi.New(opts)
 	if err != nil {
@@ -86,6 +92,31 @@ func main() {
 	log.Printf("%s stopped", platform.ServiceName("evobgp-all"))
 }
 
+func firstNonEmpty(candidates ...string) string {
+	for _, c := range candidates {
+		if v := strings.TrimSpace(c); v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+func boolFromEnv(keys ...string) bool {
+	for _, k := range keys {
+		v := strings.TrimSpace(os.Getenv(k))
+		if v == "" {
+			continue
+		}
+		switch strings.ToLower(v) {
+		case "1", "true", "yes", "on":
+			return true
+		case "0", "false", "no", "off":
+			return false
+		}
+	}
+	return false
+}
+
 func startBirdMetricsPoller(ctx context.Context) {
 	sock := strings.TrimSpace(os.Getenv("EVOBGP_BIRDC_SOCKET"))
 	if sock == "" {

cmd/evobgp-api/main.go

@@ -32,6 +32,12 @@ func main() {
 		SeedDemo:           seedDemo,
 		BundleSeedHex:      strings.TrimSpace(os.Getenv("EVOBGP_BUNDLE_SEED_HEX")),
 		CORSAllowedOrigins: strings.TrimSpace(os.Getenv("EVOBGP_CORS_ORIGINS")),
+		JWTSecret:          firstNonEmpty(os.Getenv("EVOBGP_AUTH_JWT_SECRET"), os.Getenv("AUTH_JWT_SECRET")),
+		AuthIssuer:         firstNonEmpty(os.Getenv("EVOBGP_AUTH_ISSUER"), os.Getenv("AUTH_ISSUER")),
+		AuthPortalURL:      firstNonEmpty(os.Getenv("EVOBGP_AUTH_PORTAL_URL"), os.Getenv("AUTH_PORTAL_URL")),
+		PortalTenantID:     strings.TrimSpace(os.Getenv("EVOBGP_PORTAL_TENANT_ID")),
+		AuthRequired:       boolFromEnv("EVOBGP_AUTH_REQUIRED", "AUTH_REQUIRED"),
+		AuditIngestSecret:  firstNonEmpty(os.Getenv("EVOBGP_AUTH_AUDIT_INGEST_SECRET"), os.Getenv("AUTH_AUDIT_INGEST_SECRET")),
 	}
 	srv, err := httpapi.New(opts)
 	if err != nil {
@@ -78,6 +84,31 @@ func main() {
 	log.Printf("%s stopped", platform.ServiceName("evobgp-api"))
 }
 
+func firstNonEmpty(candidates ...string) string {
+	for _, c := range candidates {
+		if v := strings.TrimSpace(c); v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+func boolFromEnv(keys ...string) bool {
+	for _, k := range keys {
+		v := strings.TrimSpace(os.Getenv(k))
+		if v == "" {
+			continue
+		}
+		switch strings.ToLower(v) {
+		case "1", "true", "yes", "on":
+			return true
+		case "0", "false", "no", "off":
+			return false
+		}
+	}
+	return false
+}
+
 func startBirdMetricsPoller(ctx context.Context) {
 	sock := strings.TrimSpace(os.Getenv("EVOBGP_BIRDC_SOCKET"))
 	if sock == "" {

deploy/compose/.env.production.example

@@ -15,3 +15,10 @@ WEBUI_DOMAIN=bgp.example.com
 WEBUI_IP_WHITELIST=203.0.113.10/32
 LETSENCRYPT_EMAIL=admin@example.com
 CF_DNS_API_TOKEN=
+
+# Auth-portal SSO → контейнер evobgp-all (не VITE_* — они только для build web)
+AUTH_REQUIRED=true
+AUTH_JWT_SECRET=
+AUTH_ISSUER=https://auth.shnt.top
+AUTH_PORTAL_URL=https://auth.shnt.top
+EVOBGP_PORTAL_TENANT_ID=

deploy/compose/.env.stack.microvps-full.example

@@ -27,3 +27,16 @@ AUTO_UPDATE_INTERVAL_SEC=300
 AUTO_UPDATE_SERVICES=evobgp-all,evobgp-web
 # Защищенные сервисы, которые updater никогда не перезапускает
 AUTO_UPDATE_PROTECTED_SERVICES=bird2
+
+# ---------------------------------------------------------------------------
+# Auth-portal SSO (прокидывается в контейнер evobgp-all)
+# VITE_* в runtime .env НЕ влияют на уже собранный web-образ —
+# UI читает GET /v1/auth/config с API (AUTH_REQUIRED / AUTH_PORTAL_URL).
+# ---------------------------------------------------------------------------
+AUTH_REQUIRED=true
+AUTH_JWT_SECRET=
+AUTH_ISSUER=https://auth.shnt.top
+AUTH_PORTAL_URL=https://auth.shnt.top
+# UUID tenant из БД (обязателен для JWT). При EVOBGP_SEED_DEMO=1 смотрите лог
+# старта evobgp-all / SELECT id FROM tenant LIMIT 1;
+EVOBGP_PORTAL_TENANT_ID=

deploy/compose/docker-compose.production.example.yaml

@@ -136,6 +136,11 @@ services:
       EVOBGP_BIRD_STAGING_DIR: /tmp/evobgp-bird-staging
       EVOBGP_SERVICE: evobgp-all
       EVOBGP_RUNTIME_LOGS_DIR: /opt/evobgp/runtime-logs
+      AUTH_REQUIRED: ${AUTH_REQUIRED:-false}
+      AUTH_JWT_SECRET: ${AUTH_JWT_SECRET:-}
+      AUTH_ISSUER: ${AUTH_ISSUER:-https://auth.shnt.top}
+      AUTH_PORTAL_URL: ${AUTH_PORTAL_URL:-}
+      EVOBGP_PORTAL_TENANT_ID: ${EVOBGP_PORTAL_TENANT_ID:-}
       EVOBGP_DEV_INSECURE: "1"
     volumes:
       - bird_etc:/etc/bird

deploy/compose/stack.microvps-full.yaml

@@ -138,6 +138,12 @@ services:
       EVOBGP_BIRD_STAGING_DIR: /tmp/evobgp-bird-staging
       EVOBGP_SERVICE: evobgp-all
       EVOBGP_RUNTIME_LOGS_DIR: /opt/evobgp/runtime-logs
+      # Portal SSO (JWT) — см. docs/access.md / auth-portal integrate-evobgp.md
+      AUTH_REQUIRED: ${AUTH_REQUIRED:-false}
+      AUTH_JWT_SECRET: ${AUTH_JWT_SECRET:-}
+      AUTH_ISSUER: ${AUTH_ISSUER:-https://auth.shnt.top}
+      AUTH_PORTAL_URL: ${AUTH_PORTAL_URL:-}
+      EVOBGP_PORTAL_TENANT_ID: ${EVOBGP_PORTAL_TENANT_ID:-}
       # DEV ONLY — не для production (см. docs/access.md).
       EVOBGP_DEV_INSECURE: "1"
     volumes:

docs/access.md

@@ -2,6 +2,41 @@
 
 Как выдавать доступ к control plane API, веб-клиентам и репликам BIRD (`evobgp-node`). Секреты храните в менеджере секретов, переменных окружения оркестратора или зашифрованных файлах — не коммитьте реальные ключи в Git.
 
+## Portal SSO (JWT)
+
+Единый вход через **auth-portal** (app id `bgp`). См. [integrate-evobgp.md](https://git.shts.su/denozord/auth-portal/src/branch/main/docs/integrate-evobgp.md) в репозитории auth-portal.
+
+| Переменная | Назначение |
+|------------|------------|
+| `AUTH_REQUIRED` / `EVOBGP_AUTH_REQUIRED` | Включить проверку portal JWT для UI |
+| `AUTH_JWT_SECRET` / `EVOBGP_AUTH_JWT_SECRET` | Тот же секрет, что `JWT_SECRET` портала (HS256) |
+| `AUTH_ISSUER` | Issuer JWT (как на портале) |
+| `AUTH_PORTAL_URL` | URL портала (также `GET /v1/auth/config`) |
+| `AUTH_AUDIT_INGEST_SECRET` / `EVOBGP_AUTH_AUDIT_INGEST_SECRET` | Shared secret для push CRUD audit в auth-portal (`POST /api/v1/ingest/audit`, `source_app=bgp`) |
+| `EVOBGP_PORTAL_TENANT_ID` | Fallback tenant для portal JWT, если в токене нет `bgp_tenant_id` / `tenants.bgp` |
+
+Источник tenant (по приоритету):
+
+1. JWT claim `tenants.bgp` или `bgp_tenant_id` (задаётся в auth-portal → **Админ → Приложения** → поле «EvoBGP tenant ID»)
+2. Env `EVOBGP_PORTAL_TENANT_ID`
+
+Compose: переменные `AUTH_*` / `EVOBGP_PORTAL_TENANT_ID` должны быть в `environment:` сервиса **`evobgp-all`** (см. `deploy/compose/stack.microvps-full.yaml`). Просто положить их в `.env` без проброса в контейнер недостаточно.
+
+`VITE_AUTH_*` в runtime `.env` **не** меняют уже собранный `evobgp-web` образ. UI берёт режим из `GET /v1/auth/config` (`required` ← `AUTH_REQUIRED`, `portal_url` ← `AUTH_PORTAL_URL`).
+
+Проверка после рестарта:
+
+```bash
+curl -sS https://bgp.shnt.top/v1/auth/config
+# {"required":true,"portal_url":"https://auth.shnt.top"}
+```
+
+Права — строки `bgp:<section>:<action>` из каталога портала (dashboard, modules, lookup, network, …). Apply/rollback требуют `bgp:operations:admin`.
+
+**Ownership:** modules, peers, firewall clients/rules с `created_by_user_id` видны создателю и portal `is_admin` (API keys — весь tenant).
+
+UI: `VITE_AUTH_ENABLED`, `VITE_AUTH_PORTAL_URL`. App Switcher: `CURRENT_APP_ID=bgp`, конфиг с `GET {portal}/api/v1/app-switcher`.
+
 ## API-ключи (`EVOBGP_API_KEYS`)
 
 Формат переменной окружения: список записей через **запятую** без пробелов внутри логики парсера (пробелы вокруг записей допускаются при обрезке). Каждая запись:
@@ -26,14 +61,18 @@ opkey|01ARZ3NDEKTSV4RRFFQ69G5FAV|operator,nodekey|01ARZ3NDEKTSV4RRFFQ69G5FAV|nod
 
 ### Управление через API и UI
 
-При подключённой БД operator может:
+При подключённой БД управлять ключами может:
 
-- `GET|POST /v1/api-keys`, `GET|PATCH|DELETE /v1/api-keys/{id}`, `POST /v1/api-keys/{id}/rotate` — см. OpenAPI, тег **API keys**.
-- В веб-панели: **Права доступа** (`/access`) → блок «API-ключи» (только для роли `operator`). Токен для браузера — в **Настройки** (`/settings`).
+- API-ключ с ролью **`operator`**, или
+- portal JWT с **`is_admin`** / правом **`bgp:access:admin`** (админ auth-portal).
+
+Эндпоинты: `GET|POST /v1/api-keys`, `GET|PATCH|DELETE /v1/api-keys/{id}`, `POST /v1/api-keys/{id}/rotate` — см. OpenAPI, тег **API keys**.
+
+В веб-панели: **Права доступа** (`/access`) → блок «API-ключи». Токен для браузера (API-key gate) — в **Настройки** (`/settings`).
 
 Полный токен возвращается **один раз** в ответе `201` (создание) и `200` (ротация). В списках — только `prefix` (первые 8 символов). В БД хранится SHA-256 токена, не plaintext.
 
-`GET /v1/auth/session` — текущие `tenant_id` и `role` (для UI).
+`GET /v1/auth/session` — `tenant_id`, `kind` (`apikey`|`jwt`), для API-ключа — `role`; для JWT — `user_id`, `email`, `permissions`, `is_admin`.
 
 ### Роли
 
@@ -144,13 +183,13 @@ http://localhost:5173,http://127.0.0.1:5173,https://ui.example.com
 
 ## Краткая матрица (ориентир)
 
-| Действие | viewer | editor | operator | node |
-|----------|--------|--------|----------|------|
-| GET модули, ревизии, peers, speakers | да | да | да | нет |
-| POST/PATCH/DELETE CRUD сущностей | нет | да | да | нет |
-| apply, rollback, PATCH settings | нет | нет | да | нет |
-| Управление API-ключами (`/v1/api-keys`) | нет | нет | да | нет |
-| bundle, latest revision, enroll | нет | нет | нет | да |
+| Действие | viewer | editor | operator | node | portal admin / `bgp:access:admin` |
+|----------|--------|--------|----------|------|-----------------------------------|
+| GET модули, ревизии, peers, speakers | да | да | да | нет | по permissions |
+| POST/PATCH/DELETE CRUD сущностей | нет | да | да | нет | по permissions |
+| apply, rollback, PATCH settings | нет | нет | да | нет | `bgp:operations:admin` |
+| Управление API-ключами (`/v1/api-keys`) | нет | нет | да | нет | да |
+| bundle, latest revision, enroll | нет | нет | нет | да | нет |
 
 Точные проверки по каждому маршруту — в коде `internal/httpapi` и в схеме безопасности операций в OpenAPI.
 

docs/api.md

@@ -116,6 +116,16 @@
 
 `{filename}` — только basename, паттерн `^[a-z0-9][a-z0-9_.-]*\.log$`. Очистка пишет строку в таблицу `runtime_log_cleanup_audit` (миграция `000026`).
 
+## CRUD audit (`/v1/audit`)
+
+Локальный журнал изменений CRUD (modules, peers, settings, API keys, …). Миграция `000030_audit_log`. Чтение — `bgp:monitoring:read` (viewer+).
+
+| Метод | Путь | Роль | Назначение |
+|-------|------|------|------------|
+| `GET` | `/v1/audit` | viewer+ | Пагинированный audit (`cursor`, `limit`, опционально `action`, `severity`) |
+
+При `AUTH_PORTAL_URL` + `AUTH_AUDIT_INGEST_SECRET` каждая запись дополнительно отправляется в auth-portal (`POST /api/v1/ingest/audit`, `source_app=bgp`).
+
 ## Соглашения из OpenAPI
 
 - Ошибки в стиле **RFC 9457** (`application/problem+json`): `type`, `title`, `status`, `detail`, и т.д.

docs/firewall.md

@@ -1,52 +1,15 @@
-# Firewall blocklist
+# Firewall (deprecated in EvoBGP)
 
-Подсистема синхронизации blocklist на произвольные Linux-серверы через bash-скрипт и HTTP API.
+**Hard cutover:** подсистема firewall перенесена в отдельный продукт **[EvoFirewall](https://git.shts.su/denozord/EvoFirewall)**.
 
-## Авторизация
+Все HTTP-эндпоинты `/v1/firewall/*` в EvoBGP отвечают **410 Gone**.
 
-1. **Enroll** — `POST /v1/firewall/enroll` с заголовком `X-EvoBGP-Seed` (значение `EVOBGP_BUNDLE_SEED_HEX` на CP). Клиент генерирует токен `evobgp_fw_*` локально.
-2. **Approve** — operator в Web UI (`/firewall` → Запросы).
-3. **Sync** — `GET /v1/firewall/blocklist` с `Authorization: Bearer <client_token>`.
+Таблицы `firewall_client` / `firewall_rule` в БД оставлены (не удаляются миграциями) для истории; API/UI/scripts больше не обслуживают их.
 
-## Политика block/accept
+## Миграция клиентов
 
-- **`block`** — добавить префиксы выбранного BGP community в kernel blocklist.
-- **`accept`** — не блокировать префиксы этого community.
-- **Community** — правило применяется к префиксам с этим `community_id` в опубликованной revision; пустое значение («Все») — ко всем communities.
-- **Default** — accept (пустой blocklist без явных `block`).
+1. Разверните EvoFirewall (auth-portal app id `fw`).
+2. Переустановите агенты one-liner'ом EvoFirewall (`/v1/agent/install.sh`).
+3. Для списков по community создайте IP list type `evobgp_community` и укажите `EVOBGP_API_URL` + token в настройках EvoFirewall.
 
-Порядок: сначала per-server overrides клиента, затем tenant-default. Для каждого community берётся первое подходящее правило по приоритету.
-
-Справочник communities: Web UI → Справочники, или модули с привязкой community к префиксам.
-
-## Установка на сервер
-
-Публичные URL (без API-ключа, вне `WEBUI_IP_WHITELIST` Traefik): `GET /v1/firewall/install.sh`, `GET /v1/firewall/sync-script`, `POST /v1/firewall/enroll`. Всегда **HTTPS**.
-
-Требуется миграция **`000027_firewall`** в PostgreSQL (применяется при старте API с актуальным бинарём). Если enroll отвечает `503` / `database schema outdated` — перезапустите `evobgp-api` / `evobgp-all` после деплоя новой версии.
-
-```bash
-curl -fsSL https://<api>/v1/firewall/install.sh | \
-  EVOBGP_CP_URL=https://<api> \
-  EVOBGP_SEED=<bundle_seed_hex> \
-  EVOBGP_CLIENT_NAME="web-01" \
-  bash
-```
-
-Файлы: `/etc/evobgp/firewall.conf`, `/usr/local/sbin/evobgp-firewall.sh`, systemd timer `evobgp-firewall.timer`.
-
-После **approve** в UI выполните на сервере (или дождитесь timer):
-
-```bash
-sudo rm -f /var/lib/evobgp-firewall/last_hash
-sudo /usr/local/sbin/evobgp-firewall.sh
-sudo nft list table inet evobgp_blocklist
-```
-
-Для парсинга JSON нужен `jq` или `python3` (install.sh ставит `jq` на Debian/Ubuntu при отсутствии).
-
-## Failover через speaker
-
-При `EVOBGP_FIREWALL_FAILOVER_ENABLED=1` на speaker-agent CP реплицирует состояние через `POST /v1/agent/firewall-replicate`. Клиенты используют тот же DNS-домен.
-
-См. также [access.md](access.md), [remote-speakers.md](remote-speakers.md).
+Старые токены `evobgp_fw_*` **не** переносятся — только re-enroll.

docs/openapi.yaml

@@ -11,9 +11,15 @@ info:
     Ошибки - `application/problem+json` ([RFC 9457](https://www.rfc-editor.org/rfc/rfc9457)).
     Пагинация списков - `cursor` + `limit`; ответ содержит `items`, `next_cursor`, `has_more`.
 
-    **Роли** (матрица доступа): `viewer`, `editor`, `operator`, `node`. Нода использует отдельные пути и ключ с ролью `node`.
+    **Аутентификация (dual):**
+    - **API key** — `Authorization: Bearer <token>` из `EVOBGP_API_KEYS` / таблицы `api_key` (роли `viewer`/`editor`/`operator`/`node`/`firewall`).
+    - **Portal JWT** — HS256 от auth-portal; claim `apps` должен содержать `bgp`; права `bgp:<section>:<action>`; tenant из `tenants.bgp` / `bgp_tenant_id` или fallback `EVOBGP_PORTAL_TENANT_ID`.
+    Публично: `GET /v1/auth/config` → `{ required, portal_url }`.
 
-    Заголовок `X-Tenant-Id` допускается только для супер-ролей (явный tenant); иначе tenant берётся из API-ключа.
+    **Роли API key** (матрица): `viewer`, `editor`, `operator`, `node`. Нода использует отдельные пути и ключ с ролью `node`.
+    JWT permissions мапятся на ту же лестницу (`:read`→viewer, `:write`→editor, `:admin`→operator).
+
+    Заголовок `X-Tenant-Id` допускается только для супер-ролей (явный tenant); иначе tenant берётся из API-ключа / portal tenant env.
   license:
     name: Proprietary
     identifier: LicenseRef-Proprietary
@@ -53,6 +59,8 @@ tags:
     description: Сессия текущего API-ключа (tenant и роль).
   - name: Monitoring
     description: Наблюдаемость PostgreSQL и корреляция (instance-level, viewer+). Maintenance — operator.
+  - name: Audit
+    description: Журнал CRUD-изменений tenant (локально + опциональный push в auth-portal). Чтение — bgp:monitoring:read.
   - name: Maintenance
     description: Политики обслуживания PostgreSQL (instance-scoped). CRUD и запуск — operator.
   - name: RuntimeLogs
@@ -670,13 +678,32 @@ components:
 
     AuthSession:
       type: object
-      required: [tenant_id, role]
+      required: [tenant_id, kind]
       properties:
         tenant_id:
           $ref: "#/components/schemas/ResourceId"
+        kind:
+          type: string
+          enum: [apikey, jwt]
+          description: apikey — Bearer API key; jwt — portal SSO token.
         role:
           type: string
-          enum: [viewer, editor, operator, node]
+          description: >
+            API-key role (viewer|editor|operator|node). Empty string for portal JWT sessions.
+        user_id:
+          type: string
+          description: JWT sub (portal sessions only).
+        email:
+          type: string
+          description: JWT email claim (portal sessions only).
+        permissions:
+          type: array
+          items:
+            type: string
+          description: JWT permissions (bgp:*); portal sessions only.
+        is_admin:
+          type: boolean
+          description: Portal is_admin claim; grants all bgp permissions.
 
     ApiKey:
       type: object
@@ -1272,6 +1299,70 @@ components:
         has_more:
           type: boolean
 
+    AuditSeverity:
+      type: string
+      enum: [info, warning, critical]
+
+    AuditLogEntry:
+      type: object
+      required:
+        [id, tenant_id, event_id, source_app, action, severity, summary, created_at]
+      properties:
+        id:
+          $ref: "#/components/schemas/ResourceId"
+        tenant_id:
+          $ref: "#/components/schemas/ResourceId"
+        event_id:
+          type: string
+          description: Stable id for portal ingest deduplication (prefix bgp-).
+        source_app:
+          type: string
+          enum: [bgp]
+        action:
+          type: string
+          description: Machine action key (e.g. bgp.module.create).
+        severity:
+          $ref: "#/components/schemas/AuditSeverity"
+        actor_user_id:
+          type: ["string", "null"]
+        actor_email:
+          type: ["string", "null"]
+        actor_name:
+          type: ["string", "null"]
+        actor_api_key_prefix:
+          type: ["string", "null"]
+        target_type:
+          type: ["string", "null"]
+          enum: [app_resource, null]
+        target_id:
+          type: ["string", "null"]
+        summary:
+          type: string
+        details:
+          type: ["object", "null"]
+          additionalProperties: true
+        ip:
+          type: ["string", "null"]
+        created_at:
+          type: string
+          format: date-time
+        portal_pushed_at:
+          type: ["string", "null"]
+          format: date-time
+
+    AuditLogList:
+      type: object
+      required: [items]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/AuditLogEntry"
+        next_cursor:
+          type: string
+        has_more:
+          type: boolean
+
     RuntimeLogAutoPolicy:
       type: object
       properties:
@@ -4495,6 +4586,40 @@ paths:
         default:
           $ref: "#/components/responses/DefaultProblem"
 
+  /v1/audit:
+    get:
+      tags: [Audit]
+      summary: Журнал CRUD audit tenant
+      description: |
+        Локальный журнал изменений (modules, peers, settings, API keys и т.д.).
+        При настроенных `AUTH_PORTAL_URL` + `AUTH_AUDIT_INGEST_SECRET` события также
+        отправляются в auth-portal ingest (`source_app=bgp`).
+      operationId: listAuditLog
+      parameters:
+        - $ref: "#/components/parameters/TenantId"
+        - $ref: "#/components/parameters/Cursor"
+        - $ref: "#/components/parameters/Limit"
+        - name: action
+          in: query
+          schema:
+            type: string
+          description: Filter by action prefix/key (exact match).
+        - name: severity
+          in: query
+          schema:
+            $ref: "#/components/schemas/AuditSeverity"
+      responses:
+        "200":
+          description: Успешно.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AuditLogList"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
   /v1/settings:
     get:
       tags: [Settings]

docs/ui-design-contract.md

@@ -1,100 +1,119 @@
 # UI Design Contract (ops apps)
 
-Единый контракт для vps-tracker, CFDM и EvoBGP. Surface: **ReUI Frame**. Kit API: `apps/web/src/components/reui-kit/`.
+Единый контракт для **CFDM · vps-tracker · EvoBGP · EvoFirewall · auth-portal**.  
+Surface: **ReUI Frame**. Kit: `apps/web/src/components/reui-kit/`.  
+Иерархия: **ReUI PRO > shadcn primitives**.
 
-Карта: [llms.txt](https://reui.io/llms.txt) · [Styling](https://reui.io/docs/styling) · [License](https://reui.io/docs/license-setup) · [Blocks](https://reui.io/blocks)
+Карта: [llms.txt](https://reui.io/llms.txt) · [Styling](https://reui.io/docs/styling) · [License](https://reui.io/docs/license-setup) · [Blocks](https://reui.io/blocks) · [MCP](https://reui.io/docs/mcp)
 
 ## Surface
 
+Project lock: **`surface: frame`**. Ops / list / dashboard / detail / settings — только **Frame**, не shadcn Card как shell. Не смешивать Card и Frame на одном ops-экране.
+
 ```ts
-// apps/web/src/lib/ui-surface.ts
+// apps/web/src/lib/ui-surface.ts (где есть)
 export const UI_SURFACE = 'frame' as const
 ```
 
-Ops / list / dashboard / detail / settings — только **Frame**, не shadcn Card как shell. Не смешивать Card и Frame на одном ops-экране.
+Settings: секции через Frame + `gap` (без hairline `Separator` под PageHeader); `SettingRow` без `FieldSeparator` по умолчанию (`separated` opt-in). Preview: [settings-3](https://reui.io/preview/base/settings-3) · [settings-16](https://reui.io/preview/base/settings-16).
 
 ## Canonical PRO references
 
 | Зона | Block | Preview |
 |------|-------|---------|
 | Shell | `app-shell-12` (+ cmdk/monitor где нужно) | https://reui.io/preview/base/app-shell-12 · https://reui.io/preview/base/app-shell-7 |
-| KPI | horizontal compact hybrid (icon left + label/Badge + value ± variant; EvoBGP visual) | https://reui.io/preview/base/stats-12 |
+| KPI | horizontal compact hybrid (EvoBGP SoT: icon left + label/Badge + value ± variant) | https://reui.io/preview/base/stats-12 |
+| Quick Actions | Frame tiles (sibling KPI) + Badge «Перейти» | https://reui.io/preview/base/stats-12 · https://reui.io/preview/base/card-12 |
 | Dashboard | `dashboard-1` | https://reui.io/preview/base/dashboard-1 |
 | Lists | `data-grid-filtering-2` | https://reui.io/preview/base/data-grid-filtering-2 |
-| Settings | `settings-16` + SettingRow (`settings-7`) | https://reui.io/preview/base/settings-16 · https://reui.io/preview/base/settings-7 |
+| Settings | `settings-16` + SettingRow | https://reui.io/preview/base/settings-16 |
 | Auth | `auth-13` | https://reui.io/preview/base/auth-13 |
 | Empty | `empty-state-12` | https://reui.io/preview/base/empty-state-12 |
 | Forms | `form-7` → Sheet/Drawer | https://reui.io/preview/base/form-7 |
-| Lookup | `/lookup` — Frame form + `KpiStatGrid` + DataGrid | https://reui.io/preview/base/form-7 · https://reui.io/preview/base/stats-12 · https://reui.io/preview/base/data-grid-filtering-2 · https://reui.io/preview/base/empty-state-2 |
 
 ## Kit API (`reui-kit/`)
 
 | Component | Role |
 |-----------|------|
 | `ResourcePage` | Frame + line tabs + Filters + DataGrid |
-| `KpiStatGrid` | horizontal compact hybrid KPI tiles (`variant`, Badge) |
-| `QuickActionGrid` | KPI-like quick action tiles under KPI (gated by `ui_show_quick_actions`) |
-| `OpsDashboard` | KPI + charts + attention queue |
+| `KpiStatGrid` | EvoBGP hybrid KPI tiles (`items`/`cards`, `variant`, Badge) |
+| `QuickActionGrid` | KPI-like quick action tiles (gated by `showQuickActions`) |
+| `OpsDashboard` | KPI + optional `afterKpi` + charts + attention queue |
 | `SettingsShell` | settings nav + Outlet |
 | `DetailPanel` | detail Frame sections |
 | `filter-utils` | apply/clear ReUI Filters |
 
+`KpiStatGrid` / `QuickActionGrid` markup — SoT **EvoBGP**; в остальных apps diff только `@scope/ui` imports.
+
 ## Dashboard layout
 
 | App | Section order |
 |-----|---------------|
-| EvoBGP / CFDM | KPI → **QuickActionGrid** → charts / rest |
+| EvoBGP / CFDM / EvoFirewall | KPI → **QuickActionGrid** → charts / rest |
 | vps-tracker | banner → KPI → charts → attention → **QuickActionGrid** → CSV |
+| auth-portal | portal-specific; Quick Actions при наличии dashboard |
 
-Gating: KV `ui_show_quick_actions` in `global_settings` via `PATCH /v1/settings` (default `true`).
+Gating: DB `show_quick_actions` / `showQuickActions` / `ui_show_quick_actions` (default `true`).
 
 ## Shared App Shell chrome
 
-Эталон: **EvoBGP** production [`apps/web/src/components/layout/app-shell.tsx`](../apps/web/src/components/layout/app-shell.tsx) + ReUI [app-shell-12](https://reui.io/preview/base/app-shell-12).
-
-При переключении между vps-tracker / CFDM / EvoBGP меняются **только** sidebar nav labels/hrefs и `main` content. Разметка, ширина, фон и hover chrome идентичны.
+Эталон разметки: production apps + ReUI [app-shell-12](https://reui.io/preview/base/app-shell-12).  
+При переключении между apps меняются **только** sidebar nav labels/hrefs и `main` content.
 
 | Токен / зона | Значение |
 |--------------|----------|
-| `SIDEBAR_WIDTH` / `--sidebar-width` | `240px` (в `packages/ui` sidebar + Provider style) |
-| Sidebar / hover colors | theme `--sidebar` / `--sidebar-accent` из `globals.css` — **без** AppShell `color-mix` override |
+| `SIDEBAR_WIDTH` / `--sidebar-width` | `240px` |
+| Sidebar / hover colors | theme `--sidebar` / `--sidebar-accent` — **без** AppShell `color-mix` override |
 | Header | `h-12`, `sticky`, `border-b`, `px-4 md:px-6` |
 | Header left | `SidebarTrigger` + `Separator` + Breadcrumb |
-| Header right | **AppsMenu** → **SystemMonitorPopover** → **ModeToggle** (без Search в chrome) |
-| Sidebar | AppSwitcher → groups (`SidebarGroupContent`) → icons `size-4` → **пустой** `SidebarFooter` |
+| Header right | **AppsMenu** → **SystemMonitorPopover** (тема — в NavUser) |
+| Sidebar | AppSwitcher → groups → icons `size-4` → **NavUser** в `SidebarFooter` |
 | `main` | `gap-4 md:gap-6`, `px-4 py-4 md:px-6 md:py-5` |
 | Search | hotkey ⌘K / Ctrl+K only (не кнопка в header) |
 
-Запрещено в chrome: `SidebarRail`, `NavUser` footer, sync-row footer, Search/Ctrl+K pill в header, issues Badge в header, muted/hover cascade на right-cluster, Provider `color-mix` для `--sidebar*`.
+Запрещено в chrome: `SidebarRail`, sync-row footer, Search pill в header, issues Badge в header, `ModeToggle` в header (тема только в NavUser), Provider `color-mix` для `--sidebar*`.
 
-App Switcher ids: `vps-tracker` · `cfdm` · `evobgp`. Override: `VITE_APP_SWITCHER` JSON.
+NavUser (footer): avatar + name/email; dropdown — Настройки / Тема (segmented) / Выйти. Preview: [app-shell-1](https://reui.io/preview/base/app-shell-1).
 
-QuickActionGrid icons: только semantic **text** (`text-info` / `text-primary` / …) на kit `bg-muted` — без solid `bg-primary` fills. Preview: [stats-12](https://reui.io/preview/base/stats-12).
+App Switcher: auth-portal `GET /api/v1/app-switcher`. Ids: `cfdm` · `vps` · `bgp` · `fw`. Admin: portal `/admin/apps`.
+
+QuickActionGrid / KPI icons: только semantic **text** (`text-info` / `text-primary` / …) на kit `bg-muted` — без solid fills.
 
 ## System monitor
 
-`SystemMonitorPopover` in app-shell header next to `ModeToggle` (после AppsMenu). Preview: https://reui.io/preview/base/app-shell-12 · https://reui.io/preview/base/app-shell-7
+`SystemMonitorPopover` in header after AppsMenu. Preview: https://reui.io/preview/base/app-shell-12 · https://reui.io/preview/base/app-shell-7
 
 ## MCP workflow
 
-1. MCP `user-reui` — `search` / `get_block` / `get_component` with `surface: "frame"`
+1. MCP `user-reui` — `search` / `get_block` / `compose_page` / `get_component` with `surface: "frame"`
 2. Cite `previewUrl` + `docsUrl`
 3. CLI from `apps/web`: `pnpm dlx shadcn@latest add @reui/...`
-4. Adapt into kit — do not hand-roll KPI/grid/settings rows
+4. Adapt into kit — do not hand-roll KPI / Quick Actions / grid / settings rows
 5. `validate_usage` / `get_audit_checklist`
 
-Primitives: MCP `plugin-shadcn-shadcn` + `@evobgp/ui`.
+Primitives: MCP `plugin-shadcn-shadcn` + project `@scope/ui` (`@cfdm/ui` / `@evobgp/ui` / `@evofw/ui` / `@authportal/ui`).
+
+## License
+
+```env
+# apps/web/.env.local (gitignored)
+REUI_LICENSE_KEY=
+```
+
+`apps/web/components.json` → `@reui` с `Authorization: Bearer ${REUI_LICENSE_KEY}`.
 
 ## Spacing
 
-- AppShell main: `gap-4 md:gap-6`, `px-4 py-4 md:px-6 md:py-5` (shared chrome)
+- AppShell main / PageShell: `gap-4 md:gap-6`, `px-4 py-4 md:px-6 md:py-5`
 - No `space-y-*` / `space-x-*` — use `flex` + `gap-*`
 - Max 1 primary CTA per screen
-- Semantic tokens only (`variant="success"|"info"|"warning"`) — no raw `bg-emerald-*`
+- Semantic tokens only — no raw `bg-emerald-*`
 
 ## Forbidden
 
 - Card as ops list/dashboard shell
-- Hand-rolled data tables when ReUI DataGrid exists
-- Hand-rolled KPI grids when `KpiStatGrid` exists
+- Hand-rolled data tables when ReUI DataGrid / `ResourcePage` exists
+- Hand-rolled KPI when `KpiStatGrid` exists
+- Hand-rolled Quick Actions when `QuickActionGrid` exists
+- SectionCards / DataGridCard as design эталон
 - Mixing Card and Frame surfaces on one ops screen

go.mod

@@ -14,6 +14,7 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect

go.sum

@@ -7,6 +7,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd h1:gbpYu9NMq8jhDVbvlGkMFWCjLFlqqEZjEmObmhUy6Vo=

internal/audit/portal.go

@@ -0,0 +1,118 @@
+// Package audit pushes local audit events to auth-portal ingest API.
+package audit
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"evobgp/internal/httpclient"
+	"evobgp/internal/store"
+)
+
+const ingestPath = "/api/v1/ingest/audit"
+
+// PortalPusher sends audit rows to auth-portal (best-effort, async-friendly).
+type PortalPusher struct {
+	BaseURL    string
+	Secret     string
+	HTTPClient *http.Client
+	MarkPushed func(id string) error
+}
+
+// PushEvent posts one audit entry to portal ingest.
+func (p *PortalPusher) PushEvent(ctx context.Context, entry *store.AuditEntry) error {
+	if p == nil || entry == nil {
+		return nil
+	}
+	base := strings.TrimRight(strings.TrimSpace(p.BaseURL), "/")
+	secret := strings.TrimSpace(p.Secret)
+	if base == "" || secret == "" {
+		return nil
+	}
+	hc := p.HTTPClient
+	if hc == nil {
+		hc = httpclient.New(15 * time.Second)
+	}
+	body := map[string]any{
+		"events": []map[string]any{p.eventPayload(entry)},
+	}
+	raw, err := json.Marshal(body)
+	if err != nil {
+		return fmt.Errorf("audit: marshal ingest: %w", err)
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, base+ingestPath, bytes.NewReader(raw))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+secret)
+	resp, err := hc.Do(req)
+	if err != nil {
+		return fmt.Errorf("audit: portal ingest: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode >= 300 {
+		b, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		return fmt.Errorf("audit: portal ingest %s: %s", resp.Status, strings.TrimSpace(string(b)))
+	}
+	if p.MarkPushed != nil {
+		if err := p.MarkPushed(entry.ID); err != nil {
+			log.Printf("audit: mark portal pushed id=%s: %v", entry.ID, err)
+		}
+	}
+	return nil
+}
+
+func (p *PortalPusher) eventPayload(entry *store.AuditEntry) map[string]any {
+	ev := map[string]any{
+		"event_id":   entry.EventID,
+		"source_app": store.AuditSourceAppBGP,
+		"action":     entry.Action,
+		"severity":   entry.Severity,
+		"summary":    entry.Summary,
+		"created_at": entry.CreatedAt.UTC().Format(time.RFC3339Nano),
+	}
+	if entry.ActorUserID != "" {
+		ev["actor_user_id"] = entry.ActorUserID
+	} else {
+		ev["actor_user_id"] = nil
+	}
+	if entry.ActorEmail != "" {
+		ev["actor_email"] = entry.ActorEmail
+	} else {
+		ev["actor_email"] = nil
+	}
+	if entry.ActorName != "" {
+		ev["actor_name"] = entry.ActorName
+	} else {
+		ev["actor_name"] = nil
+	}
+	if entry.TargetType != "" {
+		ev["target_type"] = entry.TargetType
+	} else {
+		ev["target_type"] = nil
+	}
+	if entry.TargetID != "" {
+		ev["target_id"] = entry.TargetID
+	} else {
+		ev["target_id"] = nil
+	}
+	if entry.Details != nil {
+		ev["details"] = entry.Details
+	} else {
+		ev["details"] = nil
+	}
+	if entry.IP != "" {
+		ev["ip"] = entry.IP
+	} else {
+		ev["ip"] = nil
+	}
+	return ev
+}

internal/audit/portal_test.go

@@ -0,0 +1,63 @@
+package audit
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"evobgp/internal/store"
+)
+
+func TestPortalPusherPushEvent(t *testing.T) {
+	var got struct {
+		Events []map[string]any `json:"events"`
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != ingestPath {
+			t.Fatalf("path=%s", r.URL.Path)
+		}
+		if r.Header.Get("Authorization") != "Bearer test-secret" {
+			t.Fatalf("auth=%q", r.Header.Get("Authorization"))
+		}
+		_ = json.NewDecoder(r.Body).Decode(&got)
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]int{"accepted": 1, "duplicates": 0})
+	}))
+	defer srv.Close()
+
+	marked := false
+	p := &PortalPusher{
+		BaseURL: srv.URL,
+		Secret:  "test-secret",
+		MarkPushed: func(id string) error {
+			marked = id == "local-id"
+			return nil
+		},
+	}
+	entry := &store.AuditEntry{
+		ID:         "local-id",
+		EventID:    "bgp-test-event",
+		Action:     "bgp.module.create",
+		Severity:   store.AuditSeverityInfo,
+		Summary:    "Created module",
+		SourceApp:  store.AuditSourceAppBGP,
+		CreatedAt:  time.Now().UTC(),
+		TargetType: store.AuditTargetAppResource,
+		TargetID:   "mod-1",
+	}
+	if err := p.PushEvent(context.Background(), entry); err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Events) != 1 {
+		t.Fatalf("events=%d", len(got.Events))
+	}
+	if got.Events[0]["source_app"] != "bgp" {
+		t.Fatalf("source_app=%v", got.Events[0]["source_app"])
+	}
+	if !marked {
+		t.Fatal("expected mark pushed")
+	}
+}

internal/httpapi/auth.go

@@ -6,18 +6,32 @@ import (
 	"strings"
 
 	"evobgp/internal/authkey"
+
+	"github.com/golang-jwt/jwt/v5"
 )
 
 type ctxKey int
 
 const authCtxKey ctxKey = 1
 
+// Auth kinds distinguish API key sessions from portal JWT sessions.
+const (
+	AuthKindAPIKey = "apikey"
+	AuthKindJWT    = "jwt"
+)
+
 // Auth holds resolved API identity for a request.
 type Auth struct {
 	TenantID string
-	Role     string // viewer, editor, operator, node
+	Role     string // viewer, editor, operator, node, firewall (apikeys only)
 	Token    string
 	APIKeyID string // non-empty for DB-managed keys
+	// Portal / dual-auth fields (empty for API keys unless noted).
+	Kind        string   // "apikey" | "jwt"
+	UserID      string   // JWT sub
+	Email       string   // JWT email claim
+	Permissions []string // JWT permissions claim (bgp:*)
+	IsAdmin     bool     // JWT is_admin claim
 }
 
 func authFromContext(ctx context.Context) (Auth, bool) {
@@ -56,6 +70,23 @@ func parseAPIKeysSpec(spec string) []apiKeyRecord {
 	return out
 }
 
+// looksLikeJWT reports whether raw is a compact JWS (three dot-separated segments, non-empty).
+func looksLikeJWT(raw string) bool {
+	if raw == "" {
+		return false
+	}
+	parts := strings.Split(raw, ".")
+	if len(parts) != 3 {
+		return false
+	}
+	for _, p := range parts {
+		if strings.TrimSpace(p) == "" {
+			return false
+		}
+	}
+	return true
+}
+
 func (s *Server) authMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		h := r.Header.Get("Authorization")
@@ -65,6 +96,16 @@ func (s *Server) authMiddleware(next http.Handler) http.Handler {
 			return
 		}
 		raw := strings.TrimSpace(strings.TrimPrefix(h, p))
+		if looksLikeJWT(raw) && strings.TrimSpace(s.jwtSecret) != "" {
+			a, status, msg, ok := s.resolveJWT(raw)
+			if !ok {
+				writeProblem(w, status, http.StatusText(status), msg)
+				return
+			}
+			r = r.WithContext(context.WithValue(r.Context(), authCtxKey, a))
+			next.ServeHTTP(w, r)
+			return
+		}
 		a, ok := s.resolveAuth(raw)
 		if !ok {
 			writeProblem(w, http.StatusUnauthorized, "Unauthorized", "unknown api key")
@@ -79,10 +120,16 @@ func (s *Server) authMiddleware(next http.Handler) http.Handler {
 }
 
 func authFromKeyRecord(raw string, rec apiKeyRecord) Auth {
-	return Auth{TenantID: rec.tenantID, Role: rec.role, Token: raw, APIKeyID: rec.keyID}
+	return Auth{
+		Kind:     AuthKindAPIKey,
+		TenantID: rec.tenantID,
+		Role:     rec.role,
+		Token:    raw,
+		APIKeyID: rec.keyID,
+	}
 }
 
-// resolveAuth maps a bearer token to tenant identity.
+// resolveAuth maps a bearer token to tenant identity (API key path).
 // For the literal token "dev", the demo shortcut (devAuth) takes precedence when demo-seed
 // is available; env/DB mapping is used only when demo tenant is absent.
 func (s *Server) resolveAuth(raw string) (Auth, bool) {
@@ -99,23 +146,115 @@ func (s *Server) resolveAuth(raw string) (Auth, bool) {
 	if !ok {
 		if s.firewallResolver != nil {
 			if fw, ok := s.firewallResolver.Lookup(raw); ok {
-				return Auth{TenantID: fw.tenantID, Role: "firewall", Token: raw, APIKeyID: fw.clientID}, true
+				return Auth{Kind: AuthKindAPIKey, TenantID: fw.tenantID, Role: "firewall", Token: raw, APIKeyID: fw.clientID}, true
 			}
 		}
 		if client, err := s.store.LookupFirewallClientByTokenHash(authkey.HashToken(raw)); err == nil {
-			return Auth{TenantID: client.TenantID, Role: "firewall", Token: raw, APIKeyID: client.ID}, true
+			return Auth{Kind: AuthKindAPIKey, TenantID: client.TenantID, Role: "firewall", Token: raw, APIKeyID: client.ID}, true
 		}
 		return Auth{}, false
 	}
 	return authFromKeyRecord(raw, rec), true
 }
 
+// resolveJWT parses and validates a portal HS256 token, returning an Auth on success.
+// Returns (auth, status, detail, ok). status/detail are used when ok=false.
+func (s *Server) resolveJWT(raw string) (Auth, int, string, bool) {
+	tok, err := jwt.Parse(raw, func(t *jwt.Token) (any, error) {
+		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, jwt.ErrSignatureInvalid
+		}
+		return []byte(s.jwtSecret), nil
+	}, jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}))
+	if err != nil || tok == nil || !tok.Valid {
+		return Auth{}, http.StatusUnauthorized, "invalid jwt", false
+	}
+	claims, ok := tok.Claims.(jwt.MapClaims)
+	if !ok {
+		return Auth{}, http.StatusUnauthorized, "invalid jwt claims", false
+	}
+	if iss := strings.TrimSpace(s.authIssuer); iss != "" {
+		got, _ := claims["iss"].(string)
+		if strings.TrimSpace(got) != iss {
+			return Auth{}, http.StatusUnauthorized, "jwt issuer mismatch", false
+		}
+	}
+	apps := coerceStringSlice(claims["apps"])
+	if !containsFold(apps, "bgp") {
+		return Auth{}, http.StatusForbidden, "jwt does not grant access to bgp app", false
+	}
+	sub, _ := claims["sub"].(string)
+	if strings.TrimSpace(sub) == "" {
+		return Auth{}, http.StatusUnauthorized, "jwt missing sub", false
+	}
+	tenantID := tenantIDFromClaims(claims)
+	if tenantID == "" {
+		tenantID = strings.TrimSpace(s.portalTenantID)
+	}
+	if tenantID == "" {
+		return Auth{}, http.StatusServiceUnavailable, "portal tenant not configured (set bgp tenant in auth-portal App Switcher or EVOBGP_PORTAL_TENANT_ID)", false
+	}
+	email, _ := claims["email"].(string)
+	perms := coerceStringSlice(claims["permissions"])
+	isAdmin, _ := claims["is_admin"].(bool)
+	return Auth{
+		Kind:        AuthKindJWT,
+		TenantID:    tenantID,
+		UserID:      strings.TrimSpace(sub),
+		Email:       strings.TrimSpace(email),
+		Permissions: perms,
+		IsAdmin:     isAdmin,
+		Token:       raw,
+	}, 0, "", true
+}
+
+// tenantIDFromClaims prefers tenants.bgp, then bgp_tenant_id.
+func tenantIDFromClaims(claims jwt.MapClaims) string {
+	if m, ok := claims["tenants"].(map[string]any); ok {
+		if v, ok := m["bgp"].(string); ok {
+			if tid := strings.TrimSpace(v); tid != "" {
+				return tid
+			}
+		}
+	}
+	if v, ok := claims["bgp_tenant_id"].(string); ok {
+		return strings.TrimSpace(v)
+	}
+	return ""
+}
+
+func coerceStringSlice(v any) []string {
+	switch t := v.(type) {
+	case []string:
+		return t
+	case []any:
+		out := make([]string, 0, len(t))
+		for _, x := range t {
+			if s, ok := x.(string); ok {
+				out = append(out, s)
+			}
+		}
+		return out
+	default:
+		return nil
+	}
+}
+
+func containsFold(items []string, needle string) bool {
+	for _, x := range items {
+		if strings.EqualFold(strings.TrimSpace(x), needle) {
+			return true
+		}
+	}
+	return false
+}
+
 func (s *Server) devAuth() (Auth, bool) {
 	tid, _, _, _, _ := s.store.DemoIDs()
 	if tid == "" {
 		return Auth{}, false
 	}
-	return Auth{TenantID: tid, Role: "operator", Token: "dev"}, true
+	return Auth{Kind: AuthKindAPIKey, TenantID: tid, Role: "operator", Token: "dev"}, true
 }
 
 func roleLevel(role string) int {
@@ -131,7 +270,8 @@ func roleLevel(role string) int {
 	}
 }
 
-// requireAtLeast rejects node role and enforces viewer/editor/operator ladder.
+// requireAtLeast rejects node/firewall roles and enforces viewer/editor/operator ladder for API keys.
+// New code should call requirePerm which supports JWT permissions in addition to API-key roles.
 func (s *Server) requireAtLeast(w http.ResponseWriter, a Auth, need string) bool {
 	if strings.ToLower(a.Role) == "node" {
 		writeProblem(w, http.StatusForbidden, "Forbidden", "node role cannot access this resource")

internal/httpapi/auth_jwt_test.go

@@ -0,0 +1,302 @@
+package httpapi
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+const (
+	testJWTSecret = "test-secret-32-bytes-long-abcdef"
+	testIssuer    = "https://auth.test.local"
+)
+
+func signTestJWT(t *testing.T, claims jwt.MapClaims) string {
+	t.Helper()
+	tok := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	s, err := tok.SignedString([]byte(testJWTSecret))
+	if err != nil {
+		t.Fatalf("sign jwt: %v", err)
+	}
+	return s
+}
+
+func newJWTTestServer(t *testing.T) (*Server, string) {
+	t.Helper()
+	srv, err := New(Options{
+		SeedDemo:       true,
+		BundleSeedHex:  testBundleSeed,
+		JWTSecret:      testJWTSecret,
+		AuthIssuer:     testIssuer,
+		AuthPortalURL:  "https://portal.test.local",
+		AuthRequired:   true,
+		PortalTenantID: "", // filled after DemoIDs
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	tenant, _, _, _, _ := srv.Store().DemoIDs()
+	// Override tenant to match seed.
+	srv.portalTenantID = tenant
+	return srv, tenant
+}
+
+func TestAuthJWTAcceptedWithBGPApp(t *testing.T) {
+	srv, _ := newJWTTestServer(t)
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	token := signTestJWT(t, jwt.MapClaims{
+		"iss":         testIssuer,
+		"sub":         "user-1",
+		"email":       "user@test.local",
+		"apps":        []string{"bgp"},
+		"permissions": []string{"bgp:modules:read"},
+		"exp":         time.Now().Add(time.Hour).Unix(),
+	})
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/modules", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("status=%d body=%s", resp.StatusCode, b)
+	}
+}
+
+func TestAuthJWTRejectedOnWrongIssuer(t *testing.T) {
+	srv, _ := newJWTTestServer(t)
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	token := signTestJWT(t, jwt.MapClaims{
+		"iss":  "https://other.example.com",
+		"sub":  "user-1",
+		"apps": []string{"bgp"},
+		"exp":  time.Now().Add(time.Hour).Unix(),
+	})
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/modules", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("status=%d want 401", resp.StatusCode)
+	}
+}
+
+func TestAuthJWTRejectedWhenBGPAppMissing(t *testing.T) {
+	srv, _ := newJWTTestServer(t)
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	token := signTestJWT(t, jwt.MapClaims{
+		"iss":  testIssuer,
+		"sub":  "user-1",
+		"apps": []string{"cfdm", "portal"},
+		"exp":  time.Now().Add(time.Hour).Unix(),
+	})
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/modules", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("status=%d want 403", resp.StatusCode)
+	}
+}
+
+func TestAuthJWTIsAdminBypassesPermissions(t *testing.T) {
+	srv, _ := newJWTTestServer(t)
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	token := signTestJWT(t, jwt.MapClaims{
+		"iss":      testIssuer,
+		"sub":      "admin-1",
+		"apps":     []string{"bgp"},
+		"is_admin": true,
+		"exp":      time.Now().Add(time.Hour).Unix(),
+	})
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/api-keys", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("status=%d body=%s", resp.StatusCode, b)
+	}
+}
+
+func TestAuthJWTMissingPermissionRejected(t *testing.T) {
+	srv, _ := newJWTTestServer(t)
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	token := signTestJWT(t, jwt.MapClaims{
+		"iss":         testIssuer,
+		"sub":         "user-1",
+		"apps":        []string{"bgp"},
+		"permissions": []string{"bgp:modules:read"},
+		"exp":         time.Now().Add(time.Hour).Unix(),
+	})
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/api-keys", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("status=%d want 403", resp.StatusCode)
+	}
+}
+
+func TestAuthJWTTenantFromClaimWithoutEnv(t *testing.T) {
+	srv, err := New(Options{
+		SeedDemo:      true,
+		BundleSeedHex: testBundleSeed,
+		JWTSecret:     testJWTSecret,
+		AuthIssuer:    testIssuer,
+		AuthPortalURL: "https://portal.test.local",
+		AuthRequired:  true,
+		// No PortalTenantID — must come from JWT claim.
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+	tenant, _, _, _, _ := srv.Store().DemoIDs()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	token := signTestJWT(t, jwt.MapClaims{
+		"iss":           testIssuer,
+		"sub":           "user-1",
+		"apps":          []string{"bgp"},
+		"permissions":   []string{"bgp:modules:read"},
+		"bgp_tenant_id": tenant,
+		"exp":           time.Now().Add(time.Hour).Unix(),
+	})
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/modules", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("status=%d body=%s", resp.StatusCode, b)
+	}
+}
+
+func TestAuthJWTRejectedWhenTenantMissing(t *testing.T) {
+	srv, err := New(Options{
+		SeedDemo:      true,
+		BundleSeedHex: testBundleSeed,
+		JWTSecret:     testJWTSecret,
+		AuthIssuer:    testIssuer,
+		AuthPortalURL: "https://portal.test.local",
+		AuthRequired:  true,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	token := signTestJWT(t, jwt.MapClaims{
+		"iss":  testIssuer,
+		"sub":  "user-1",
+		"apps": []string{"bgp"},
+		"exp":  time.Now().Add(time.Hour).Unix(),
+	})
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/modules", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusServiceUnavailable {
+		t.Fatalf("status=%d want 503", resp.StatusCode)
+	}
+}
+
+func TestAuthConfigPublic(t *testing.T) {
+	srv, _ := newJWTTestServer(t)
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/auth/config", nil)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("status=%d body=%s", resp.StatusCode, b)
+	}
+}
+
+func TestHasPermissionSupersets(t *testing.T) {
+	cases := []struct {
+		name    string
+		granted []string
+		want    string
+		ok      bool
+	}{
+		{"exact-read", []string{"bgp:modules:read"}, "bgp:modules:read", true},
+		{"write-covers-read", []string{"bgp:modules:write"}, "bgp:modules:read", true},
+		{"admin-covers-write", []string{"bgp:modules:admin"}, "bgp:modules:write", true},
+		{"read-does-not-cover-write", []string{"bgp:modules:read"}, "bgp:modules:write", false},
+		{"different-section", []string{"bgp:network:admin"}, "bgp:modules:read", false},
+		{"empty-granted", nil, "bgp:modules:read", false},
+		{"malformed-required", []string{"bgp:modules:admin"}, "bgp:modules", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := HasPermission(tc.granted, tc.want); got != tc.ok {
+				t.Fatalf("HasPermission(%v, %q) = %v, want %v", tc.granted, tc.want, got, tc.ok)
+			}
+		})
+	}
+}

internal/httpapi/firewall_replicate.go

@@ -1,118 +0,0 @@
-package httpapi
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"log"
-	"net/http"
-	"strings"
-	"time"
-
-	"evobgp/internal/nodedispatch"
-	"evobgp/internal/store"
-)
-
-func (s *Server) replicateFirewallStateToSpeakers(tenantID string) {
-	if !nodedispatch.Enabled() {
-		return
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 45*time.Second)
-	defer cancel()
-
-	clients, err := s.store.ListApprovedFirewallClientsForReplication(tenantID)
-	if err != nil {
-		log.Printf("httpapi: firewall replicate clients: %v", err)
-		return
-	}
-	rules, err := s.store.ListAllFirewallRulesForReplication(tenantID)
-	if err != nil {
-		log.Printf("httpapi: firewall replicate rules: %v", err)
-		return
-	}
-	revs, _, _ := s.store.ListRevisions(tenantID, "", "", 1)
-	if len(revs) == 0 {
-		return
-	}
-	revID := revs[0].ID
-	prefixesByCommunity, _, err := s.loadPrefixesByCommunity(tenantID, revID)
-	if err != nil {
-		log.Printf("httpapi: firewall replicate prefixes: %v", err)
-		return
-	}
-
-	payloadRules := make([]map[string]any, 0, len(rules))
-	for _, r := range rules {
-		payloadRules = append(payloadRules, map[string]any{
-			"client_id":    r.ClientID,
-			"priority":     r.Priority,
-			"action":       r.Action,
-			"community_id": r.CommunityID,
-		})
-	}
-	payloadClients := make([]map[string]any, 0, len(clients))
-	for _, c := range clients {
-		payloadClients = append(payloadClients, map[string]any{
-			"token_hash_hex": c.TokenHashHex,
-			"client_id":      c.ClientID,
-			"name":           c.Name,
-		})
-	}
-	body := map[string]any{
-		"tenant_id":             tenantID,
-		"revision_id":           revID,
-		"generated_at":          time.Now().UTC().Format(time.RFC3339),
-		"clients":               payloadClients,
-		"rules":                 payloadRules,
-		"prefixes_by_community": prefixesByCommunity,
-	}
-
-	speakers := s.store.ListSpeakersForTenant(tenantID)
-	for _, sp := range speakers {
-		meta := store.ParseSpeakerMeta(sp.MetaJSON)
-		if !store.SpeakerNeedsRemoteDispatch(sp.Role, meta) || !meta.FirewallFailover {
-			continue
-		}
-		domain := strings.TrimSpace(meta.AgentDomain)
-		if domain == "" {
-			continue
-		}
-		url := "https://" + strings.TrimSuffix(domain, "/") + "/v1/agent/firewall-replicate"
-		status, errMsg := postFirewallReplicate(ctx, url, meta.AgentSecret, body)
-		patch := store.SpeakerMeta{
-			LastFirewallReplicateAt:     time.Now().UTC().Format(time.RFC3339Nano),
-			LastFirewallReplicateStatus: status,
-			LastFirewallReplicateError:  errMsg,
-		}
-		merged := store.MergeSpeakerMetaJSON(sp.MetaJSON, patch)
-		mp := merged
-		if _, err := s.store.UpdateSpeaker(tenantID, sp.ID, &store.SpeakerPatch{MetaJSON: &mp}); err != nil {
-			log.Printf("httpapi: firewall replicate meta update %s: %v", sp.ID, err)
-		}
-	}
-}
-
-func postFirewallReplicate(ctx context.Context, url, secret string, body map[string]any) (status, errMsg string) {
-	b, err := json.Marshal(body)
-	if err != nil {
-		return "error", err.Error()
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(b))
-	if err != nil {
-		return "error", err.Error()
-	}
-	req.Header.Set("Authorization", "Bearer "+strings.TrimSpace(secret))
-	req.Header.Set("Content-Type", "application/json")
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return "error", err.Error()
-	}
-	defer func() { _ = resp.Body.Close() }()
-	_, _ = io.Copy(io.Discard, resp.Body)
-	if resp.StatusCode >= 200 && resp.StatusCode < 300 {
-		return "ok", ""
-	}
-	return "error", resp.Status
-}

internal/httpapi/permissions.go

@@ -0,0 +1,107 @@
+package httpapi
+
+import (
+	"net/http"
+	"strings"
+)
+
+// Portal permission strings. Format: <app>:<section>:<level> (bgp:modules:read).
+// Superset order: admin ⊃ write ⊃ read for the same <app>:<section>.
+const (
+	permLevelRead  = "read"
+	permLevelWrite = "write"
+	permLevelAdmin = "admin"
+)
+
+// permLevelRank returns 0 for unknown, 1 for read, 2 for write, 3 for admin.
+func permLevelRank(level string) int {
+	switch strings.ToLower(strings.TrimSpace(level)) {
+	case permLevelRead:
+		return 1
+	case permLevelWrite:
+		return 2
+	case permLevelAdmin:
+		return 3
+	default:
+		return 0
+	}
+}
+
+// splitPerm splits a permission string into (app, section, level).
+func splitPerm(perm string) (app, section, level string, ok bool) {
+	parts := strings.Split(strings.TrimSpace(perm), ":")
+	if len(parts) != 3 {
+		return "", "", "", false
+	}
+	return strings.TrimSpace(parts[0]), strings.TrimSpace(parts[1]), strings.TrimSpace(parts[2]), true
+}
+
+// HasPermission reports whether the granted list satisfies required, applying the
+// admin ⊃ write ⊃ read superset within the same app+section.
+func HasPermission(granted []string, required string) bool {
+	rApp, rSection, rLevel, ok := splitPerm(required)
+	if !ok {
+		return false
+	}
+	needRank := permLevelRank(rLevel)
+	if needRank == 0 {
+		return false
+	}
+	for _, g := range granted {
+		gApp, gSection, gLevel, ok := splitPerm(g)
+		if !ok {
+			continue
+		}
+		if !strings.EqualFold(gApp, rApp) || !strings.EqualFold(gSection, rSection) {
+			continue
+		}
+		if permLevelRank(gLevel) >= needRank {
+			return true
+		}
+	}
+	return false
+}
+
+// permAPIKeyRoleFor maps a permission level to the API-key role required.
+func permAPIKeyRoleFor(perm string) string {
+	_, _, level, ok := splitPerm(perm)
+	if !ok {
+		return "operator"
+	}
+	switch strings.ToLower(level) {
+	case permLevelRead:
+		return "viewer"
+	case permLevelWrite:
+		return "editor"
+	case permLevelAdmin:
+		return "operator"
+	default:
+		return "operator"
+	}
+}
+
+// requirePerm enforces a permission for a portal JWT or falls back to the API-key role ladder.
+// node/firewall roles are always rejected (they use requireNode / requireFirewall).
+func (s *Server) requirePerm(w http.ResponseWriter, a Auth, perm string) bool {
+	switch strings.ToLower(a.Role) {
+	case "node":
+		writeProblem(w, http.StatusForbidden, "Forbidden", "node role cannot access this resource")
+		return false
+	case "firewall":
+		writeProblem(w, http.StatusForbidden, "Forbidden", "firewall role cannot access this resource")
+		return false
+	}
+	if a.Kind == AuthKindJWT || len(a.Permissions) > 0 {
+		if a.IsAdmin || HasPermission(a.Permissions, perm) {
+			return true
+		}
+		writeProblem(w, http.StatusForbidden, "Forbidden", "missing permission: "+perm)
+		return false
+	}
+	need := permAPIKeyRoleFor(perm)
+	if roleLevel(a.Role) < roleLevel(need) {
+		writeProblem(w, http.StatusForbidden, "Forbidden", "insufficient role")
+		return false
+	}
+	return true
+}

internal/httpapi/routes.go

@@ -35,9 +35,10 @@ func (s *Server) Handler() http.Handler {
 	s.mux.HandleFunc("GET /v1/health", s.handleHealth)
 	s.mux.HandleFunc("GET /v1/ready", s.handleReady)
 	s.mux.HandleFunc("GET /v1/version", s.handleVersion)
-	s.mux.HandleFunc("POST /v1/firewall/enroll", s.handleFirewallEnrollPublic)
-	s.mux.HandleFunc("GET /v1/firewall/install.sh", s.handleFirewallInstallScript)
-	s.mux.HandleFunc("GET /v1/firewall/sync-script", s.handleFirewallSyncScript)
+	s.mux.HandleFunc("GET /v1/auth/config", s.handleAuthConfigPublic)
+	// Firewall subsystem moved to the standalone EvoFirewall service; see docs/firewall.md.
+	// Registered on the public mux so it wins over the "/v1/" subtree below regardless of auth.
+	s.mux.HandleFunc("/v1/firewall/", s.handleFirewallGone)
 	s.mux.Handle("/v1/", s.authMiddleware(wrappedV1))
 	return s.withCORS(observability.HTTPMiddleware(s.mux))
 }
@@ -82,17 +83,26 @@ func (s *Server) registerV1(m *http.ServeMux) {
 	m.HandleFunc("GET /speakers/{speaker_id}/bundle/{revision_id}", s.handleNodeBundle)
 	m.HandleFunc("POST /nodes/enroll", s.handleNodeEnroll)
 	s.registerCRUDRoutes(m)
+	s.registerAuditRoutes(m)
 	s.registerPostgresMonitoringRoutes(m)
 	s.registerPostgresMaintenanceRoutes(m)
 	s.registerMaintenanceRoutes(m)
 	s.registerRuntimeLogsRoutes(m)
-	s.registerFirewallRoutes(m)
 }
 
 func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
 }
 
+// handleAuthConfigPublic exposes portal-auth wiring so the UI can decide whether to redirect to the login portal.
+// Registered on the public mux (no auth middleware): safe to call without a bearer token.
+func (s *Server) handleAuthConfigPublic(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, http.StatusOK, map[string]any{
+		"required":   s.authRequired,
+		"portal_url": s.authPortalURL,
+	})
+}
+
 func (s *Server) handleReady(w http.ResponseWriter, r *http.Request) {
 	checks := map[string]string{"store": "ok", "jobs": "memory"}
 	ctx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
@@ -188,7 +198,7 @@ func (s *Server) handleListModules(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	typeFilter := strings.TrimSpace(r.URL.Query().Get("type"))
@@ -204,23 +214,9 @@ func (s *Server) handleListModules(w http.ResponseWriter, r *http.Request) {
 	}
 
 	filtered := make([]*store.Module, 0)
-	limit := parseListLimit(r)
-	cursor := r.URL.Query().Get("cursor")
-	if typeFilter == "" && enabledFilter == nil {
-		page, next, more := s.store.ListModulesPage(a.TenantID, cursor, limit)
-		for _, mod := range page {
-			filtered = append(filtered, mod)
-		}
-		items := make([]map[string]any, 0, len(filtered))
-		for _, mod := range filtered {
-			items = append(items, moduleJSON(mod))
-		}
-		writeJSON(w, http.StatusOK, map[string]any{
-			"items": items, "next_cursor": strPtrOrNull(next), "has_more": more,
-		})
-		return
-	}
-	for _, mod := range s.store.ListModules(a.TenantID) {
+	all := s.store.ListModules(a.TenantID)
+	all = store.FilterOwned(all, func(m *store.Module) string { return m.CreatedByUserID }, a.Kind, a.IsAdmin, a.UserID)
+	for _, mod := range all {
 		if typeFilter != "" && mod.Type != typeFilter {
 			continue
 		}
@@ -245,7 +241,7 @@ func (s *Server) handleRouterListsCatalog(w http.ResponseWriter, r *http.Request
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:directories:read") {
 		return
 	}
 	cat, err := reports.BuildRouterListsCatalog(s.store, a.TenantID)
@@ -268,10 +264,14 @@ func (s *Server) handleGetModule(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	mod, err := s.store.GetModule(a.TenantID, r.PathValue("module_id"))
+	if err == nil && !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, mod.CreatedByUserID) {
+		writeProblem(w, http.StatusNotFound, "Not Found", "module not found")
+		return
+	}
 	if err != nil {
 		if err == store.ErrNotFound || err == store.ErrTenantScope {
 			writeProblem(w, http.StatusNotFound, "Not Found", "module not found")
@@ -289,10 +289,11 @@ func (s *Server) handleListPeers(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:network:read") {
 		return
 	}
 	allPeers := s.store.ListPeers(a.TenantID)
+	allPeers = store.FilterOwned(allPeers, func(p *store.BGPPeer) string { return p.CreatedByUserID }, a.Kind, a.IsAdmin, a.UserID)
 	page, next, more := store.PaginateOffset(allPeers, r.URL.Query().Get("cursor"), parseListLimit(r))
 	fresh := r != nil && strings.EqualFold(strings.TrimSpace(r.URL.Query().Get("live")), "1")
 	ctx, cancel := context.WithTimeout(r.Context(), 12*time.Second)
@@ -392,7 +393,7 @@ func (s *Server) handleListSpeakers(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:network:read") {
 		return
 	}
 	speakers := s.store.ListSpeakersForTenant(a.TenantID)
@@ -424,7 +425,7 @@ func (s *Server) handleModuleRefresh(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "editor") {
+	if !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	moduleID := r.PathValue("module_id")
@@ -460,7 +461,7 @@ func (s *Server) handleTenantRefresh(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "editor") {
+	if !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body struct {
@@ -514,7 +515,7 @@ func (s *Server) handleListRevisions(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
@@ -587,7 +588,7 @@ func (s *Server) handleGetRevision(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	rev, err := s.store.GetRevisionSummary(a.TenantID, r.PathValue("revision_id"))
@@ -604,7 +605,7 @@ func (s *Server) handleRevisionPreview(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	rev, err := s.store.GetRevision(a.TenantID, r.PathValue("revision_id"))
@@ -643,7 +644,7 @@ func (s *Server) handleRevisionDiagnosticLog(w http.ResponseWriter, r *http.Requ
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	revID := r.PathValue("revision_id")
@@ -669,7 +670,7 @@ func (s *Server) handleRevisionDiff(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	d, err := s.store.RevisionDiff(a.TenantID, r.PathValue("revision_a"), r.PathValue("revision_b"))
@@ -686,7 +687,7 @@ func (s *Server) handleRevisionRollback(w http.ResponseWriter, r *http.Request)
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "operator") {
+	if !s.requirePerm(w, a, "bgp:operations:admin") {
 		return
 	}
 	revID := r.PathValue("revision_id")
@@ -717,8 +718,7 @@ func (s *Server) handleApply(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if strings.ToLower(a.Role) != "operator" {
-		writeProblem(w, http.StatusForbidden, "Forbidden", "operator role required")
+	if !s.requirePerm(w, a, "bgp:operations:admin") {
 		return
 	}
 	var body struct {
@@ -764,8 +764,7 @@ func (s *Server) handleSpeakerApply(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if strings.ToLower(a.Role) != "operator" {
-		writeProblem(w, http.StatusForbidden, "Forbidden", "operator role required")
+	if !s.requirePerm(w, a, "bgp:operations:admin") {
 		return
 	}
 	spkID := r.PathValue("id")
@@ -815,8 +814,7 @@ func (s *Server) handleBirdReload(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if strings.ToLower(a.Role) != "operator" {
-		writeProblem(w, http.StatusForbidden, "Forbidden", "operator role required")
+	if !s.requirePerm(w, a, "bgp:operations:admin") {
 		return
 	}
 	idem := strings.TrimSpace(r.Header.Get("Idempotency-Key"))
@@ -839,7 +837,7 @@ func (s *Server) handleBirdStatus(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:monitoring:read") {
 		return
 	}
 	ctx, cancel := context.WithTimeout(r.Context(), 12*time.Second)
@@ -854,7 +852,7 @@ func (s *Server) handleListJobs(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
@@ -877,7 +875,7 @@ func (s *Server) handleGetJob(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	j, err := s.jobs.Get(a.TenantID, r.PathValue("job_id"))
@@ -894,7 +892,7 @@ func (s *Server) handleGetJobReport(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	j, err := s.jobs.Get(a.TenantID, r.PathValue("job_id"))
@@ -932,7 +930,7 @@ func (s *Server) handleCancelJob(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "editor") {
+	if !s.requirePerm(w, a, "bgp:operations:admin") {
 		return
 	}
 	j, err := s.jobs.RequestCancel(a.TenantID, r.PathValue("job_id"))

internal/httpapi/routes_api_keys.go

@@ -21,13 +21,22 @@ func (s *Server) registerAPIKeyRoutes(m *http.ServeMux) {
 
 func (s *Server) handleAuthSession(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok {
+		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	writeJSON(w, http.StatusOK, map[string]any{
+	resp := map[string]any{
 		"tenant_id": a.TenantID,
 		"role":      a.Role,
-	})
+		"kind":      a.Kind,
+	}
+	if a.Kind == AuthKindJWT {
+		resp["user_id"] = a.UserID
+		resp["email"] = a.Email
+		resp["permissions"] = a.Permissions
+		resp["is_admin"] = a.IsAdmin
+	}
+	writeJSON(w, http.StatusOK, resp)
 }
 
 func apiKeyJSON(k *store.APIKey) map[string]any {
@@ -59,7 +68,7 @@ func apiKeyJSON(k *store.APIKey) map[string]any {
 
 func (s *Server) handleListAPIKeys(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
 	list, err := s.store.ListAPIKeys(a.TenantID)
@@ -74,7 +83,7 @@ func (s *Server) handleListAPIKeys(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleGetAPIKey(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
 	k, err := s.store.GetAPIKey(a.TenantID, r.PathValue("id"))
@@ -87,7 +96,7 @@ func (s *Server) handleGetAPIKey(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostAPIKey(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
 	var body struct {
@@ -122,12 +131,13 @@ func (s *Server) handlePostAPIKey(w http.ResponseWriter, r *http.Request) {
 	}
 	out := apiKeyJSON(&created.APIKey)
 	out["token"] = created.Token
+	s.recordCRUDAudit(r, a, "bgp.api_key.create", "Created API key "+created.Name, created.ID, map[string]any{"api_key_id": created.ID, "role": created.Role})
 	writeJSON(w, http.StatusCreated, out)
 }
 
 func (s *Server) handlePatchAPIKey(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
 	var raw map[string]json.RawMessage
@@ -178,15 +188,17 @@ func (s *Server) handlePatchAPIKey(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusInternalServerError, "Internal Server Error", "failed to reload api keys")
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.api_key.update", "Updated API key "+k.Name, k.ID, map[string]any{"api_key_id": k.ID, "role": k.Role})
 	writeJSON(w, http.StatusOK, apiKeyJSON(k))
 }
 
 func (s *Server) handleDeleteAPIKey(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
-	if err := s.store.RevokeAPIKey(a.TenantID, r.PathValue("id")); err != nil {
+	keyID := r.PathValue("id")
+	if err := s.store.RevokeAPIKey(a.TenantID, keyID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
@@ -194,12 +206,13 @@ func (s *Server) handleDeleteAPIKey(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusInternalServerError, "Internal Server Error", "failed to reload api keys")
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.api_key.revoke", "Revoked API key", keyID, map[string]any{"api_key_id": keyID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
 func (s *Server) handleRotateAPIKey(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
 	rotated, err := s.store.RotateAPIKey(a.TenantID, r.PathValue("id"))
@@ -213,5 +226,6 @@ func (s *Server) handleRotateAPIKey(w http.ResponseWriter, r *http.Request) {
 	}
 	out := apiKeyJSON(&rotated.APIKey)
 	out["token"] = rotated.Token
+	s.recordCRUDAudit(r, a, "bgp.api_key.rotate", "Rotated API key "+rotated.Name, rotated.ID, map[string]any{"api_key_id": rotated.ID})
 	writeJSON(w, http.StatusOK, out)
 }

internal/httpapi/routes_audit.go

@@ -0,0 +1,171 @@
+package httpapi
+
+import (
+	"context"
+	"log"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+
+	"evobgp/internal/audit"
+	"evobgp/internal/store"
+)
+
+func (s *Server) registerAuditRoutes(m *http.ServeMux) {
+	m.HandleFunc("GET /audit", s.handleListAudit)
+}
+
+func (s *Server) handleListAudit(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") {
+		return
+	}
+	cursor := r.URL.Query().Get("cursor")
+	limit := parseLimitQuery(r, 20, 200)
+	filter := store.AuditListFilter{
+		Action:   strings.TrimSpace(r.URL.Query().Get("action")),
+		Severity: strings.TrimSpace(r.URL.Query().Get("severity")),
+	}
+	if filter.Severity != "" && !store.ValidAuditSeverity(filter.Severity) {
+		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid severity")
+		return
+	}
+	items, next, hasMore, err := s.store.ListAudit(a.TenantID, cursor, limit, filter)
+	if err != nil {
+		writeInternalError(w, "audit_list", err)
+		return
+	}
+	out := make([]map[string]any, 0, len(items))
+	for _, row := range items {
+		out = append(out, auditEntryJSON(row))
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"items": out, "next_cursor": next, "has_more": hasMore})
+}
+
+func auditEntryJSON(row *store.AuditEntry) map[string]any {
+	if row == nil {
+		return map[string]any{}
+	}
+	m := map[string]any{
+		"id":                   row.ID,
+		"tenant_id":            row.TenantID,
+		"event_id":             row.EventID,
+		"source_app":           row.SourceApp,
+		"action":               row.Action,
+		"severity":             row.Severity,
+		"actor_user_id":        strPtrOrNull(row.ActorUserID),
+		"actor_email":          strPtrOrNull(row.ActorEmail),
+		"actor_name":           strPtrOrNull(row.ActorName),
+		"actor_api_key_prefix": strPtrOrNull(row.ActorAPIKeyPrefix),
+		"target_type":          strPtrOrNull(row.TargetType),
+		"target_id":            strPtrOrNull(row.TargetID),
+		"summary":              row.Summary,
+		"details":              row.Details,
+		"ip":                   strPtrOrNull(row.IP),
+		"created_at":           row.CreatedAt.UTC().Format(time.RFC3339Nano),
+		"portal_pushed_at":     nil,
+	}
+	if row.PortalPushedAt != nil {
+		m["portal_pushed_at"] = row.PortalPushedAt.UTC().Format(time.RFC3339Nano)
+	}
+	if m["details"] == nil {
+		m["details"] = nil
+	}
+	return m
+}
+
+func (s *Server) recordCRUDAudit(r *http.Request, a Auth, action, summary, targetID string, details map[string]any) {
+	if s == nil || s.store == nil {
+		return
+	}
+	in := store.AuditAppendInput{
+		TenantID:   a.TenantID,
+		Action:     action,
+		Severity:   store.AuditSeverityInfo,
+		TargetType: store.AuditTargetAppResource,
+		TargetID:   targetID,
+		Summary:    summary,
+		Details:    details,
+		IP:         clientIP(r),
+	}
+	fillAuditActor(&in, a)
+	entry, err := s.store.AppendAudit(in)
+	if err != nil {
+		log.Printf("httpapi: audit append action=%s: %v", action, err)
+		return
+	}
+	s.pushAuditToPortal(entry)
+}
+
+func fillAuditActor(in *store.AuditAppendInput, a Auth) {
+	if in == nil {
+		return
+	}
+	if a.Kind == AuthKindJWT {
+		in.ActorUserID = strings.TrimSpace(a.UserID)
+		in.ActorEmail = strings.TrimSpace(a.Email)
+		if in.ActorEmail != "" {
+			in.ActorName = in.ActorEmail
+		}
+		return
+	}
+	prefix := actorPrefix(a)
+	in.ActorAPIKeyPrefix = prefix
+	if prefix != "" {
+		in.ActorName = "apikey:" + prefix
+	}
+}
+
+func (s *Server) pushAuditToPortal(entry *store.AuditEntry) {
+	if s == nil || s.auditPusher == nil || entry == nil {
+		return
+	}
+	pusher := s.auditPusher
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+		defer cancel()
+		if err := pusher.PushEvent(ctx, entry); err != nil {
+			log.Printf("httpapi: audit portal push event_id=%s: %v", entry.EventID, err)
+		}
+	}()
+}
+
+func clientIP(r *http.Request) string {
+	if r == nil {
+		return ""
+	}
+	if xff := strings.TrimSpace(r.Header.Get("X-Forwarded-For")); xff != "" {
+		parts := strings.Split(xff, ",")
+		if len(parts) > 0 {
+			return strings.TrimSpace(parts[0])
+		}
+	}
+	if xrip := strings.TrimSpace(r.Header.Get("X-Real-IP")); xrip != "" {
+		return xrip
+	}
+	host, _, err := net.SplitHostPort(strings.TrimSpace(r.RemoteAddr))
+	if err != nil {
+		return strings.TrimSpace(r.RemoteAddr)
+	}
+	return host
+}
+
+// initAuditPusher wires portal push when URL and secret are configured.
+func (s *Server) initAuditPusher(portalURL, ingestSecret string) {
+	base := strings.TrimSpace(portalURL)
+	secret := strings.TrimSpace(ingestSecret)
+	if base == "" || secret == "" {
+		return
+	}
+	s.auditPusher = &audit.PortalPusher{
+		BaseURL: base,
+		Secret:  secret,
+		MarkPushed: func(id string) error {
+			if s.store == nil {
+				return nil
+			}
+			return s.store.MarkAuditPortalPushed(id)
+		},
+	}
+}

internal/httpapi/routes_audit_test.go

@@ -0,0 +1,52 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"evobgp/internal/store"
+)
+
+func TestHandleListAudit(t *testing.T) {
+	mem := store.NewMemory()
+	mem.SeedDemo()
+	tenant, _, _, _, _ := mem.DemoIDs()
+
+	srv, err := New(Options{SeedDemo: false, InsecureDev: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv.store = mem
+
+	_, err = mem.AppendAudit(store.AuditAppendInput{
+		TenantID: tenant,
+		Action:   "bgp.module.create",
+		Summary:  "Created module demo",
+		TargetID: "mod-x",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/audit", nil)
+	req.Header.Set("Authorization", "Bearer dev")
+	rec := httptest.NewRecorder()
+	srv.Handler().ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var body struct {
+		Items []map[string]any `json:"items"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatal(err)
+	}
+	if len(body.Items) != 1 {
+		t.Fatalf("items=%d", len(body.Items))
+	}
+	if body.Items[0]["action"] != "bgp.module.create" {
+		t.Fatalf("action=%v", body.Items[0]["action"])
+	}
+}

internal/httpapi/routes_crud.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"log"
 	"net/http"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -80,7 +81,7 @@ func (s *Server) registerCRUDRoutes(m *http.ServeMux) {
 
 func (s *Server) handlePostModule(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body struct {
@@ -99,22 +100,27 @@ func (s *Server) handlePostModule(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid json")
 		return
 	}
-	mod, err := s.store.CreateModule(a.TenantID, &store.Module{
+	newModule := &store.Module{
 		Type: body.Type, Name: body.Name, Enabled: body.Enabled, Priority: body.Priority,
 		RefreshIntervalSec: body.RefreshIntervalSec, CronExpr: body.CronExpr,
 		DefaultCommunityID: body.DefaultCommunityID, DohProfileID: body.DohProfileID,
 		DohProfileIDs: body.DohProfileIDs, DohResolverPolicy: body.DohResolverPolicy,
-	})
+	}
+	if a.Kind == AuthKindJWT && strings.TrimSpace(a.UserID) != "" {
+		newModule.CreatedByUserID = a.UserID
+	}
+	mod, err := s.store.CreateModule(a.TenantID, newModule)
 	if err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.module.create", "Created module "+mod.Name, mod.ID, map[string]any{"module_id": mod.ID, "type": mod.Type, "name": mod.Name})
 	writeJSON(w, http.StatusCreated, moduleJSON(mod))
 }
 
 func (s *Server) handlePatchModule(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	rawBody, err := io.ReadAll(r.Body)
@@ -158,23 +164,39 @@ func (s *Server) handlePatchModule(w http.ResponseWriter, r *http.Request) {
 			body.RefreshIntervalSec = &zero
 		}
 	}
-	mod, err := s.store.UpdateModule(a.TenantID, r.PathValue("module_id"), &body)
+	moduleID := r.PathValue("module_id")
+	if existing, gerr := s.store.GetModule(a.TenantID, moduleID); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "module not found")
+			return
+		}
+	}
+	mod, err := s.store.UpdateModule(a.TenantID, moduleID, &body)
 	if err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.module.update", "Updated module "+mod.Name, mod.ID, map[string]any{"module_id": mod.ID, "name": mod.Name})
 	writeJSON(w, http.StatusOK, moduleJSON(mod))
 }
 
 func (s *Server) handleDeleteModule(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
-	if err := s.store.SoftDeleteModule(a.TenantID, r.PathValue("module_id")); err != nil {
+	moduleID := r.PathValue("module_id")
+	if existing, gerr := s.store.GetModule(a.TenantID, moduleID); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "module not found")
+			return
+		}
+	}
+	if err := s.store.SoftDeleteModule(a.TenantID, moduleID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.module.delete", "Deleted module", moduleID, map[string]any{"module_id": moduleID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -215,7 +237,7 @@ func writePostgresStoreErr(w http.ResponseWriter, err error) bool {
 
 func (s *Server) handleListCDNSources(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	list, err := s.store.ListCDNSources(a.TenantID, r.PathValue("module_id"))
@@ -248,7 +270,7 @@ func cdnSourceJSON(x *store.CDNSource) map[string]any {
 
 func (s *Server) handlePreviewCDNSource(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body struct {
@@ -327,7 +349,7 @@ func (s *Server) handlePreviewCDNSource(w http.ResponseWriter, r *http.Request)
 
 func (s *Server) handlePostCDNSource(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.CDNSource
@@ -351,13 +373,14 @@ func (s *Server) handlePostCDNSource(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.cdn_source.create", "Created CDN source", x.ID, map[string]any{"module_id": mid, "source_id": x.ID, "url": x.URL})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "cdn_source_create")
 	writeJSON(w, http.StatusCreated, cdnSourceJSON(x))
 }
 
 func (s *Server) handlePatchCDNSource(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.CDNSourcePatch
@@ -381,27 +404,30 @@ func (s *Server) handlePatchCDNSource(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.cdn_source.update", "Updated CDN source", x.ID, map[string]any{"module_id": mid, "source_id": x.ID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "cdn_source_patch")
 	writeJSON(w, http.StatusOK, cdnSourceJSON(x))
 }
 
 func (s *Server) handleDeleteCDNSource(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	mid := r.PathValue("module_id")
-	if err := s.store.DeleteCDNSource(a.TenantID, mid, r.PathValue("source_id")); err != nil {
+	sourceID := r.PathValue("source_id")
+	if err := s.store.DeleteCDNSource(a.TenantID, mid, sourceID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.cdn_source.delete", "Deleted CDN source", sourceID, map[string]any{"module_id": mid, "source_id": sourceID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "cdn_source_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
 
 func (s *Server) handleListAS(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	list, err := s.store.ListASEntries(a.TenantID, r.PathValue("module_id"))
@@ -439,7 +465,7 @@ func asEntryJSON(x *store.ASEntry) map[string]any {
 
 func (s *Server) handlePostAS(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.ASEntry
@@ -453,13 +479,14 @@ func (s *Server) handlePostAS(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.as_entry.create", "Created AS entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "asn": x.ASN})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "as_entry_create")
 	writeJSON(w, http.StatusCreated, asEntryJSON(x))
 }
 
 func (s *Server) handlePatchAS(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.ASEntryPatch
@@ -473,27 +500,30 @@ func (s *Server) handlePatchAS(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.as_entry.update", "Updated AS entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "asn": x.ASN})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "as_entry_patch")
 	writeJSON(w, http.StatusOK, asEntryJSON(x))
 }
 
 func (s *Server) handleDeleteAS(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	mid := r.PathValue("module_id")
-	if err := s.store.DeleteASEntry(a.TenantID, mid, r.PathValue("entry_id")); err != nil {
+	entryID := r.PathValue("entry_id")
+	if err := s.store.DeleteASEntry(a.TenantID, mid, entryID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.as_entry.delete", "Deleted AS entry", entryID, map[string]any{"module_id": mid, "entry_id": entryID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "as_entry_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
 
 func (s *Server) handleListDomain(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	list, err := s.store.ListDomainEntries(a.TenantID, r.PathValue("module_id"))
@@ -516,7 +546,7 @@ func domainEntryJSON(x *store.DomainEntry) map[string]any {
 
 func (s *Server) handlePostDomain(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.DomainEntry
@@ -530,13 +560,14 @@ func (s *Server) handlePostDomain(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.domain_entry.create", "Created domain entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "fqdn": x.FQDN})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "domain_entry_create")
 	writeJSON(w, http.StatusCreated, domainEntryJSON(x))
 }
 
 func (s *Server) handlePatchDomain(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.DomainEntryPatch
@@ -550,27 +581,30 @@ func (s *Server) handlePatchDomain(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.domain_entry.update", "Updated domain entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "fqdn": x.FQDN})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "domain_entry_patch")
 	writeJSON(w, http.StatusOK, domainEntryJSON(x))
 }
 
 func (s *Server) handleDeleteDomain(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	mid := r.PathValue("module_id")
-	if err := s.store.DeleteDomainEntry(a.TenantID, mid, r.PathValue("entry_id")); err != nil {
+	entryID := r.PathValue("entry_id")
+	if err := s.store.DeleteDomainEntry(a.TenantID, mid, entryID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.domain_entry.delete", "Deleted domain entry", entryID, map[string]any{"module_id": mid, "entry_id": entryID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "domain_entry_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
 
 func (s *Server) handleListIPRange(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	list, err := s.store.ListIPRangeEntries(a.TenantID, r.PathValue("module_id"))
@@ -593,7 +627,7 @@ func ipRangeJSON(x *store.IPRangeEntry) map[string]any {
 
 func (s *Server) handlePostIPRange(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.IPRangeEntry
@@ -607,13 +641,14 @@ func (s *Server) handlePostIPRange(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.ip_range.create", "Created IP range entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "prefix": x.Prefix})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "ip_range_create")
 	writeJSON(w, http.StatusCreated, ipRangeJSON(x))
 }
 
 func (s *Server) handlePatchIPRange(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.IPRangePatch
@@ -627,27 +662,30 @@ func (s *Server) handlePatchIPRange(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.ip_range.update", "Updated IP range entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "prefix": x.Prefix})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "ip_range_patch")
 	writeJSON(w, http.StatusOK, ipRangeJSON(x))
 }
 
 func (s *Server) handleDeleteIPRange(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	mid := r.PathValue("module_id")
-	if err := s.store.DeleteIPRangeEntry(a.TenantID, mid, r.PathValue("entry_id")); err != nil {
+	entryID := r.PathValue("entry_id")
+	if err := s.store.DeleteIPRangeEntry(a.TenantID, mid, entryID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.ip_range.delete", "Deleted IP range entry", entryID, map[string]any{"module_id": mid, "entry_id": entryID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "ip_range_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
 
 func (s *Server) handleExportModuleEntriesCSV(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	moduleID := r.PathValue("module_id")
@@ -730,7 +768,7 @@ func (s *Server) handleExportModuleEntriesCSV(w http.ResponseWriter, r *http.Req
 
 func (s *Server) handleImportModuleEntriesCSV(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	moduleID := r.PathValue("module_id")
@@ -774,7 +812,7 @@ func (s *Server) handleImportModuleEntriesCSV(w http.ResponseWriter, r *http.Req
 
 func (s *Server) handleListDoh(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:read") {
 		return
 	}
 	list, err := s.store.ListDohProfiles(a.TenantID)
@@ -806,7 +844,7 @@ func dohJSON(x *store.DohProfile) map[string]any {
 
 func (s *Server) handleGetDoh(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:read") {
 		return
 	}
 	x, err := s.store.GetDohProfile(a.TenantID, r.PathValue("id"))
@@ -819,7 +857,7 @@ func (s *Server) handleGetDoh(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostDoh(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
 	var body store.DohProfile
@@ -832,12 +870,13 @@ func (s *Server) handlePostDoh(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.doh_profile.create", "Created DoH profile "+x.Name, x.ID, map[string]any{"profile_id": x.ID, "name": x.Name})
 	writeJSON(w, http.StatusCreated, dohJSON(x))
 }
 
 func (s *Server) handlePatchDoh(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
 	var body store.DohProfilePatch
@@ -850,24 +889,27 @@ func (s *Server) handlePatchDoh(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.doh_profile.update", "Updated DoH profile "+x.Name, x.ID, map[string]any{"profile_id": x.ID, "name": x.Name})
 	writeJSON(w, http.StatusOK, dohJSON(x))
 }
 
 func (s *Server) handleDeleteDoh(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
-	if err := s.store.DeleteDohProfile(a.TenantID, r.PathValue("id")); err != nil {
+	profileID := r.PathValue("id")
+	if err := s.store.DeleteDohProfile(a.TenantID, profileID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.doh_profile.delete", "Deleted DoH profile", profileID, map[string]any{"profile_id": profileID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
 func (s *Server) handleListComm(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:read") {
 		return
 	}
 	list, err := s.store.ListCommunities(a.TenantID)
@@ -892,7 +934,7 @@ func commJSON(x *store.Community) map[string]any {
 
 func (s *Server) handleGetComm(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:read") {
 		return
 	}
 	x, err := s.store.GetCommunity(a.TenantID, r.PathValue("id"))
@@ -905,7 +947,7 @@ func (s *Server) handleGetComm(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostComm(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
 	var body store.Community
@@ -918,12 +960,13 @@ func (s *Server) handlePostComm(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.community.create", "Created community "+x.Community, x.ID, map[string]any{"community_id": x.ID, "community": x.Community})
 	writeJSON(w, http.StatusCreated, commJSON(x))
 }
 
 func (s *Server) handlePatchComm(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
 	var body store.CommunityPatch
@@ -936,24 +979,27 @@ func (s *Server) handlePatchComm(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.community.update", "Updated community "+x.Community, x.ID, map[string]any{"community_id": x.ID, "community": x.Community})
 	writeJSON(w, http.StatusOK, commJSON(x))
 }
 
 func (s *Server) handleDeleteComm(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
-	if err := s.store.DeleteCommunity(a.TenantID, r.PathValue("id")); err != nil {
+	commID := r.PathValue("id")
+	if err := s.store.DeleteCommunity(a.TenantID, commID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.community.delete", "Deleted community", commID, map[string]any{"community_id": commID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
 func (s *Server) handlePostPeer(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
 	var body store.BGPPeer
@@ -962,18 +1008,22 @@ func (s *Server) handlePostPeer(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	body.TenantID = a.TenantID
+	if a.Kind == AuthKindJWT && strings.TrimSpace(a.UserID) != "" {
+		body.CreatedByUserID = a.UserID
+	}
 	x, err := s.store.CreatePeer(a.TenantID, &body)
 	if err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.peer.create", "Created BGP peer "+x.Name, x.ID, map[string]any{"peer_id": x.ID, "neighbor": x.Neighbor})
 	s.enqueuePeerReconcile(a.TenantID, "peer_create")
 	writeJSON(w, http.StatusCreated, peerJSON(x))
 }
 
 func (s *Server) handleGetPeer(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:read") {
 		return
 	}
 	x, err := s.store.GetPeer(a.TenantID, r.PathValue("id"))
@@ -981,12 +1031,16 @@ func (s *Server) handleGetPeer(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, x.CreatedByUserID) {
+		writeProblem(w, http.StatusNotFound, "Not Found", "peer not found")
+		return
+	}
 	writeJSON(w, http.StatusOK, peerJSON(x))
 }
 
 func (s *Server) handlePatchPeer(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
 	var body store.PeerPatch
@@ -994,31 +1048,47 @@ func (s *Server) handlePatchPeer(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid json")
 		return
 	}
-	x, err := s.store.UpdatePeer(a.TenantID, r.PathValue("id"), &body)
+	peerID := r.PathValue("id")
+	if existing, gerr := s.store.GetPeer(a.TenantID, peerID); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "peer not found")
+			return
+		}
+	}
+	x, err := s.store.UpdatePeer(a.TenantID, peerID, &body)
 	if err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.peer.update", "Updated BGP peer "+x.Name, x.ID, map[string]any{"peer_id": x.ID, "neighbor": x.Neighbor})
 	s.enqueuePeerReconcile(a.TenantID, "peer_patch")
 	writeJSON(w, http.StatusOK, peerJSON(x))
 }
 
 func (s *Server) handleDeletePeer(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
-	if err := s.store.DeletePeer(a.TenantID, r.PathValue("id")); err != nil {
+	peerID := r.PathValue("id")
+	if existing, gerr := s.store.GetPeer(a.TenantID, peerID); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "peer not found")
+			return
+		}
+	}
+	if err := s.store.DeletePeer(a.TenantID, peerID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.peer.delete", "Deleted BGP peer", peerID, map[string]any{"peer_id": peerID})
 	s.enqueuePeerReconcile(a.TenantID, "peer_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
 
 func (s *Server) handlePostSpeaker(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
 	var body store.Speaker
@@ -1035,6 +1105,7 @@ func (s *Server) handlePostSpeaker(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.speaker.create", "Created speaker "+x.ID, x.ID, map[string]any{"speaker_id": x.ID, "role": x.Role})
 	resp := speakerJSONFromStore(s.store, x)
 	if meta := store.ParseSpeakerMeta(x.MetaJSON); meta.AgentSecret != "" {
 		resp["agent_secret"] = meta.AgentSecret
@@ -1044,7 +1115,7 @@ func (s *Server) handlePostSpeaker(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleGetSpeakerByID(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:read") {
 		return
 	}
 	x, err := s.store.GetSpeaker(a.TenantID, r.PathValue("speaker_id"))
@@ -1057,7 +1128,7 @@ func (s *Server) handleGetSpeakerByID(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePatchSpeaker(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
 	var body store.SpeakerPatch
@@ -1070,24 +1141,27 @@ func (s *Server) handlePatchSpeaker(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.speaker.update", "Updated speaker "+x.ID, x.ID, map[string]any{"speaker_id": x.ID, "role": x.Role})
 	writeJSON(w, http.StatusOK, speakerJSONFromStore(s.store, x))
 }
 
 func (s *Server) handleDeleteSpeaker(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
-	if err := s.store.DeleteSpeaker(a.TenantID, r.PathValue("speaker_id")); err != nil {
+	speakerID := r.PathValue("speaker_id")
+	if err := s.store.DeleteSpeaker(a.TenantID, speakerID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.speaker.delete", "Deleted speaker", speakerID, map[string]any{"speaker_id": speakerID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
 func (s *Server) handleRevisionPrefixes(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
@@ -1111,7 +1185,7 @@ func (s *Server) handleRevisionPrefixes(w http.ResponseWriter, r *http.Request)
 
 func (s *Server) handleGetSettings(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:tenant_settings:admin") {
 		return
 	}
 	m, err := s.store.ListGlobalSettings(a.TenantID)
@@ -1124,7 +1198,7 @@ func (s *Server) handleGetSettings(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePatchSettings(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:tenant_settings:admin") {
 		return
 	}
 	var body map[string]any
@@ -1148,9 +1222,22 @@ func (s *Server) handlePatchSettings(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.settings.update", "Updated tenant settings", a.TenantID, map[string]any{"keys": settingsAuditKeys(body)})
 	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
 }
 
+func settingsAuditKeys(body map[string]any) []string {
+	if len(body) == 0 {
+		return nil
+	}
+	keys := make([]string, 0, len(body))
+	for k := range body {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
 func parseRevisionRetentionMinutes(v any) (int, bool) {
 	const minMinutes = 15
 	const maxMinutes = 30 * 24 * 60

internal/httpapi/routes_firewall.go

@@ -1,663 +1,16 @@
 package httpapi
 
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"io"
-	"net/http"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-	"time"
+import "net/http"
 
-	"evobgp/internal/authkey"
-	"evobgp/internal/firewall"
-	"evobgp/internal/firewallscripts"
-	"evobgp/internal/store"
-)
-
-func (s *Server) registerFirewallRoutes(m *http.ServeMux) {
-	m.HandleFunc("GET /firewall/install-context", s.handleFirewallInstallContext)
-	m.HandleFunc("GET /firewall/clients", s.handleListFirewallClients)
-	m.HandleFunc("GET /firewall/clients/{id}", s.handleGetFirewallClient)
-	m.HandleFunc("GET /firewall/clients/{id}/preview", s.handleFirewallClientPreview)
-	m.HandleFunc("PATCH /firewall/clients/{id}", s.handlePatchFirewallClient)
-	m.HandleFunc("POST /firewall/clients/{id}/approve", s.handleApproveFirewallClient)
-	m.HandleFunc("POST /firewall/clients/{id}/revoke", s.handleRevokeFirewallClient)
-	m.HandleFunc("DELETE /firewall/clients/{id}", s.handleDeleteFirewallClient)
-
-	m.HandleFunc("GET /firewall/rules", s.handleListFirewallRules)
-	m.HandleFunc("POST /firewall/rules", s.handleCreateFirewallRule)
-	m.HandleFunc("PATCH /firewall/rules/{id}", s.handlePatchFirewallRule)
-	m.HandleFunc("DELETE /firewall/rules/{id}", s.handleDeleteFirewallRule)
-	m.HandleFunc("POST /firewall/rules:reorder", s.handleReorderFirewallRules)
-
-	m.HandleFunc("GET /firewall/blocklist", s.handleFirewallBlocklist)
-	m.HandleFunc("POST /firewall/apply-report", s.handleFirewallApplyReport)
-	m.HandleFunc("POST /firewall/heartbeat", s.handleFirewallHeartbeat)
-}
-
-func (s *Server) handleFirewallInstallContext(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
-		return
-	}
-	seed := strings.TrimSpace(s.bundleSeedHex)
-	writeJSON(w, http.StatusOK, map[string]any{
-		"bundle_seed":            seed,
-		"bundle_seed_configured": seed != "",
-		"suggested_cp_url":       publicHTTPSBaseURL(r),
-		"install_sh_url":         publicHTTPSBaseURL(r) + "/v1/firewall/install.sh",
-	})
-}
-
-// publicHTTPSBaseURL is the external HTTPS origin for firewall install/enroll links.
-func publicHTTPSBaseURL(r *http.Request) string {
-	host := strings.TrimSpace(r.Host)
-	if xf := strings.TrimSpace(r.Header.Get("X-Forwarded-Host")); xf != "" {
-		host = strings.TrimSpace(strings.Split(xf, ",")[0])
-	}
-	if host == "" {
-		return ""
-	}
-	return "https://" + host
-}
-
-func requestBaseURL(r *http.Request) string {
-	return publicHTTPSBaseURL(r)
-}
-
-func (s *Server) handleFirewallEnrollPublic(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		writeProblem(w, http.StatusMethodNotAllowed, "Method Not Allowed", "POST required")
-		return
-	}
-	seed := strings.TrimSpace(r.Header.Get("X-EvoBGP-Seed"))
-	if seed == "" || s.bundleSeedHex == "" || !strings.EqualFold(seed, s.bundleSeedHex) {
-		writeProblem(w, http.StatusForbidden, "Forbidden", "invalid or missing X-EvoBGP-Seed")
-		return
-	}
-	var body struct {
-		Name          string `json:"name"`
-		Hostname      string `json:"hostname"`
-		ClientToken   string `json:"client_token"`
-		ClientVersion string `json:"client_version"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&body); err != nil && !errors.Is(err, io.EOF) {
-		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
-		return
-	}
-	name := strings.TrimSpace(body.Name)
-	tok := strings.TrimSpace(body.ClientToken)
-	if name == "" || tok == "" {
-		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "name and client_token are required")
-		return
-	}
-	if !strings.HasPrefix(tok, "evobgp_fw_") {
-		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "client_token must use evobgp_fw_ prefix")
-		return
-	}
-	tenantID, err := s.firewallEnrollTenantID()
-	if err != nil {
-		writeInternalError(w, "internal", err)
-		return
-	}
-	hash := authkey.HashToken(tok)
-	prefix := tok
-	if len(prefix) > 12 {
-		prefix = prefix[:12]
-	}
-	client, err := s.store.CreateFirewallClient(tenantID, &store.FirewallClientCreate{
-		Name:          name,
-		Hostname:      strings.TrimSpace(body.Hostname),
-		TokenPrefix:   prefix,
-		TokenHash:     hash,
-		ClientVersion: strings.TrimSpace(body.ClientVersion),
-	})
-	if err != nil {
-		if errors.Is(err, store.ErrInvalidInput) {
-			writeProblem(w, http.StatusConflict, "Conflict", "client token already enrolled")
-			return
-		}
-		writeStoreErr(w, err)
-		return
-	}
-	writeJSON(w, http.StatusCreated, map[string]any{
-		"client_id": client.ID,
-		"status":    client.Status,
-		"message":   "pending operator approval in EvoBGP UI",
-	})
-}
-
-func (s *Server) firewallEnrollTenantID() (string, error) {
-	tid, _, _, _, _ := s.store.DemoIDs()
-	if tid != "" {
-		return tid, nil
-	}
-	ids, err := s.store.ListTenantIDs()
-	if err != nil {
-		return "", err
-	}
-	if len(ids) == 0 {
-		return "", errors.New("httpapi: no tenant for firewall enroll")
-	}
-	return ids[0], nil
-}
-
-func (s *Server) handleFirewallInstallScript(w http.ResponseWriter, r *http.Request) {
-	s.serveFirewallScript(w, "install.sh")
-}
-
-func (s *Server) handleFirewallSyncScript(w http.ResponseWriter, r *http.Request) {
-	s.serveFirewallScript(w, "evobgp-firewall.sh")
-}
-
-func (s *Server) serveFirewallScript(w http.ResponseWriter, name string) {
-	b, err := readFirewallScript(name)
-	if err != nil {
-		writeProblem(w, http.StatusNotFound, "Not Found", "script not found")
-		return
-	}
-	w.Header().Set("Content-Type", "text/x-shellscript; charset=utf-8")
-	w.WriteHeader(http.StatusOK)
-	_, _ = w.Write(b)
-}
-
-func readFirewallScript(name string) ([]byte, error) {
-	if b, err := firewallscripts.FS.ReadFile(name); err == nil {
-		return b, nil
-	}
-	candidates := []string{}
-	if dir := strings.TrimSpace(os.Getenv("EVOBGP_FIREWALL_SCRIPTS")); dir != "" {
-		candidates = append(candidates, filepath.Join(dir, name))
-	}
-	candidates = append(candidates, filepath.Join("scripts", "firewall", name))
-	for _, p := range candidates {
-		b, err := os.ReadFile(p)
-		if err == nil {
-			return b, nil
-		}
-	}
-	return nil, os.ErrNotExist
-}
-
-func (s *Server) handleListFirewallClients(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
-		return
-	}
-	items, err := s.store.ListFirewallClients(a.TenantID)
-	if err != nil {
-		writeInternalError(w, "internal", err)
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"items": items})
-}
-
-func (s *Server) handleGetFirewallClient(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
-		return
-	}
-	id := strings.TrimSpace(r.PathValue("id"))
-	client, err := s.store.GetFirewallClient(a.TenantID, id)
-	if err != nil {
-		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
-		return
-	}
-	writeJSON(w, http.StatusOK, client)
-}
-
-func (s *Server) handlePatchFirewallClient(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
-		return
-	}
-	id := strings.TrimSpace(r.PathValue("id"))
-	var patch store.FirewallClientPatch
-	if err := json.NewDecoder(r.Body).Decode(&patch); err != nil {
-		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
-		return
-	}
-	client, err := s.store.UpdateFirewallClient(a.TenantID, id, &patch)
-	if err != nil {
-		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
-		return
-	}
-	writeJSON(w, http.StatusOK, client)
-}
-
-func (s *Server) handleApproveFirewallClient(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
-		return
-	}
-	id := strings.TrimSpace(r.PathValue("id"))
-	client, err := s.store.ApproveFirewallClient(a.TenantID, id, a.APIKeyID)
-	if err != nil {
-		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
-		return
-	}
-	_ = s.firewallResolver.Reload(s.store)
-	go s.replicateFirewallStateToSpeakers(a.TenantID)
-	writeJSON(w, http.StatusOK, client)
-}
-
-func (s *Server) handleRevokeFirewallClient(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
-		return
-	}
-	id := strings.TrimSpace(r.PathValue("id"))
-	if err := s.store.RevokeFirewallClient(a.TenantID, id); err != nil {
-		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
-		return
-	}
-	_ = s.firewallResolver.Reload(s.store)
-	go s.replicateFirewallStateToSpeakers(a.TenantID)
-	writeJSON(w, http.StatusOK, map[string]string{"status": "revoked"})
-}
-
-func (s *Server) handleDeleteFirewallClient(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
-		return
-	}
-	id := strings.TrimSpace(r.PathValue("id"))
-	if err := s.store.DeleteFirewallClient(a.TenantID, id); err != nil {
-		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
-		return
-	}
-	_ = s.firewallResolver.Reload(s.store)
-	go s.replicateFirewallStateToSpeakers(a.TenantID)
-	w.WriteHeader(http.StatusNoContent)
-}
-
-func (s *Server) handleListFirewallRules(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
-		return
-	}
-	scope := strings.TrimSpace(r.URL.Query().Get("scope"))
-	var clientID *string
-	if scope == "client" {
-		cid := strings.TrimSpace(r.URL.Query().Get("client_id"))
-		if cid == "" {
-			writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "client_id required for scope=client")
-			return
-		}
-		clientID = &cid
-	}
-	items, err := s.store.ListFirewallRules(a.TenantID, clientID)
-	if err != nil {
-		writeInternalError(w, "internal", err)
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"items": items})
-}
-
-func (s *Server) handleCreateFirewallRule(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
-		return
-	}
-	var body struct {
-		Scope       string  `json:"scope"`
-		ClientID    *string `json:"client_id"`
-		Action      string  `json:"action"`
-		CommunityID *string `json:"community_id"`
-		Comment     string  `json:"comment"`
-		Priority    *int    `json:"priority"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
-		return
-	}
-	var clientID *string
-	if strings.TrimSpace(body.Scope) == "client" {
-		if body.ClientID == nil || strings.TrimSpace(*body.ClientID) == "" {
-			writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "client_id required for scope=client")
-			return
-		}
-		cid := strings.TrimSpace(*body.ClientID)
-		clientID = &cid
-	}
-	rule, err := s.store.CreateFirewallRule(a.TenantID, clientID, &store.FirewallRuleCreate{
-		Priority:    body.Priority,
-		Action:      body.Action,
-		CommunityID: body.CommunityID,
-		Comment:     body.Comment,
-	})
-	if err != nil {
-		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "invalid rule")
-		return
-	}
-	go s.replicateFirewallStateToSpeakers(a.TenantID)
-	writeJSON(w, http.StatusCreated, rule)
-}
-
-func (s *Server) handlePatchFirewallRule(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
-		return
-	}
-	id := strings.TrimSpace(r.PathValue("id"))
-	var patch store.FirewallRulePatch
-	if err := json.NewDecoder(r.Body).Decode(&patch); err != nil {
-		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
-		return
-	}
-	rule, err := s.store.UpdateFirewallRule(a.TenantID, id, &patch)
-	if err != nil {
-		writeProblem(w, http.StatusNotFound, "Not Found", "rule not found")
-		return
-	}
-	go s.replicateFirewallStateToSpeakers(a.TenantID)
-	writeJSON(w, http.StatusOK, rule)
-}
-
-func (s *Server) handleDeleteFirewallRule(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
-		return
-	}
-	id := strings.TrimSpace(r.PathValue("id"))
-	if err := s.store.DeleteFirewallRule(a.TenantID, id); err != nil {
-		writeProblem(w, http.StatusNotFound, "Not Found", "rule not found")
-		return
-	}
-	go s.replicateFirewallStateToSpeakers(a.TenantID)
-	w.WriteHeader(http.StatusNoContent)
-}
-
-func (s *Server) handleReorderFirewallRules(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
-		return
-	}
-	var body struct {
-		Scope      string   `json:"scope"`
-		ClientID   *string  `json:"client_id"`
-		OrderedIDs []string `json:"ordered_ids"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
-		return
-	}
-	var clientID *string
-	if strings.TrimSpace(body.Scope) == "client" {
-		if body.ClientID == nil || strings.TrimSpace(*body.ClientID) == "" {
-			writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "client_id required")
-			return
-		}
-		cid := strings.TrimSpace(*body.ClientID)
-		clientID = &cid
-	}
-	if err := s.store.ReorderFirewallRules(a.TenantID, clientID, body.OrderedIDs); err != nil {
-		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "invalid reorder")
-		return
-	}
-	go s.replicateFirewallStateToSpeakers(a.TenantID)
-	writeJSON(w, http.StatusOK, map[string]bool{"ok": true})
-}
-
-func (s *Server) handleFirewallBlocklist(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireFirewall(w, a) {
-		return
-	}
-	client, err := s.store.GetFirewallClient(a.TenantID, a.APIKeyID)
-	if err != nil {
-		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "unknown firewall client")
-		return
-	}
-	if client.Status != "approved" {
-		w.Header().Set("Retry-After", "60")
-		writeProblem(w, http.StatusForbidden, "Forbidden", "client pending approval")
-		return
-	}
-	_ = s.store.TouchFirewallClientLastSeen(client.ID, "cp", clientIP(r), r.UserAgent())
-	resp, err := s.buildFirewallBlocklist(r.Context(), client)
-	if err != nil {
-		if errors.Is(err, errNoFirewallRevision) {
-			writeProblem(w, http.StatusNotFound, "Not Found", "no published revision")
-			return
-		}
-		writeInternalError(w, "internal", err)
-		return
-	}
-	w.Header().Set("X-EvoBGP-Source", "cp")
-	w.Header().Set("X-EvoBGP-Revision-ID", resp.RevisionID)
-	w.Header().Set("X-EvoBGP-Generated-At", resp.GeneratedAt)
-	w.Header().Set("X-EvoBGP-Rules-Version", resp.RulesVersion)
-	if strings.Contains(r.Header.Get("Accept"), "text/plain") {
-		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
-		for _, p := range resp.Prefixes {
-			_, _ = w.Write([]byte(p + "\n"))
-		}
-		return
-	}
-	writeJSON(w, http.StatusOK, resp)
-}
-
-func (s *Server) handleFirewallApplyReport(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireFirewall(w, a) {
-		return
-	}
-	var body struct {
-		Status          string `json:"status"`
-		Error           string `json:"error"`
-		PrefixCount     int    `json:"prefix_count"`
-		IPCount         int    `json:"ip_count"`
-		PacketsDropped  int64  `json:"packets_dropped"`
-		PacketsAccepted int64  `json:"packets_accepted"`
-		Version         string `json:"version"`
-		KernelMethod    string `json:"kernel_method"`
-		Source          string `json:"source"`
-	}
-	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
-		return
-	}
-	src := strings.TrimSpace(body.Source)
-	if src == "" {
-		src = "cp"
-	}
-	_ = s.store.TouchFirewallClientLastApply(
-		a.APIKeyID, src, body.Status, body.Error,
-		body.PrefixCount, body.IPCount, body.PacketsDropped, body.PacketsAccepted,
-	)
-	writeJSON(w, http.StatusOK, map[string]bool{"ok": true})
-}
-
-func (s *Server) handleFirewallHeartbeat(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireFirewall(w, a) {
-		return
-	}
-	var body struct {
-		Source string `json:"source"`
-	}
-	_ = json.NewDecoder(r.Body).Decode(&body)
-	src := strings.TrimSpace(body.Source)
-	if src == "" {
-		src = "cp"
-	}
-	_ = s.store.TouchFirewallClientLastSeen(a.APIKeyID, src, clientIP(r), r.UserAgent())
-	writeJSON(w, http.StatusOK, map[string]bool{"ok": true})
-}
-
-func (s *Server) handleFirewallClientPreview(w http.ResponseWriter, r *http.Request) {
-	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
-		return
-	}
-	id := strings.TrimSpace(r.PathValue("id"))
-	client, err := s.store.GetFirewallClient(a.TenantID, id)
-	if err != nil {
-		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
-		return
-	}
-	resp, err := s.buildFirewallBlocklist(r.Context(), client)
-	if err != nil {
-		if errors.Is(err, errNoFirewallRevision) {
-			writeProblem(w, http.StatusNotFound, "Not Found", "no published revision")
-			return
-		}
-		writeInternalError(w, "internal", err)
-		return
-	}
-	writeJSON(w, http.StatusOK, resp)
-}
-
-var errNoFirewallRevision = errors.New("httpapi: no firewall revision")
-
-type firewallBlocklistResponse struct {
-	ClientID             string   `json:"client_id"`
-	RevisionID           string   `json:"revision_id"`
-	GeneratedAt          string   `json:"generated_at"`
-	Source               string   `json:"source"`
-	RulesApplied         int      `json:"rules_applied"`
-	CommunitiesEvaluated int      `json:"communities_evaluated"`
-	CommunitiesBlocked   int      `json:"communities_blocked"`
-	Prefixes             []string `json:"prefixes"`
-	Total                int      `json:"total"`
-	Hash                 string   `json:"hash"`
-	RulesVersion         string   `json:"-"`
-}
-
-func (s *Server) buildFirewallBlocklist(ctx context.Context, client *store.FirewallClient) (*firewallBlocklistResponse, error) {
-	_ = ctx
-	revs, _, _ := s.store.ListRevisions(client.TenantID, "", "", 1)
-	if len(revs) == 0 {
-		return nil, errNoFirewallRevision
-	}
-	rev := revs[0]
-	prefixesByCommunity, commCount, err := s.loadPrefixesByCommunity(client.TenantID, rev.ID)
-	if err != nil {
-		return nil, err
-	}
-	rules, err := s.store.ListAllFirewallRulesForClient(client.TenantID, client.ID)
-	if err != nil {
-		return nil, err
-	}
-	fwRules := storeRulesToFirewall(rules)
-	blocked := firewall.Evaluate(client.ID, fwRules, prefixesByCommunity)
-	blockedComm := countBlockedCommunities(client.ID, fwRules, prefixesByCommunity)
-	hash := prefixListHash(blocked)
-	return &firewallBlocklistResponse{
-		ClientID:             client.ID,
-		RevisionID:           rev.ID,
-		GeneratedAt:          time.Now().UTC().Format(time.RFC3339),
-		Source:               "cp",
-		RulesApplied:         len(rules),
-		CommunitiesEvaluated: commCount,
-		CommunitiesBlocked:   blockedComm,
-		Prefixes:             blocked,
-		Total:                len(blocked),
-		Hash:                 hash,
-		RulesVersion:         firewall.RulesVersionHash(fwRules),
-	}, nil
-}
-
-func (s *Server) loadPrefixesByCommunity(tenantID, revisionID string) (map[string][]string, int, error) {
-	out := make(map[string][]string)
-	communities := make(map[string]struct{})
-	cursor := ""
-	for {
-		rows, next, more := s.store.ListRevisionPrefixes(tenantID, revisionID, cursor, 5000)
-		for _, row := range rows {
-			key := ""
-			if row.CommunityID != nil {
-				key = strings.TrimSpace(*row.CommunityID)
-			}
-			communities[key] = struct{}{}
-			out[key] = append(out[key], strings.TrimSpace(row.Prefix))
-		}
-		if !more {
-			break
-		}
-		cursor = next
-	}
-	return out, len(communities), nil
-}
-
-func storeRulesToFirewall(rules []*store.FirewallRule) []firewall.Rule {
-	out := make([]firewall.Rule, 0, len(rules))
-	for _, r := range rules {
-		var cid *string
-		if r.CommunityID != nil {
-			v := *r.CommunityID
-			cid = &v
-		}
-		var cl *string
-		if r.ClientID != nil {
-			v := *r.ClientID
-			cl = &v
-		}
-		out = append(out, firewall.Rule{
-			ClientID:    cl,
-			Priority:    r.Priority,
-			Action:      r.Action,
-			CommunityID: cid,
-		})
-	}
-	return out
-}
-
-func countBlockedCommunities(clientID string, rules []firewall.Rule, prefixesByCommunity map[string][]string) int {
-	n := 0
-	for k := range prefixesByCommunity {
-		ordered := mergeRulesForCount(clientID, rules)
-		for _, r := range ordered {
-			if r.CommunityID == nil || strings.TrimSpace(*r.CommunityID) == k {
-				if strings.EqualFold(r.Action, "block") {
-					n++
-				}
-				break
-			}
-		}
-	}
-	return n
-}
-
-func mergeRulesForCount(clientID string, rules []firewall.Rule) []firewall.Rule {
-	var clientRules, tenantRules []firewall.Rule
-	for _, r := range rules {
-		if r.ClientID != nil && *r.ClientID == clientID {
-			clientRules = append(clientRules, r)
-			continue
-		}
-		if r.ClientID == nil {
-			tenantRules = append(tenantRules, r)
-		}
-	}
-	sort.Slice(clientRules, func(i, j int) bool { return clientRules[i].Priority < clientRules[j].Priority })
-	sort.Slice(tenantRules, func(i, j int) bool { return tenantRules[i].Priority < tenantRules[j].Priority })
-	out := append([]firewall.Rule{}, clientRules...)
-	return append(out, tenantRules...)
-}
-
-func prefixListHash(prefixes []string) string {
-	cp := append([]string(nil), prefixes...)
-	sort.Strings(cp)
-	sum := sha256.Sum256([]byte(strings.Join(cp, "\n")))
-	return "sha256:" + hex.EncodeToString(sum[:])
-}
-
-func clientIP(r *http.Request) string {
-	if xff := strings.TrimSpace(r.Header.Get("X-Forwarded-For")); xff != "" {
-		parts := strings.Split(xff, ",")
-		return strings.TrimSpace(parts[0])
-	}
-	host := r.RemoteAddr
-	if i := strings.LastIndex(host, ":"); i >= 0 {
-		return host[:i]
-	}
-	return host
+// handleFirewallGone responds 410 Gone for every legacy /v1/firewall/* endpoint
+// (enroll, install.sh, sync-script, clients, rules, blocklist, apply-report,
+// heartbeat, install-context). The firewall subsystem (client enrollment,
+// block/accept rules, blocklist distribution) has moved to the standalone
+// EvoFirewall service; see docs/firewall.md.
+//
+// Existing firewall_client / firewall_rule tables and store code (memory_firewall.go,
+// postgres_firewall.go, firewall_types.go) are intentionally left in place — only the
+// HTTP surface is decommissioned here.
+func (s *Server) handleFirewallGone(w http.ResponseWriter, r *http.Request) {
+	writeProblem(w, http.StatusGone, "Gone", "firewall feature moved to EvoFirewall — see docs/firewall.md")
 }

internal/httpapi/routes_firewall_test.go

@@ -1,19 +1,15 @@
 package httpapi
 
 import (
-	"encoding/json"
-	"errors"
-	"io"
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"testing"
-
-	"evobgp/internal/authkey"
-	"evobgp/internal/store"
 )
 
-func TestFirewallEnrollAndBlocklist(t *testing.T) {
+// TestFirewallRoutesGone verifies the firewall subsystem HTTP surface has been
+// decommissioned in favor of the standalone EvoFirewall service (see docs/firewall.md).
+// Every legacy /v1/firewall/* path — public and authenticated — must answer 410 Gone.
+func TestFirewallRoutesGone(t *testing.T) {
 	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
 	if err != nil {
 		t.Fatal(err)
@@ -26,279 +22,37 @@ func TestFirewallEnrollAndBlocklist(t *testing.T) {
 	defer ts.Close()
 	client := ts.Client()
 
-	tok := "evobgp_fw_testtoken123456789012345678901234"
-	enrollBody := `{"name":"web-01","hostname":"web-01.local","client_token":"` + tok + `","client_version":"test/1"}`
-	reqEnroll, _ := http.NewRequest(http.MethodPost, ts.URL+"/v1/firewall/enroll", strings.NewReader(enrollBody))
-	reqEnroll.Header.Set("Content-Type", "application/json")
-	reqEnroll.Header.Set("X-EvoBGP-Seed", testBundleSeed)
-	respEnroll, err := client.Do(reqEnroll)
-	if err != nil {
-		t.Fatal(err)
+	cases := []struct {
+		method string
+		path   string
+		auth   bool // send a valid operator bearer token
+	}{
+		{http.MethodPost, "/v1/firewall/enroll", false},
+		{http.MethodGet, "/v1/firewall/install.sh", false},
+		{http.MethodGet, "/v1/firewall/sync-script", false},
+		{http.MethodGet, "/v1/firewall/install-context", true},
+		{http.MethodGet, "/v1/firewall/clients", true},
+		{http.MethodGet, "/v1/firewall/clients/any-id", true},
+		{http.MethodGet, "/v1/firewall/rules", true},
+		{http.MethodGet, "/v1/firewall/blocklist", false},
+		{http.MethodPost, "/v1/firewall/apply-report", false},
+		{http.MethodPost, "/v1/firewall/heartbeat", false},
 	}
-	defer func() { _ = respEnroll.Body.Close() }()
-	if respEnroll.StatusCode != http.StatusCreated {
-		b, _ := io.ReadAll(respEnroll.Body)
-		t.Fatalf("enroll status=%d body=%s", respEnroll.StatusCode, b)
-	}
-	var enroll map[string]any
-	if err := json.NewDecoder(respEnroll.Body).Decode(&enroll); err != nil {
-		t.Fatal(err)
-	}
-	clientID, _ := enroll["client_id"].(string)
-	if clientID == "" {
-		t.Fatal("missing client_id")
-	}
-
-	reqBlock, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/firewall/blocklist", nil)
-	reqBlock.Header.Set("Authorization", "Bearer "+tok)
-	respBlock, err := client.Do(reqBlock)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = respBlock.Body.Close() }()
-	if respBlock.StatusCode != http.StatusForbidden {
-		t.Fatalf("pending blocklist want 403 got %d", respBlock.StatusCode)
-	}
-
-	reqApprove, _ := http.NewRequest(http.MethodPost, ts.URL+"/v1/firewall/clients/"+clientID+"/approve", nil)
-	reqApprove.Header.Set("Authorization", "Bearer opkey")
-	respApprove, err := client.Do(reqApprove)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = respApprove.Body.Close() }()
-	if respApprove.StatusCode != http.StatusOK {
-		b, _ := io.ReadAll(respApprove.Body)
-		t.Fatalf("approve status=%d body=%s", respApprove.StatusCode, b)
-	}
-
-	_, err = srv.Store().CreateFirewallRule(tenant, nil, &store.FirewallRuleCreate{Action: "accept", Comment: "default"})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	reqBlock2, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/firewall/blocklist", nil)
-	reqBlock2.Header.Set("Authorization", "Bearer "+tok)
-	respBlock2, err := client.Do(reqBlock2)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = respBlock2.Body.Close() }()
-	if respBlock2.StatusCode != http.StatusOK {
-		b, _ := io.ReadAll(respBlock2.Body)
-		t.Fatalf("blocklist status=%d body=%s", respBlock2.StatusCode, b)
-	}
-	var bl map[string]any
-	if err := json.NewDecoder(respBlock2.Body).Decode(&bl); err != nil {
-		t.Fatal(err)
-	}
-	if total, _ := bl["total"].(float64); total != 0 {
-		t.Fatalf("accept-only want empty blocklist, total=%v", total)
-	}
-
-	reportBody := `{"status":"ok","prefix_count":0,"ip_count":0,"packets_dropped":42,"packets_accepted":1000,"source":"cp","kernel_method":"nft"}`
-	reqReport, _ := http.NewRequest(http.MethodPost, ts.URL+"/v1/firewall/apply-report", strings.NewReader(reportBody))
-	reqReport.Header.Set("Authorization", "Bearer "+tok)
-	reqReport.Header.Set("Content-Type", "application/json")
-	respReport, err := client.Do(reqReport)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = respReport.Body.Close() }()
-	if respReport.StatusCode != http.StatusOK {
-		b, _ := io.ReadAll(respReport.Body)
-		t.Fatalf("apply-report status=%d body=%s", respReport.StatusCode, b)
-	}
-	gotClient, err := srv.Store().GetFirewallClient(tenant, clientID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if gotClient.LastApplyPacketsDropped != 42 || gotClient.LastApplyPacketsAccepted != 1000 {
-		t.Fatalf("packet stats dropped=%d accepted=%d", gotClient.LastApplyPacketsDropped, gotClient.LastApplyPacketsAccepted)
-	}
-}
-
-func TestFirewallEnrollBadSeed(t *testing.T) {
-	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer srv.Close()
-	ts := httptest.NewServer(srv.Handler())
-	defer ts.Close()
-
-	body := `{"name":"x","client_token":"evobgp_fw_` + strings.Repeat("a", 40) + `"}`
-	req, _ := http.NewRequest(http.MethodPost, ts.URL+"/v1/firewall/enroll", strings.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("X-EvoBGP-Seed", "deadbeef")
-	resp, err := ts.Client().Do(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = resp.Body.Close() }()
-	if resp.StatusCode != http.StatusForbidden {
-		t.Fatalf("want 403 got %d", resp.StatusCode)
-	}
-}
-
-func TestFirewallInstallScriptPublic(t *testing.T) {
-	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer srv.Close()
-	ts := httptest.NewServer(srv.Handler())
-	defer ts.Close()
-
-	for _, path := range []string{"/v1/firewall/install.sh", "/v1/firewall/sync-script"} {
-		req, _ := http.NewRequest(http.MethodGet, ts.URL+path, nil)
-		resp, err := ts.Client().Do(req)
+	for _, tc := range cases {
+		req, err := http.NewRequest(tc.method, ts.URL+tc.path, nil)
 		if err != nil {
 			t.Fatal(err)
 		}
-		func() {
-			defer func() { _ = resp.Body.Close() }()
-			if resp.StatusCode != http.StatusOK {
-				b, _ := io.ReadAll(resp.Body)
-				t.Fatalf("%s status=%d body=%s", path, resp.StatusCode, b)
-			}
-			ct := resp.Header.Get("Content-Type")
-			if !strings.Contains(ct, "shellscript") {
-				t.Fatalf("%s content-type=%q", path, ct)
-			}
-			b, _ := io.ReadAll(resp.Body)
-			if !strings.HasPrefix(string(b), "#!/") {
-				t.Fatalf("%s missing shebang", path)
-			}
-		}()
-	}
-}
-
-func TestFirewallInstallContext(t *testing.T) {
-	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer srv.Close()
-	tenant, _, _, _, _ := srv.Store().DemoIDs()
-	mustSetTestAPIKeys(t, srv, "opkey|"+tenant+"|operator,vwkey|"+tenant+"|viewer")
-
-	ts := httptest.NewServer(srv.Handler())
-	defer ts.Close()
-	client := ts.Client()
-
-	reqOp, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/firewall/install-context", nil)
-	reqOp.Header.Set("Authorization", "Bearer opkey")
-	respOp, err := client.Do(reqOp)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = respOp.Body.Close() }()
-	if respOp.StatusCode != http.StatusOK {
-		b, _ := io.ReadAll(respOp.Body)
-		t.Fatalf("operator install-context status=%d body=%s", respOp.StatusCode, b)
-	}
-	var ctx map[string]any
-	if err := json.NewDecoder(respOp.Body).Decode(&ctx); err != nil {
-		t.Fatal(err)
-	}
-	if seed, _ := ctx["bundle_seed"].(string); seed != testBundleSeed {
-		t.Fatalf("bundle_seed=%q want %q", seed, testBundleSeed)
-	}
-	if configured, _ := ctx["bundle_seed_configured"].(bool); !configured {
-		t.Fatal("bundle_seed_configured want true")
-	}
-	if url, _ := ctx["suggested_cp_url"].(string); !strings.HasPrefix(url, "https://") {
-		t.Fatalf("suggested_cp_url=%q want https", url)
-	}
-	if url, _ := ctx["install_sh_url"].(string); !strings.HasPrefix(url, "https://") || !strings.HasSuffix(url, "/v1/firewall/install.sh") {
-		t.Fatalf("install_sh_url=%q", url)
-	}
-
-	reqVw, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/firewall/install-context", nil)
-	reqVw.Header.Set("Authorization", "Bearer vwkey")
-	respVw, err := client.Do(reqVw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = respVw.Body.Close() }()
-	if respVw.StatusCode != http.StatusForbidden {
-		t.Fatalf("viewer install-context want 403 got %d", respVw.StatusCode)
-	}
-}
-
-func TestFirewallDeletePendingClient(t *testing.T) {
-	srv, err := New(Options{SeedDemo: true, BundleSeedHex: testBundleSeed})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer srv.Close()
-	tenant, _, _, _, _ := srv.Store().DemoIDs()
-	mustSetTestAPIKeys(t, srv, "opkey|"+tenant+"|operator")
-
-	ts := httptest.NewServer(srv.Handler())
-	defer ts.Close()
-	client := ts.Client()
-
-	tok := "evobgp_fw_revoketest123456789012345678901"
-	enrollBody := `{"name":"reject-me","hostname":"test.local","client_token":"` + tok + `","client_version":"test/1"}`
-	reqEnroll, _ := http.NewRequest(http.MethodPost, ts.URL+"/v1/firewall/enroll", strings.NewReader(enrollBody))
-	reqEnroll.Header.Set("Content-Type", "application/json")
-	reqEnroll.Header.Set("X-EvoBGP-Seed", testBundleSeed)
-	respEnroll, err := client.Do(reqEnroll)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = respEnroll.Body.Close() }()
-	if respEnroll.StatusCode != http.StatusCreated {
-		b, _ := io.ReadAll(respEnroll.Body)
-		t.Fatalf("enroll status=%d body=%s", respEnroll.StatusCode, b)
-	}
-	var enroll map[string]any
-	if err := json.NewDecoder(respEnroll.Body).Decode(&enroll); err != nil {
-		t.Fatal(err)
-	}
-	clientID, _ := enroll["client_id"].(string)
-	if clientID == "" {
-		t.Fatal("missing client_id")
-	}
-
-	reqDelete, _ := http.NewRequest(http.MethodDelete, ts.URL+"/v1/firewall/clients/"+clientID, nil)
-	reqDelete.Header.Set("Authorization", "Bearer opkey")
-	respDelete, err := client.Do(reqDelete)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = respDelete.Body.Close() }()
-	if respDelete.StatusCode != http.StatusNoContent {
-		b, _ := io.ReadAll(respDelete.Body)
-		t.Fatalf("delete status=%d body=%s", respDelete.StatusCode, b)
-	}
-
-	_, err = srv.Store().GetFirewallClient(tenant, clientID)
-	if err == nil {
-		t.Fatal("client should be deleted")
-	}
-	if !errors.Is(err, store.ErrNotFound) {
-		t.Fatalf("delete err=%v", err)
-	}
-
-	reqBlock, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/firewall/blocklist", nil)
-	reqBlock.Header.Set("Authorization", "Bearer "+tok)
-	respBlock, err := client.Do(reqBlock)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = respBlock.Body.Close() }()
-	if respBlock.StatusCode != http.StatusUnauthorized {
-		t.Fatalf("deleted blocklist want 401 got %d", respBlock.StatusCode)
-	}
-}
-
-func TestFirewallTokenHashMatchesAuthkey(t *testing.T) {
-	tok := "evobgp_fw_sample"
-	h := authkey.HashToken(tok)
-	if len(h) != 32 {
-		t.Fatalf("hash len %d", len(h))
+		if tc.auth {
+			req.Header.Set("Authorization", "Bearer opkey")
+		}
+		resp, err := client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		_ = resp.Body.Close()
+		if resp.StatusCode != http.StatusGone {
+			t.Fatalf("%s %s: want 410 got %d", tc.method, tc.path, resp.StatusCode)
+		}
 	}
 }

internal/httpapi/routes_lookup.go

@@ -16,7 +16,7 @@ func (s *Server) handleLookup(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:lookup:read") {
 		return
 	}
 	q := strings.TrimSpace(r.URL.Query().Get("q"))

internal/httpapi/routes_maintenance.go

@@ -62,7 +62,7 @@ func maintenancePolicyJSON(p *store.MaintenancePolicy) map[string]any {
 
 func (s *Server) handleListMaintenancePolicies(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	cursor := r.URL.Query().Get("cursor")
@@ -81,7 +81,7 @@ func (s *Server) handleListMaintenancePolicies(w http.ResponseWriter, r *http.Re
 
 func (s *Server) handleGetMaintenancePolicy(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	p, err := s.store.GetMaintenancePolicy(r.PathValue("id"))
@@ -163,7 +163,7 @@ func (s *Server) handleDeleteMaintenancePolicy(w http.ResponseWriter, r *http.Re
 
 func (s *Server) handleMaintenancePolicyHints(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	if s.maintStats == nil {
@@ -185,7 +185,7 @@ func (s *Server) handleMaintenancePolicyHints(w http.ResponseWriter, r *http.Req
 
 func (s *Server) handleListMaintenanceConfigAudit(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	cursor := r.URL.Query().Get("cursor")

internal/httpapi/routes_postgres_maintenance.go

@@ -27,12 +27,10 @@ func (s *Server) registerPostgresMaintenanceRoutes(m *http.ServeMux) {
 	m.HandleFunc("GET /postgres/maintenance/logs", s.handlePostgresMaintenanceLogs)
 }
 
+// requireOperatorStrict is a compatibility shim mapping the legacy "operator"
+// API-key role to the tenant-settings admin permission for JWT/API-key clients.
 func (s *Server) requireOperatorStrict(w http.ResponseWriter, a Auth) bool {
-	if strings.ToLower(a.Role) != "operator" {
-		writeProblem(w, http.StatusForbidden, "Forbidden", "operator role required")
-		return false
-	}
-	return true
+	return s.requirePerm(w, a, "bgp:tenant_settings:admin")
 }
 
 func (s *Server) checkPgMaintRateLimit(tenantID, kind string) bool {
@@ -201,7 +199,7 @@ func (s *Server) handlePostgresCleanup(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostgresMaintenanceLogs(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	cursor := r.URL.Query().Get("cursor")

internal/httpapi/routes_postgres_monitoring.go

@@ -35,7 +35,7 @@ func parseLimitQuery(r *http.Request, def, max int) int {
 
 func (s *Server) handlePostgresOverview(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
@@ -50,7 +50,7 @@ func (s *Server) handlePostgresOverview(w http.ResponseWriter, r *http.Request)
 
 func (s *Server) handlePostgresQueries(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
@@ -65,7 +65,7 @@ func (s *Server) handlePostgresQueries(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostgresLocks(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
@@ -80,7 +80,7 @@ func (s *Server) handlePostgresLocks(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostgresTables(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
@@ -95,7 +95,7 @@ func (s *Server) handlePostgresTables(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostgresRecommendations(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
@@ -110,7 +110,7 @@ func (s *Server) handlePostgresRecommendations(w http.ResponseWriter, r *http.Re
 
 func (s *Server) handleMonitoringCorrelation(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	window := 60

internal/httpapi/routes_revisions_prune.go

@@ -52,7 +52,7 @@ func (s *Server) resolveRevisionRetentionMinutesBody(r *http.Request, tenantID s
 
 func (s *Server) handleRevisionPruneEstimate(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	minutes, valid := s.resolveRevisionRetentionMinutesQuery(r, a.TenantID)
@@ -78,7 +78,7 @@ func (s *Server) handleRevisionPruneEstimate(w http.ResponseWriter, r *http.Requ
 
 func (s *Server) handleRevisionPrune(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:operations:admin") {
 		return
 	}
 	minutes, valid := s.resolveRevisionRetentionMinutesBody(r, a.TenantID)

internal/httpapi/routes_runtime_logs.go

@@ -70,7 +70,7 @@ func runtimeLogCleanupAuditJSON(row *store.RuntimeLogCleanupAudit) map[string]an
 
 func (s *Server) handleListRuntimeLogFiles(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requireRuntimeLogs(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requireRuntimeLogs(w) {
 		return
 	}
 	items, err := s.runtimeLogs.ListFiles()
@@ -87,7 +87,7 @@ func (s *Server) handleListRuntimeLogFiles(w http.ResponseWriter, r *http.Reques
 
 func (s *Server) handleGetRuntimeLogTail(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requireRuntimeLogs(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requireRuntimeLogs(w) {
 		return
 	}
 	filename := r.PathValue("filename")
@@ -111,7 +111,7 @@ func (s *Server) handleGetRuntimeLogTail(w http.ResponseWriter, r *http.Request)
 
 func (s *Server) handleDeleteRuntimeLogFile(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") || !s.requireRuntimeLogs(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:tenant_settings:admin") || !s.requireRuntimeLogs(w) {
 		return
 	}
 	filename := r.PathValue("filename")
@@ -157,7 +157,7 @@ func (s *Server) runtimeLogAutoPolicy(w http.ResponseWriter, r *http.Request, te
 
 func (s *Server) handleRuntimeLogAutoEstimate(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") || !s.requireRuntimeLogs(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:tenant_settings:admin") || !s.requireRuntimeLogs(w) {
 		return
 	}
 	policy, ok := s.runtimeLogAutoPolicy(w, r, a.TenantID)
@@ -199,7 +199,7 @@ func (s *Server) handleRuntimeLogAutoEstimate(w http.ResponseWriter, r *http.Req
 
 func (s *Server) handleRuntimeLogAutoRun(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") || !s.requireRuntimeLogs(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:tenant_settings:admin") || !s.requireRuntimeLogs(w) {
 		return
 	}
 	policy, ok := s.runtimeLogAutoPolicy(w, r, a.TenantID)
@@ -221,7 +221,7 @@ func (s *Server) handleRuntimeLogAutoRun(w http.ResponseWriter, r *http.Request)
 
 func (s *Server) handleListRuntimeLogCleanupAudit(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") {
 		return
 	}
 	cursor := r.URL.Query().Get("cursor")

internal/httpapi/server.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"evobgp/internal/audit"
 	"evobgp/internal/jobs"
 	"evobgp/internal/maintenance"
 	"evobgp/internal/pgmonitor"
@@ -36,6 +37,15 @@ type Server struct {
 	runtimeLogs             *runtimelogs.Service
 	runtimeLogsPolicyTenant string
 	mux                     *http.ServeMux
+
+	// Portal / dual-auth (JWT) configuration.
+	jwtSecret         string
+	authIssuer        string
+	authPortalURL     string
+	portalTenantID    string
+	authRequired      bool
+	auditIngestSecret string
+	auditPusher       *audit.PortalPusher
 }
 
 // Options configures the API server.
@@ -49,6 +59,15 @@ type Options struct {
 	CORSAllowedOrigins string
 	// RuntimeLogsPolicyTenant overrides tenant for auto-cleanup scheduler settings (optional).
 	RuntimeLogsPolicyTenant string
+
+	// Portal / dual-auth (JWT) — leave empty to disable JWT path.
+	JWTSecret      string // AUTH_JWT_SECRET / EVOBGP_AUTH_JWT_SECRET (HS256 shared secret)
+	AuthIssuer     string // AUTH_ISSUER (expected iss claim; default https://auth.shnt.top)
+	AuthPortalURL  string // AUTH_PORTAL_URL (returned by /v1/auth/config for the UI)
+	PortalTenantID string // fallback when JWT has no bgp_tenant_id / tenants.bgp
+	AuthRequired   bool   // AUTH_REQUIRED / EVOBGP_AUTH_REQUIRED (surfaced via /v1/auth/config)
+	// AuditIngestSecret — AUTH_AUDIT_INGEST_SECRET for portal push (optional).
+	AuditIngestSecret string
 }
 
 // New constructs Server and wiring for async jobs.
@@ -104,7 +123,17 @@ func New(opts Options) (*Server, error) {
 		cdnHTTP:                 NewCDNHTTPClient(),
 		runtimeLogs:             runtimelogs.NewService(runtimelogs.ConfigFromEnv()),
 		runtimeLogsPolicyTenant: strings.TrimSpace(opts.RuntimeLogsPolicyTenant),
+		jwtSecret:               strings.TrimSpace(opts.JWTSecret),
+		authIssuer:              strings.TrimSpace(opts.AuthIssuer),
+		authPortalURL:           strings.TrimSpace(opts.AuthPortalURL),
+		portalTenantID:          strings.TrimSpace(opts.PortalTenantID),
+		authRequired:            opts.AuthRequired,
+		auditIngestSecret:       strings.TrimSpace(opts.AuditIngestSecret),
 	}
+	if s.authIssuer == "" {
+		s.authIssuer = "https://auth.shnt.top"
+	}
+	s.initAuditPusher(s.authPortalURL, s.auditIngestSecret)
 	s.mux = http.NewServeMux()
 	s.registerRoutes()
 	return s, nil

internal/httpapi/speakers.go

@@ -71,7 +71,7 @@ func speakerJSONFromStore(st store.Backend, sp *store.Speaker) map[string]any {
 
 func (s *Server) handleBundleSigningPublicKey(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:read") {
 		return
 	}
 	writeJSON(w, http.StatusOK, map[string]any{

internal/repository/postgres.go

@@ -119,7 +119,7 @@ func (p *Postgres) ListModules(tenantID string) []*store.Module {
 	ctx := context.Background()
 	rows, err := p.pool.Query(ctx, `
 		SELECT id, type, name, enabled, priority, doh_profile_id::text, doh_resolver_policy,
-			refresh_interval_sec, cron_expr, default_community_id::text, last_refreshed_at
+			refresh_interval_sec, cron_expr, default_community_id::text, last_refreshed_at, created_by_user_id
 		FROM module WHERE tenant_id = $1 AND deleted_at IS NULL ORDER BY priority, name`, tenantID)
 	if err != nil {
 		return nil
@@ -133,7 +133,8 @@ func (p *Postgres) ListModules(tenantID string) []*store.Module {
 		var doh, dc, cron *string
 		var refresh *int32
 		var last *time.Time
-		if err := rows.Scan(&m.ID, &m.Type, &m.Name, &m.Enabled, &m.Priority, &doh, &m.DohResolverPolicy, &refresh, &cron, &dc, &last); err != nil {
+		var createdBy *string
+		if err := rows.Scan(&m.ID, &m.Type, &m.Name, &m.Enabled, &m.Priority, &doh, &m.DohResolverPolicy, &refresh, &cron, &dc, &last, &createdBy); err != nil {
 			continue
 		}
 		m.DohResolverPolicy = store.NormalizeDohResolverPolicy(m.DohResolverPolicy)
@@ -153,6 +154,9 @@ func (p *Postgres) ListModules(tenantID string) []*store.Module {
 			t := last.UTC()
 			m.LastRefreshedAt = &t
 		}
+		if createdBy != nil {
+			m.CreatedByUserID = strings.TrimSpace(*createdBy)
+		}
 		out = append(out, &m)
 		moduleByID[m.ID] = &m
 	}
@@ -175,7 +179,7 @@ func (p *Postgres) ListModulesPage(tenantID, cursor string, limit int) ([]*store
 	ctx := context.Background()
 	rows, err := p.pool.Query(ctx, `
 		SELECT id, type, name, enabled, priority, doh_profile_id::text, doh_resolver_policy,
-			refresh_interval_sec, cron_expr, default_community_id::text, last_refreshed_at
+			refresh_interval_sec, cron_expr, default_community_id::text, last_refreshed_at, created_by_user_id
 		FROM module WHERE tenant_id = $1 AND deleted_at IS NULL
 		ORDER BY priority, name
 		LIMIT $2 OFFSET $3`, tenantID, limit+1, off)
@@ -191,7 +195,8 @@ func (p *Postgres) ListModulesPage(tenantID, cursor string, limit int) ([]*store
 		var doh, dc, cron *string
 		var refresh *int32
 		var last *time.Time
-		if err := rows.Scan(&m.ID, &m.Type, &m.Name, &m.Enabled, &m.Priority, &doh, &m.DohResolverPolicy, &refresh, &cron, &dc, &last); err != nil {
+		var createdBy *string
+		if err := rows.Scan(&m.ID, &m.Type, &m.Name, &m.Enabled, &m.Priority, &doh, &m.DohResolverPolicy, &refresh, &cron, &dc, &last, &createdBy); err != nil {
 			continue
 		}
 		m.DohResolverPolicy = store.NormalizeDohResolverPolicy(m.DohResolverPolicy)
@@ -211,6 +216,9 @@ func (p *Postgres) ListModulesPage(tenantID, cursor string, limit int) ([]*store
 			t := last.UTC()
 			m.LastRefreshedAt = &t
 		}
+		if createdBy != nil {
+			m.CreatedByUserID = strings.TrimSpace(*createdBy)
+		}
 		out = append(out, &m)
 		moduleByID[m.ID] = &m
 	}
@@ -238,11 +246,12 @@ func (p *Postgres) GetModule(tenantID, moduleID string) (*store.Module, error) {
 	var doh, dc, cron *string
 	var refresh *int32
 	var last *time.Time
+	var createdBy *string
 	err := p.pool.QueryRow(ctx, `
 		SELECT id, type, name, enabled, priority, doh_profile_id::text, doh_resolver_policy,
-			refresh_interval_sec, cron_expr, default_community_id::text, last_refreshed_at
+			refresh_interval_sec, cron_expr, default_community_id::text, last_refreshed_at, created_by_user_id
 		FROM module WHERE id = $1 AND tenant_id = $2 AND deleted_at IS NULL`, moduleID, tenantID).Scan(
-		&m.ID, &m.Type, &m.Name, &m.Enabled, &m.Priority, &doh, &m.DohResolverPolicy, &refresh, &cron, &dc, &last)
+		&m.ID, &m.Type, &m.Name, &m.Enabled, &m.Priority, &doh, &m.DohResolverPolicy, &refresh, &cron, &dc, &last, &createdBy)
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, store.ErrNotFound
@@ -265,6 +274,9 @@ func (p *Postgres) GetModule(tenantID, moduleID string) (*store.Module, error) {
 		t := last.UTC()
 		m.LastRefreshedAt = &t
 	}
+	if createdBy != nil {
+		m.CreatedByUserID = strings.TrimSpace(*createdBy)
+	}
 	m.DohResolverPolicy = store.NormalizeDohResolverPolicy(m.DohResolverPolicy)
 	if err := p.fillModuleDohFields(ctx, &m); err != nil {
 		return nil, err
@@ -299,10 +311,14 @@ func (p *Postgres) CreateModule(tenantID string, in *store.Module) (*store.Modul
 		lastArg = in.LastRefreshedAt.UTC()
 	}
 	policy := store.NormalizeDohResolverPolicy(in.DohResolverPolicy)
+	var createdBy any
+	if v := strings.TrimSpace(in.CreatedByUserID); v != "" {
+		createdBy = v
+	}
 	_, err := p.pool.Exec(ctx, `
-		INSERT INTO module (id, tenant_id, type, name, enabled, priority, doh_profile_id, doh_resolver_policy, refresh_interval_sec, cron_expr, default_community_id, last_refreshed_at)
-		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12)`,
-		id, tenantID, in.Type, in.Name, in.Enabled, in.Priority, doh, policy, ri, cronArg, dc, lastArg)
+		INSERT INTO module (id, tenant_id, type, name, enabled, priority, doh_profile_id, doh_resolver_policy, refresh_interval_sec, cron_expr, default_community_id, last_refreshed_at, created_by_user_id)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13)`,
+		id, tenantID, in.Type, in.Name, in.Enabled, in.Priority, doh, policy, ri, cronArg, dc, lastArg, createdBy)
 	if err != nil {
 		return nil, err
 	}
@@ -402,7 +418,8 @@ func (p *Postgres) ListPeers(tenantID string) []*store.BGPPeer {
 	ctx := context.Background()
 	rows, err := p.pool.Query(ctx, `
 		SELECT id::text, tenant_id::text, bgp_speaker_id::text, neighbor::text, remote_asn, enabled,
-			COALESCE(meta_json->>'name',''), COALESCE(meta_json->>'session_state',''), COALESCE(policies_json::text,'{}')
+			COALESCE(meta_json->>'name',''), COALESCE(meta_json->>'session_state',''), COALESCE(policies_json::text,'{}'),
+			created_by_user_id
 		FROM bgp_peer WHERE tenant_id=$1 ORDER BY neighbor`, tenantID)
 	if err != nil {
 		return nil
@@ -412,10 +429,14 @@ func (p *Postgres) ListPeers(tenantID string) []*store.BGPPeer {
 	for rows.Next() {
 		var peer store.BGPPeer
 		var sp *string
-		if err := rows.Scan(&peer.ID, &peer.TenantID, &sp, &peer.Neighbor, &peer.RemoteASN, &peer.Enabled, &peer.Name, &peer.SessionState, &peer.PoliciesJSON); err != nil {
+		var createdBy *string
+		if err := rows.Scan(&peer.ID, &peer.TenantID, &sp, &peer.Neighbor, &peer.RemoteASN, &peer.Enabled, &peer.Name, &peer.SessionState, &peer.PoliciesJSON, &createdBy); err != nil {
 			continue
 		}
 		peer.SpeakerID = sp
+		if createdBy != nil {
+			peer.CreatedByUserID = strings.TrimSpace(*createdBy)
+		}
 		out = append(out, &peer)
 	}
 	return out
@@ -425,11 +446,13 @@ func (p *Postgres) GetPeer(tenantID, id string) (*store.BGPPeer, error) {
 	ctx := context.Background()
 	var peer store.BGPPeer
 	var sp *string
+	var createdBy *string
 	err := p.pool.QueryRow(ctx, `
 		SELECT id::text, tenant_id::text, bgp_speaker_id::text, neighbor::text, remote_asn, enabled,
-			COALESCE(meta_json->>'name',''), COALESCE(meta_json->>'session_state',''), COALESCE(policies_json::text,'{}')
+			COALESCE(meta_json->>'name',''), COALESCE(meta_json->>'session_state',''), COALESCE(policies_json::text,'{}'),
+			created_by_user_id
 		FROM bgp_peer WHERE id=$1 AND tenant_id=$2`, id, tenantID).Scan(
-		&peer.ID, &peer.TenantID, &sp, &peer.Neighbor, &peer.RemoteASN, &peer.Enabled, &peer.Name, &peer.SessionState, &peer.PoliciesJSON)
+		&peer.ID, &peer.TenantID, &sp, &peer.Neighbor, &peer.RemoteASN, &peer.Enabled, &peer.Name, &peer.SessionState, &peer.PoliciesJSON, &createdBy)
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, store.ErrNotFound
@@ -437,6 +460,9 @@ func (p *Postgres) GetPeer(tenantID, id string) (*store.BGPPeer, error) {
 		return nil, err
 	}
 	peer.SpeakerID = sp
+	if createdBy != nil {
+		peer.CreatedByUserID = strings.TrimSpace(*createdBy)
+	}
 	return &peer, nil
 }
 
@@ -461,10 +487,14 @@ func (p *Postgres) CreatePeer(tenantID string, in *store.BGPPeer) (*store.BGPPee
 		sp = strings.TrimSpace(*in.SpeakerID)
 	}
 	enabled := store.EffectivePeerEnabledOnCreate(in.Enabled, in.SessionState)
+	var createdBy any
+	if v := strings.TrimSpace(in.CreatedByUserID); v != "" {
+		createdBy = v
+	}
 	_, err := p.pool.Exec(ctx, `
-		INSERT INTO bgp_peer (id, tenant_id, bgp_speaker_id, neighbor, remote_asn, enabled, policies_json, meta_json)
-		VALUES ($1,$2,$3,$4::inet, $5, $6, $7::jsonb, $8::jsonb)`,
-		id, tenantID, sp, neighbor, in.RemoteASN, enabled, pol, string(mb))
+		INSERT INTO bgp_peer (id, tenant_id, bgp_speaker_id, neighbor, remote_asn, enabled, policies_json, meta_json, created_by_user_id)
+		VALUES ($1,$2,$3,$4::inet, $5, $6, $7::jsonb, $8::jsonb, $9)`,
+		id, tenantID, sp, neighbor, in.RemoteASN, enabled, pol, string(mb), createdBy)
 	if err != nil {
 		return nil, err
 	}

internal/repository/postgres_audit.go

@@ -0,0 +1,186 @@
+package repository
+
+import (
+	"context"
+	"encoding/json"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+
+	"evobgp/internal/store"
+)
+
+// AppendAudit inserts a tenant-scoped audit row.
+func (p *Postgres) AppendAudit(in store.AuditAppendInput) (*store.AuditEntry, error) {
+	if strings.TrimSpace(in.TenantID) == "" || strings.TrimSpace(in.Action) == "" || strings.TrimSpace(in.Summary) == "" {
+		return nil, store.ErrInvalidInput
+	}
+	sev := strings.TrimSpace(in.Severity)
+	if sev == "" {
+		sev = store.AuditSeverityInfo
+	}
+	if !store.ValidAuditSeverity(sev) {
+		return nil, store.ErrInvalidInput
+	}
+	ctx := context.Background()
+	id := uuid.NewString()
+	eventID := "bgp-" + uuid.NewString()
+	var detailJSON []byte
+	if in.Details != nil {
+		detailJSON, _ = json.Marshal(in.Details)
+	}
+	var createdAt time.Time
+	err := p.pool.QueryRow(ctx, `
+		INSERT INTO audit_log
+			(id, tenant_id, event_id, source_app, action, severity,
+			 actor_user_id, actor_email, actor_name, actor_api_key_prefix,
+			 target_type, target_id, summary, details_json, ip, created_at)
+		VALUES ($1, $2, $3, 'bgp', $4, $5, $6, $7, $8, $9, $10, $11, $12, $13::jsonb, $14, now())
+		RETURNING created_at`,
+		id, strings.TrimSpace(in.TenantID), eventID, strings.TrimSpace(in.Action), sev,
+		nullIfEmpty(in.ActorUserID), nullIfEmpty(in.ActorEmail), nullIfEmpty(in.ActorName),
+		nullIfEmpty(in.ActorAPIKeyPrefix), nullIfEmpty(in.TargetType), nullIfEmpty(in.TargetID),
+		strings.TrimSpace(in.Summary), nullJSONBytes(detailJSON), nullIfEmpty(in.IP),
+	).Scan(&createdAt)
+	if err != nil {
+		return nil, err
+	}
+	return &store.AuditEntry{
+		ID:                id,
+		TenantID:          strings.TrimSpace(in.TenantID),
+		EventID:           eventID,
+		SourceApp:         store.AuditSourceAppBGP,
+		Action:            strings.TrimSpace(in.Action),
+		Severity:          sev,
+		ActorUserID:       strings.TrimSpace(in.ActorUserID),
+		ActorEmail:        strings.TrimSpace(in.ActorEmail),
+		ActorName:         strings.TrimSpace(in.ActorName),
+		ActorAPIKeyPrefix: strings.TrimSpace(in.ActorAPIKeyPrefix),
+		TargetType:        strings.TrimSpace(in.TargetType),
+		TargetID:          strings.TrimSpace(in.TargetID),
+		Summary:           strings.TrimSpace(in.Summary),
+		Details:           in.Details,
+		IP:                strings.TrimSpace(in.IP),
+		CreatedAt:         createdAt.UTC(),
+	}, nil
+}
+
+// ListAudit returns paginated audit rows for a tenant.
+func (p *Postgres) ListAudit(tenantID, cursor string, limit int, filter store.AuditListFilter) ([]*store.AuditEntry, string, bool, error) {
+	if limit <= 0 {
+		limit = 50
+	}
+	off := 0
+	if cursor != "" {
+		if n, err := strconv.Atoi(cursor); err == nil && n >= 0 {
+			off = n
+		}
+	}
+	ctx := context.Background()
+	args := []any{tenantID}
+	where := "tenant_id = $1"
+	argN := 2
+	if a := strings.TrimSpace(filter.Action); a != "" {
+		where += " AND action = $" + strconv.Itoa(argN)
+		args = append(args, a)
+		argN++
+	}
+	if s := strings.TrimSpace(filter.Severity); s != "" {
+		where += " AND severity = $" + strconv.Itoa(argN)
+		args = append(args, s)
+		argN++
+	}
+	args = append(args, limit+1, off)
+	q := `
+		SELECT id, tenant_id, event_id, source_app, action, severity,
+		       actor_user_id, actor_email, actor_name, actor_api_key_prefix,
+		       target_type, target_id, summary, details_json, ip, created_at, portal_pushed_at
+		FROM audit_log
+		WHERE ` + where + `
+		ORDER BY created_at DESC, id DESC
+		LIMIT $` + strconv.Itoa(argN) + ` OFFSET $` + strconv.Itoa(argN+1)
+	rows, err := p.pool.Query(ctx, q, args...)
+	if err != nil {
+		return nil, "", false, err
+	}
+	defer rows.Close()
+	var out []*store.AuditEntry
+	for rows.Next() {
+		row, err := scanAuditEntry(rows.Scan)
+		if err != nil {
+			return nil, "", false, err
+		}
+		out = append(out, row)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, "", false, err
+	}
+	more := len(out) > limit
+	if more {
+		out = out[:limit]
+	}
+	next := ""
+	if more {
+		next = strconv.Itoa(off + limit)
+	}
+	return out, next, more, nil
+}
+
+// MarkAuditPortalPushed sets portal_pushed_at for a row.
+func (p *Postgres) MarkAuditPortalPushed(id string) error {
+	ctx := context.Background()
+	tag, err := p.pool.Exec(ctx, `UPDATE audit_log SET portal_pushed_at = now() WHERE id = $1`, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return store.ErrNotFound
+	}
+	return nil
+}
+
+func scanAuditEntry(scan func(dest ...any) error) (*store.AuditEntry, error) {
+	var row store.AuditEntry
+	var actorUserID, actorEmail, actorName, actorPrefix, targetType, targetID, ip *string
+	var detailRaw []byte
+	var portalPushed *time.Time
+	if err := scan(
+		&row.ID, &row.TenantID, &row.EventID, &row.SourceApp, &row.Action, &row.Severity,
+		&actorUserID, &actorEmail, &actorName, &actorPrefix,
+		&targetType, &targetID, &row.Summary, &detailRaw, &ip, &row.CreatedAt, &portalPushed,
+	); err != nil {
+		return nil, err
+	}
+	row.CreatedAt = row.CreatedAt.UTC()
+	if actorUserID != nil {
+		row.ActorUserID = *actorUserID
+	}
+	if actorEmail != nil {
+		row.ActorEmail = *actorEmail
+	}
+	if actorName != nil {
+		row.ActorName = *actorName
+	}
+	if actorPrefix != nil {
+		row.ActorAPIKeyPrefix = *actorPrefix
+	}
+	if targetType != nil {
+		row.TargetType = *targetType
+	}
+	if targetID != nil {
+		row.TargetID = *targetID
+	}
+	if ip != nil {
+		row.IP = *ip
+	}
+	if len(detailRaw) > 0 {
+		_ = json.Unmarshal(detailRaw, &row.Details)
+	}
+	if portalPushed != nil {
+		t := portalPushed.UTC()
+		row.PortalPushedAt = &t
+	}
+	return &row, nil
+}

internal/repository/postgres_firewall.go

@@ -20,7 +20,7 @@ const firewallClientSelectCols = `
 	COALESCE(last_apply_prefix_count, 0), COALESCE(last_apply_ip_count, 0),
 	COALESCE(last_apply_packets_dropped, 0), COALESCE(last_apply_packets_accepted, 0),
 	COALESCE(last_apply_source, ''),
-	COALESCE(client_version, ''), created_at, approved_at, approved_by_api_key_id, revoked_at`
+	COALESCE(client_version, ''), created_at, approved_at, approved_by_api_key_id, revoked_at, created_by_user_id`
 
 func (p *Postgres) ListFirewallClients(tenantID string) ([]*store.FirewallClient, error) {
 	ctx := context.Background()
@@ -63,11 +63,15 @@ func (p *Postgres) CreateFirewallClient(tenantID string, in *store.FirewallClien
 	}
 	id := uuid.NewString()
 	ctx := context.Background()
+	var createdBy any
+	if v := strings.TrimSpace(in.CreatedByUserID); v != "" {
+		createdBy = v
+	}
 	_, err := p.pool.Exec(ctx, `
-		INSERT INTO firewall_client (id, tenant_id, name, hostname, token_prefix, token_hash, client_version)
-		VALUES ($1,$2,$3,$4,$5,$6,$7)`,
+		INSERT INTO firewall_client (id, tenant_id, name, hostname, token_prefix, token_hash, client_version, created_by_user_id)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8)`,
 		id, tenantID, strings.TrimSpace(in.Name), strings.TrimSpace(in.Hostname),
-		in.TokenPrefix, in.TokenHash, strings.TrimSpace(in.ClientVersion))
+		in.TokenPrefix, in.TokenHash, strings.TrimSpace(in.ClientVersion), createdBy)
 	if err != nil {
 		return nil, err
 	}
@@ -232,11 +236,11 @@ func (p *Postgres) ListFirewallRules(tenantID string, clientID *string) ([]*stor
 	var err error
 	if clientID == nil {
 		rows, err = p.pool.Query(ctx, `
-			SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at
+			SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at, created_by_user_id
 			FROM firewall_rule WHERE tenant_id=$1 AND client_id IS NULL ORDER BY priority`, tenantID)
 	} else {
 		rows, err = p.pool.Query(ctx, `
-			SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at
+			SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at, created_by_user_id
 			FROM firewall_rule WHERE tenant_id=$1 AND client_id=$2 ORDER BY priority`, tenantID, *clientID)
 	}
 	if err != nil {
@@ -249,7 +253,7 @@ func (p *Postgres) ListFirewallRules(tenantID string, clientID *string) ([]*stor
 func (p *Postgres) ListAllFirewallRulesForClient(tenantID, clientID string) ([]*store.FirewallRule, error) {
 	ctx := context.Background()
 	rows, err := p.pool.Query(ctx, `
-		SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at
+		SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at, created_by_user_id
 		FROM firewall_rule
 		WHERE tenant_id=$1 AND (client_id IS NULL OR client_id=$2)
 		ORDER BY CASE WHEN client_id IS NULL THEN 1 ELSE 0 END, priority`, tenantID, clientID)
@@ -263,7 +267,7 @@ func (p *Postgres) ListAllFirewallRulesForClient(tenantID, clientID string) ([]*
 func (p *Postgres) ListAllFirewallRulesForReplication(tenantID string) ([]*store.FirewallRule, error) {
 	ctx := context.Background()
 	rows, err := p.pool.Query(ctx, `
-		SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at
+		SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at, created_by_user_id
 		FROM firewall_rule WHERE tenant_id=$1
 		ORDER BY CASE WHEN client_id IS NULL THEN 1 ELSE 0 END, client_id, priority`, tenantID)
 	if err != nil {
@@ -294,10 +298,14 @@ func (p *Postgres) CreateFirewallRule(tenantID string, clientID *string, in *sto
 	}
 	id := uuid.NewString()
 	ctx := context.Background()
+	var createdBy any
+	if v := strings.TrimSpace(in.CreatedByUserID); v != "" {
+		createdBy = v
+	}
 	_, err := p.pool.Exec(ctx, `
-		INSERT INTO firewall_rule (id, tenant_id, client_id, priority, action, community_id, comment)
-		VALUES ($1,$2,$3,$4,$5,$6,$7)`,
-		id, tenantID, clientID, priority, strings.ToLower(strings.TrimSpace(in.Action)), in.CommunityID, strings.TrimSpace(in.Comment))
+		INSERT INTO firewall_rule (id, tenant_id, client_id, priority, action, community_id, comment, created_by_user_id)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8)`,
+		id, tenantID, clientID, priority, strings.ToLower(strings.TrimSpace(in.Action)), in.CommunityID, strings.TrimSpace(in.Comment), createdBy)
 	if err != nil {
 		return nil, err
 	}
@@ -307,7 +315,7 @@ func (p *Postgres) CreateFirewallRule(tenantID string, clientID *string, in *sto
 func (p *Postgres) GetFirewallRule(tenantID, id string) (*store.FirewallRule, error) {
 	ctx := context.Background()
 	row := p.pool.QueryRow(ctx, `
-		SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at
+		SELECT id, client_id, priority, action, community_id, comment, created_at, updated_at, created_by_user_id
 		FROM firewall_rule WHERE id=$1 AND tenant_id=$2`, id, tenantID)
 	r, err := scanFirewallRuleRow(row.Scan, tenantID)
 	if err != nil {
@@ -423,19 +431,22 @@ func scanFirewallRules(rows pgx.Rows, tenantID string) ([]*store.FirewallRule, e
 func scanFirewallRuleRow(scan scanFn, tenantID string) (*store.FirewallRule, error) {
 	var r store.FirewallRule
 	r.TenantID = tenantID
-	var clientID, communityID *string
-	if err := scan(&r.ID, &clientID, &r.Priority, &r.Action, &communityID, &r.Comment, &r.CreatedAt, &r.UpdatedAt); err != nil {
+	var clientID, communityID, createdBy *string
+	if err := scan(&r.ID, &clientID, &r.Priority, &r.Action, &communityID, &r.Comment, &r.CreatedAt, &r.UpdatedAt, &createdBy); err != nil {
 		return nil, err
 	}
 	r.ClientID = clientID
 	r.CommunityID = communityID
+	if createdBy != nil {
+		r.CreatedByUserID = strings.TrimSpace(*createdBy)
+	}
 	return &r, nil
 }
 
 func scanFirewallClientRow(scan scanFn, tenantID string) (*store.FirewallClient, error) {
 	var c store.FirewallClient
 	c.TenantID = tenantID
-	var approvedBy *string
+	var approvedBy, createdBy *string
 	var lastSeen, lastApply, approved, revoked *time.Time
 	var prefixCount, ipCount *int
 	var packetsDropped, packetsAccepted *int64
@@ -444,16 +455,16 @@ func scanFirewallClientRow(scan scanFn, tenantID string) (*store.FirewallClient,
 		&lastSeen, &c.LastSeenAtSource, &c.LastSeenIP,
 		&lastApply, &c.LastApplyStatus, &c.LastApplyError,
 		&prefixCount, &ipCount, &packetsDropped, &packetsAccepted, &c.LastApplySource,
-		&c.ClientVersion, &c.CreatedAt, &approved, &approvedBy, &revoked,
+		&c.ClientVersion, &c.CreatedAt, &approved, &approvedBy, &revoked, &createdBy,
 	); err != nil {
 		return nil, err
 	}
-	return finishFirewallClientScan(&c, lastSeen, lastApply, approved, revoked, approvedBy, prefixCount, ipCount, packetsDropped, packetsAccepted), nil
+	return finishFirewallClientScan(&c, lastSeen, lastApply, approved, revoked, approvedBy, createdBy, prefixCount, ipCount, packetsDropped, packetsAccepted), nil
 }
 
 func scanFirewallClientLookupRow(scan scanFn) (*store.FirewallClient, error) {
 	var c store.FirewallClient
-	var approvedBy *string
+	var approvedBy, createdBy *string
 	var lastSeen, lastApply, approved, revoked *time.Time
 	var prefixCount, ipCount *int
 	var packetsDropped, packetsAccepted *int64
@@ -462,14 +473,14 @@ func scanFirewallClientLookupRow(scan scanFn) (*store.FirewallClient, error) {
 		&lastSeen, &c.LastSeenAtSource, &c.LastSeenIP,
 		&lastApply, &c.LastApplyStatus, &c.LastApplyError,
 		&prefixCount, &ipCount, &packetsDropped, &packetsAccepted, &c.LastApplySource,
-		&c.ClientVersion, &c.CreatedAt, &approved, &approvedBy, &revoked,
+		&c.ClientVersion, &c.CreatedAt, &approved, &approvedBy, &revoked, &createdBy,
 	); err != nil {
 		return nil, err
 	}
-	return finishFirewallClientScan(&c, lastSeen, lastApply, approved, revoked, approvedBy, prefixCount, ipCount, packetsDropped, packetsAccepted), nil
+	return finishFirewallClientScan(&c, lastSeen, lastApply, approved, revoked, approvedBy, createdBy, prefixCount, ipCount, packetsDropped, packetsAccepted), nil
 }
 
-func finishFirewallClientScan(c *store.FirewallClient, lastSeen, lastApply, approved, revoked *time.Time, approvedBy *string, prefixCount, ipCount *int, packetsDropped, packetsAccepted *int64) *store.FirewallClient {
+func finishFirewallClientScan(c *store.FirewallClient, lastSeen, lastApply, approved, revoked *time.Time, approvedBy, createdBy *string, prefixCount, ipCount *int, packetsDropped, packetsAccepted *int64) *store.FirewallClient {
 	c.LastSeenAt = lastSeen
 	c.LastApplyAt = lastApply
 	c.ApprovedAt = approved
@@ -477,6 +488,9 @@ func finishFirewallClientScan(c *store.FirewallClient, lastSeen, lastApply, appr
 	if approvedBy != nil {
 		c.ApprovedByAPIKeyID = *approvedBy
 	}
+	if createdBy != nil {
+		c.CreatedByUserID = strings.TrimSpace(*createdBy)
+	}
 	if prefixCount != nil {
 		c.LastApplyPrefixCount = *prefixCount
 	}

internal/store/audit.go

@@ -0,0 +1,67 @@
+package store
+
+import (
+	"strings"
+	"time"
+)
+
+const (
+	AuditSourceAppBGP      = "bgp"
+	AuditTargetAppResource = "app_resource"
+	AuditSeverityInfo      = "info"
+	AuditSeverityWarning   = "warning"
+	AuditSeverityCritical  = "critical"
+)
+
+// AuditEntry is a persisted CRUD / settings audit row (local + portal ingest).
+type AuditEntry struct {
+	ID                string
+	TenantID          string
+	EventID           string
+	SourceApp         string
+	Action            string
+	Severity          string
+	ActorUserID       string
+	ActorEmail        string
+	ActorName         string
+	ActorAPIKeyPrefix string
+	TargetType        string
+	TargetID          string
+	Summary           string
+	Details           map[string]any
+	IP                string
+	CreatedAt         time.Time
+	PortalPushedAt    *time.Time
+}
+
+// AuditAppendInput is input for AppendAudit.
+type AuditAppendInput struct {
+	TenantID          string
+	Action            string
+	Severity          string
+	ActorUserID       string
+	ActorEmail        string
+	ActorName         string
+	ActorAPIKeyPrefix string
+	TargetType        string
+	TargetID          string
+	Summary           string
+	Details           map[string]any
+	IP                string
+}
+
+// AuditListFilter optional query filters for ListAudit.
+type AuditListFilter struct {
+	Action   string
+	Severity string
+}
+
+// ValidAuditSeverity reports whether s is an allowed severity.
+func ValidAuditSeverity(s string) bool {
+	switch strings.ToLower(strings.TrimSpace(s)) {
+	case AuditSeverityInfo, AuditSeverityWarning, AuditSeverityCritical:
+		return true
+	default:
+		return false
+	}
+}

internal/store/backend.go

@@ -132,6 +132,11 @@ type Backend interface {
 	AppendRuntimeLogCleanupAudit(tenantID, actor, filename, action string, sizeBefore int64, sizeAfter *int64, detail map[string]any) (string, error)
 	ListRuntimeLogCleanupAudit(tenantID, cursor string, limit int) ([]*RuntimeLogCleanupAudit, string, bool, error)
 
+	// CRUD audit log (tenant-scoped; optional portal ingest push from httpapi).
+	AppendAudit(in AuditAppendInput) (*AuditEntry, error)
+	ListAudit(tenantID, cursor string, limit int, filter AuditListFilter) ([]*AuditEntry, string, bool, error)
+	MarkAuditPortalPushed(id string) error
+
 	// Firewall blocklist clients and policy rules.
 	ListFirewallClients(tenantID string) ([]*FirewallClient, error)
 	GetFirewallClient(tenantID, id string) (*FirewallClient, error)
@@ -150,6 +155,7 @@ type Backend interface {
 	ListAllFirewallRulesForClient(tenantID, clientID string) ([]*FirewallRule, error)
 	ListAllFirewallRulesForReplication(tenantID string) ([]*FirewallRule, error)
 	CreateFirewallRule(tenantID string, clientID *string, in *FirewallRuleCreate) (*FirewallRule, error)
+	GetFirewallRule(tenantID, ruleID string) (*FirewallRule, error)
 	UpdateFirewallRule(tenantID, ruleID string, patch *FirewallRulePatch) (*FirewallRule, error)
 	DeleteFirewallRule(tenantID, ruleID string) error
 	ReorderFirewallRules(tenantID string, clientID *string, orderedIDs []string) error

internal/store/firewall_types.go

@@ -29,15 +29,17 @@ type FirewallClient struct {
 	ApprovedAt               *time.Time `json:"approved_at,omitempty"`
 	ApprovedByAPIKeyID       string     `json:"approved_by_api_key_id,omitempty"`
 	RevokedAt                *time.Time `json:"revoked_at,omitempty"`
+	CreatedByUserID          string     `json:"created_by_user_id,omitempty"`
 }
 
 // FirewallClientCreate is input for enroll (token hash supplied by caller).
 type FirewallClientCreate struct {
-	Name          string
-	Hostname      string
-	TokenPrefix   string
-	TokenHash     []byte
-	ClientVersion string
+	Name            string
+	Hostname        string
+	TokenPrefix     string
+	TokenHash       []byte
+	ClientVersion   string
+	CreatedByUserID string
 }
 
 // FirewallClientPatch is a partial update for operator edits.
@@ -62,23 +64,25 @@ type FirewallClientReplicationRow struct {
 
 // FirewallRule is one block/accept policy rule.
 type FirewallRule struct {
-	ID          string    `json:"id"`
-	TenantID    string    `json:"tenant_id,omitempty"`
-	ClientID    *string   `json:"client_id,omitempty"`
-	Priority    int       `json:"priority"`
-	Action      string    `json:"action"`
-	CommunityID *string   `json:"community_id,omitempty"`
-	Comment     string    `json:"comment,omitempty"`
-	CreatedAt   time.Time `json:"created_at"`
-	UpdatedAt   time.Time `json:"updated_at"`
+	ID              string    `json:"id"`
+	TenantID        string    `json:"tenant_id,omitempty"`
+	ClientID        *string   `json:"client_id,omitempty"`
+	Priority        int       `json:"priority"`
+	Action          string    `json:"action"`
+	CommunityID     *string   `json:"community_id,omitempty"`
+	Comment         string    `json:"comment,omitempty"`
+	CreatedAt       time.Time `json:"created_at"`
+	UpdatedAt       time.Time `json:"updated_at"`
+	CreatedByUserID string    `json:"created_by_user_id,omitempty"`
 }
 
 // FirewallRuleCreate is input for creating a rule.
 type FirewallRuleCreate struct {
-	Priority    *int    `json:"priority,omitempty"`
-	Action      string  `json:"action"`
-	CommunityID *string `json:"community_id,omitempty"`
-	Comment     string  `json:"comment,omitempty"`
+	Priority        *int    `json:"priority,omitempty"`
+	Action          string  `json:"action"`
+	CommunityID     *string `json:"community_id,omitempty"`
+	Comment         string  `json:"comment,omitempty"`
+	CreatedByUserID string  `json:"-"`
 }
 
 // FirewallRulePatch is a partial rule update.

internal/store/memory.go

@@ -50,6 +50,7 @@ type Memory struct {
 	maintenancePolicies    map[string]*MaintenancePolicy
 	maintConfigAudit       []*MaintenancePolicyConfigAudit
 	runtimeLogCleanupAudit []*RuntimeLogCleanupAudit
+	auditLog               []*AuditEntry
 
 	// DemoIDs valid after SeedDemo()
 	demoTenantID   string
@@ -95,6 +96,7 @@ type Module struct {
 	DohResolverPolicy  string
 	LastRefreshedAt    *time.Time
 	DeletedAt          *time.Time
+	CreatedByUserID    string // portal JWT sub; empty = system / API key
 }
 
 type Revision struct {
@@ -112,15 +114,16 @@ type Revision struct {
 
 // BGPPeer maps to bgp_peer (+ display fields in meta).
 type BGPPeer struct {
-	ID           string  `json:"id,omitempty"`
-	TenantID     string  `json:"tenant_id,omitempty"`
-	SpeakerID    *string `json:"bgp_speaker_id"`
-	Name         string  `json:"name"`
-	Neighbor     string  `json:"neighbor"`
-	RemoteASN    int64   `json:"remote_asn"`
-	Enabled      bool    `json:"enabled"`
-	SessionState string  `json:"session_state"`
-	PoliciesJSON string  `json:"policies_json"`
+	ID              string  `json:"id,omitempty"`
+	TenantID        string  `json:"tenant_id,omitempty"`
+	SpeakerID       *string `json:"bgp_speaker_id"`
+	Name            string  `json:"name"`
+	Neighbor        string  `json:"neighbor"`
+	RemoteASN       int64   `json:"remote_asn"`
+	Enabled         bool    `json:"enabled"`
+	SessionState    string  `json:"session_state"`
+	PoliciesJSON    string  `json:"policies_json"`
+	CreatedByUserID string  `json:"created_by_user_id,omitempty"`
 }
 
 type Speaker struct {

internal/store/memory_audit.go

@@ -0,0 +1,117 @@
+package store
+
+import (
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+func (m *Memory) AppendAudit(in AuditAppendInput) (*AuditEntry, error) {
+	if strings.TrimSpace(in.TenantID) == "" || strings.TrimSpace(in.Action) == "" || strings.TrimSpace(in.Summary) == "" {
+		return nil, ErrInvalidInput
+	}
+	sev := strings.TrimSpace(in.Severity)
+	if sev == "" {
+		sev = AuditSeverityInfo
+	}
+	if !ValidAuditSeverity(sev) {
+		return nil, ErrInvalidInput
+	}
+	now := time.Now().UTC()
+	row := &AuditEntry{
+		ID:                uuid.NewString(),
+		TenantID:          strings.TrimSpace(in.TenantID),
+		EventID:           "bgp-" + uuid.NewString(),
+		SourceApp:         AuditSourceAppBGP,
+		Action:            strings.TrimSpace(in.Action),
+		Severity:          sev,
+		ActorUserID:       strings.TrimSpace(in.ActorUserID),
+		ActorEmail:        strings.TrimSpace(in.ActorEmail),
+		ActorName:         strings.TrimSpace(in.ActorName),
+		ActorAPIKeyPrefix: strings.TrimSpace(in.ActorAPIKeyPrefix),
+		TargetType:        strings.TrimSpace(in.TargetType),
+		TargetID:          strings.TrimSpace(in.TargetID),
+		Summary:           strings.TrimSpace(in.Summary),
+		Details:           in.Details,
+		IP:                strings.TrimSpace(in.IP),
+		CreatedAt:         now,
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.auditLog = append(m.auditLog, row)
+	return cloneAuditEntry(row), nil
+}
+
+func (m *Memory) ListAudit(tenantID, cursor string, limit int, filter AuditListFilter) ([]*AuditEntry, string, bool, error) {
+	if limit <= 0 {
+		limit = 50
+	}
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	var filtered []*AuditEntry
+	for _, row := range m.auditLog {
+		if row.TenantID != tenantID {
+			continue
+		}
+		if a := strings.TrimSpace(filter.Action); a != "" && row.Action != a {
+			continue
+		}
+		if s := strings.TrimSpace(filter.Severity); s != "" && row.Severity != s {
+			continue
+		}
+		filtered = append(filtered, row)
+	}
+	sort.Slice(filtered, func(i, j int) bool {
+		if filtered[i].CreatedAt.Equal(filtered[j].CreatedAt) {
+			return filtered[i].ID > filtered[j].ID
+		}
+		return filtered[i].CreatedAt.After(filtered[j].CreatedAt)
+	})
+	off := parseMaintCursor(cursor)
+	end := off + limit
+	next := ""
+	hasMore := false
+	if end > len(filtered) {
+		end = len(filtered)
+	} else if end < len(filtered) {
+		hasMore = true
+		next = formatMaintCursor(end)
+	}
+	if off >= len(filtered) {
+		return nil, "", false, nil
+	}
+	out := make([]*AuditEntry, end-off)
+	for i := off; i < end; i++ {
+		out[i-off] = cloneAuditEntry(filtered[i])
+	}
+	return out, next, hasMore, nil
+}
+
+func (m *Memory) MarkAuditPortalPushed(id string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	for _, row := range m.auditLog {
+		if row.ID == id {
+			now := time.Now().UTC()
+			row.PortalPushedAt = &now
+			return nil
+		}
+	}
+	return ErrNotFound
+}
+
+func cloneAuditEntry(row *AuditEntry) *AuditEntry {
+	if row == nil {
+		return nil
+	}
+	cp := *row
+	if row.Details != nil {
+		cp.Details = make(map[string]any, len(row.Details))
+		for k, v := range row.Details {
+			cp.Details[k] = v
+		}
+	}
+	return &cp
+}

internal/store/memory_audit_test.go

@@ -0,0 +1,70 @@
+package store
+
+import "testing"
+
+func TestMemoryAppendAndListAudit(t *testing.T) {
+	m := NewMemory()
+	tenantA := "tenant-a"
+	tenantB := "tenant-b"
+
+	entry, err := m.AppendAudit(AuditAppendInput{
+		TenantID: tenantA,
+		Action:   "bgp.module.create",
+		Summary:  "Created module test",
+		TargetID: "mod-1",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if entry == nil || entry.EventID == "" || entry.SourceApp != AuditSourceAppBGP {
+		t.Fatalf("unexpected entry: %+v", entry)
+	}
+
+	if _, err := m.AppendAudit(AuditAppendInput{
+		TenantID: tenantB,
+		Action:   "bgp.peer.delete",
+		Summary:  "Deleted peer",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	items, _, hasMore, err := m.ListAudit(tenantA, "", 10, AuditListFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(items) != 1 || hasMore {
+		t.Fatalf("items=%d hasMore=%v", len(items), hasMore)
+	}
+	if items[0].Action != "bgp.module.create" {
+		t.Fatalf("action=%s", items[0].Action)
+	}
+
+	filtered, _, _, err := m.ListAudit(tenantA, "", 10, AuditListFilter{Action: "bgp.peer.delete"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(filtered) != 0 {
+		t.Fatalf("expected empty filter result, got %d", len(filtered))
+	}
+
+	if err := m.MarkAuditPortalPushed(entry.ID); err != nil {
+		t.Fatal(err)
+	}
+	items2, _, _, err := m.ListAudit(tenantA, "", 10, AuditListFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if items2[0].PortalPushedAt == nil {
+		t.Fatal("expected portal_pushed_at")
+	}
+}
+
+func TestMemoryAppendAuditValidation(t *testing.T) {
+	m := NewMemory()
+	if _, err := m.AppendAudit(AuditAppendInput{}); err != ErrInvalidInput {
+		t.Fatalf("err=%v", err)
+	}
+	if _, err := m.AppendAudit(AuditAppendInput{TenantID: "t", Action: "x", Summary: "s", Severity: "bad"}); err != ErrInvalidInput {
+		t.Fatalf("err=%v", err)
+	}
+}

internal/store/memory_crud.go

@@ -32,6 +32,7 @@ func (m *Memory) CreateModule(tenantID string, in *Module) (*Module, error) {
 		DohProfileIDs:      append([]string(nil), in.DohProfileIDs...),
 		DohResolverPolicy:  in.DohResolverPolicy,
 		LastRefreshedAt:    in.LastRefreshedAt,
+		CreatedByUserID:    strings.TrimSpace(in.CreatedByUserID),
 	}
 	NormalizeModuleDoh(mod)
 	m.modules[id] = mod
@@ -680,6 +681,7 @@ func (m *Memory) CreatePeer(tenantID string, in *BGPPeer) (*BGPPeer, error) {
 		Neighbor: neighbor, RemoteASN: in.RemoteASN,
 		Enabled:      EffectivePeerEnabledOnCreate(in.Enabled, in.SessionState),
 		SessionState: in.SessionState, PoliciesJSON: in.PoliciesJSON,
+		CreatedByUserID: strings.TrimSpace(in.CreatedByUserID),
 	}
 	m.peers[id] = p
 	return p, nil

internal/store/memory_firewall.go

@@ -49,14 +49,15 @@ func (m *Memory) CreateFirewallClient(tenantID string, in *FirewallClientCreate)
 	id := uuid.NewString()
 	rec := &firewallClientRec{
 		FirewallClient: FirewallClient{
-			ID:            id,
-			TenantID:      tenantID,
-			Name:          strings.TrimSpace(in.Name),
-			Hostname:      strings.TrimSpace(in.Hostname),
-			TokenPrefix:   in.TokenPrefix,
-			Status:        "pending",
-			ClientVersion: strings.TrimSpace(in.ClientVersion),
-			CreatedAt:     now,
+			ID:              id,
+			TenantID:        tenantID,
+			Name:            strings.TrimSpace(in.Name),
+			Hostname:        strings.TrimSpace(in.Hostname),
+			TokenPrefix:     in.TokenPrefix,
+			Status:          "pending",
+			ClientVersion:   strings.TrimSpace(in.ClientVersion),
+			CreatedAt:       now,
+			CreatedByUserID: strings.TrimSpace(in.CreatedByUserID),
 		},
 		TokenHash: append([]byte(nil), in.TokenHash...),
 	}
@@ -311,20 +312,31 @@ func (m *Memory) CreateFirewallRule(tenantID string, clientID *string, in *Firew
 	now := time.Now().UTC()
 	id := uuid.NewString()
 	rule := &FirewallRule{
-		ID:          id,
-		TenantID:    tenantID,
-		ClientID:    clientID,
-		Priority:    priority,
-		Action:      strings.ToLower(strings.TrimSpace(in.Action)),
-		CommunityID: in.CommunityID,
-		Comment:     strings.TrimSpace(in.Comment),
-		CreatedAt:   now,
-		UpdatedAt:   now,
+		ID:              id,
+		TenantID:        tenantID,
+		ClientID:        clientID,
+		Priority:        priority,
+		Action:          strings.ToLower(strings.TrimSpace(in.Action)),
+		CommunityID:     in.CommunityID,
+		Comment:         strings.TrimSpace(in.Comment),
+		CreatedAt:       now,
+		UpdatedAt:       now,
+		CreatedByUserID: strings.TrimSpace(in.CreatedByUserID),
 	}
 	m.firewallRules[id] = rule
 	return firewallRuleCopy(rule), nil
 }
 
+func (m *Memory) GetFirewallRule(tenantID, ruleID string) (*FirewallRule, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	rule, ok := m.firewallRules[ruleID]
+	if !ok || rule.TenantID != tenantID {
+		return nil, ErrNotFound
+	}
+	return firewallRuleCopy(rule), nil
+}
+
 func (m *Memory) UpdateFirewallRule(tenantID, ruleID string, patch *FirewallRulePatch) (*FirewallRule, error) {
 	if patch == nil {
 		return nil, ErrInvalidInput

internal/store/ownership.go

@@ -0,0 +1,37 @@
+package store
+
+// Ownership helpers for portal JWT resource scoping.
+
+// SeesAllOwned is true for API keys and portal admins (no per-user filter).
+func SeesAllOwned(kind string, isAdmin bool) bool {
+	if kind != "jwt" {
+		return true
+	}
+	return isAdmin
+}
+
+// CanAccessOwned reports whether the actor may see/edit a resource with createdBy.
+// Empty createdBy (legacy/API-key-created) is visible only when SeesAllOwned.
+func CanAccessOwned(kind string, isAdmin bool, userID, createdBy string) bool {
+	if SeesAllOwned(kind, isAdmin) {
+		return true
+	}
+	if createdBy == "" {
+		return false
+	}
+	return createdBy == userID
+}
+
+// FilterOwnedStrings keeps items whose owner matches the actor.
+func FilterOwned[T any](items []T, owner func(T) string, kind string, isAdmin bool, userID string) []T {
+	if SeesAllOwned(kind, isAdmin) {
+		return items
+	}
+	out := make([]T, 0, len(items))
+	for _, it := range items {
+		if CanAccessOwned(kind, isAdmin, userID, owner(it)) {
+			out = append(out, it)
+		}
+	}
+	return out
+}

internal/store/ownership_test.go

@@ -0,0 +1,67 @@
+package store
+
+import "testing"
+
+func TestSeesAllOwned(t *testing.T) {
+	if !SeesAllOwned("apikey", false) {
+		t.Fatal("api keys must see all rows")
+	}
+	if !SeesAllOwned("jwt", true) {
+		t.Fatal("admin jwt must see all rows")
+	}
+	if SeesAllOwned("jwt", false) {
+		t.Fatal("non-admin jwt must not see all rows")
+	}
+}
+
+func TestCanAccessOwned(t *testing.T) {
+	if !CanAccessOwned("apikey", false, "", "someone") {
+		t.Fatal("api key must access any owner")
+	}
+	if !CanAccessOwned("jwt", true, "admin", "user-1") {
+		t.Fatal("admin jwt must access any owner")
+	}
+	if !CanAccessOwned("jwt", false, "user-1", "user-1") {
+		t.Fatal("owner must access their resource")
+	}
+	if CanAccessOwned("jwt", false, "user-1", "user-2") {
+		t.Fatal("non-owner must not access foreign resource")
+	}
+	if CanAccessOwned("jwt", false, "user-1", "") {
+		t.Fatal("non-admin jwt must not see legacy rows without owner")
+	}
+}
+
+type ownRow struct {
+	id    string
+	owner string
+}
+
+func TestFilterOwned(t *testing.T) {
+	rows := []ownRow{
+		{"a", "user-1"},
+		{"b", "user-2"},
+		{"c", ""},
+	}
+	get := func(r ownRow) string { return r.owner }
+
+	got := FilterOwned(rows, get, "apikey", false, "")
+	if len(got) != 3 {
+		t.Fatalf("apikey filter: got=%d want 3", len(got))
+	}
+
+	got = FilterOwned(rows, get, "jwt", true, "any")
+	if len(got) != 3 {
+		t.Fatalf("admin jwt filter: got=%d want 3", len(got))
+	}
+
+	got = FilterOwned(rows, get, "jwt", false, "user-1")
+	if len(got) != 1 || got[0].id != "a" {
+		t.Fatalf("user-1 filter: got=%+v want [a]", got)
+	}
+
+	got = FilterOwned(rows, get, "jwt", false, "user-3")
+	if len(got) != 0 {
+		t.Fatalf("unknown user filter: got=%+v want []", got)
+	}
+}

migrations/postgres/000029_created_by_user.down.sql

@@ -0,0 +1,9 @@
+DROP INDEX IF EXISTS idx_firewall_rule_created_by;
+DROP INDEX IF EXISTS idx_firewall_client_created_by;
+DROP INDEX IF EXISTS idx_bgp_peer_created_by;
+DROP INDEX IF EXISTS idx_module_created_by;
+
+ALTER TABLE firewall_rule DROP COLUMN IF EXISTS created_by_user_id;
+ALTER TABLE firewall_client DROP COLUMN IF EXISTS created_by_user_id;
+ALTER TABLE bgp_peer DROP COLUMN IF EXISTS created_by_user_id;
+ALTER TABLE module DROP COLUMN IF EXISTS created_by_user_id;

migrations/postgres/000029_created_by_user.up.sql

@@ -0,0 +1,10 @@
+-- Ownership for portal JWT users (modules, peers, firewall).
+ALTER TABLE module ADD COLUMN IF NOT EXISTS created_by_user_id TEXT;
+ALTER TABLE bgp_peer ADD COLUMN IF NOT EXISTS created_by_user_id TEXT;
+ALTER TABLE firewall_client ADD COLUMN IF NOT EXISTS created_by_user_id TEXT;
+ALTER TABLE firewall_rule ADD COLUMN IF NOT EXISTS created_by_user_id TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_module_created_by ON module (tenant_id, created_by_user_id);
+CREATE INDEX IF NOT EXISTS idx_bgp_peer_created_by ON bgp_peer (tenant_id, created_by_user_id);
+CREATE INDEX IF NOT EXISTS idx_firewall_client_created_by ON firewall_client (tenant_id, created_by_user_id);
+CREATE INDEX IF NOT EXISTS idx_firewall_rule_created_by ON firewall_rule (tenant_id, created_by_user_id);

migrations/postgres/000030_audit_log.down.sql

@@ -0,0 +1,4 @@
+DROP INDEX IF EXISTS idx_audit_log_tenant_action;
+DROP INDEX IF EXISTS idx_audit_log_tenant_created;
+DROP INDEX IF EXISTS idx_audit_log_event_id;
+DROP TABLE IF EXISTS audit_log;

migrations/postgres/000030_audit_log.up.sql

@@ -0,0 +1,30 @@
+CREATE TABLE IF NOT EXISTS audit_log (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    event_id TEXT NOT NULL,
+    source_app TEXT NOT NULL DEFAULT 'bgp',
+    action TEXT NOT NULL,
+    severity TEXT NOT NULL DEFAULT 'info',
+    actor_user_id TEXT,
+    actor_email TEXT,
+    actor_name TEXT,
+    actor_api_key_prefix TEXT,
+    target_type TEXT,
+    target_id TEXT,
+    summary TEXT NOT NULL,
+    details_json JSONB,
+    ip TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    portal_pushed_at TIMESTAMPTZ,
+    CONSTRAINT audit_log_severity_chk CHECK (severity IN ('info', 'warning', 'critical')),
+    CONSTRAINT audit_log_source_app_chk CHECK (source_app = 'bgp'),
+    CONSTRAINT audit_log_summary_chk CHECK (length(trim(summary)) > 0)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_log_event_id ON audit_log (event_id);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_created
+    ON audit_log (tenant_id, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_action
+    ON audit_log (tenant_id, action, created_at DESC);

migrations/sqlite/000029_created_by_user.down.sql

@@ -0,0 +1,7 @@
+DROP INDEX IF EXISTS idx_firewall_rule_created_by;
+DROP INDEX IF EXISTS idx_firewall_client_created_by;
+DROP INDEX IF EXISTS idx_bgp_peer_created_by;
+DROP INDEX IF EXISTS idx_module_created_by;
+
+-- SQLite: recreate tables without column is heavy; leave columns (no-op down for v1).
+-- Down migration intentionally empty for SQLite ALTER DROP COLUMN compatibility.

migrations/sqlite/000029_created_by_user.up.sql

@@ -0,0 +1,10 @@
+-- Ownership for portal JWT users (modules, peers, firewall).
+ALTER TABLE module ADD COLUMN created_by_user_id TEXT;
+ALTER TABLE bgp_peer ADD COLUMN created_by_user_id TEXT;
+ALTER TABLE firewall_client ADD COLUMN created_by_user_id TEXT;
+ALTER TABLE firewall_rule ADD COLUMN created_by_user_id TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_module_created_by ON module (tenant_id, created_by_user_id);
+CREATE INDEX IF NOT EXISTS idx_bgp_peer_created_by ON bgp_peer (tenant_id, created_by_user_id);
+CREATE INDEX IF NOT EXISTS idx_firewall_client_created_by ON firewall_client (tenant_id, created_by_user_id);
+CREATE INDEX IF NOT EXISTS idx_firewall_rule_created_by ON firewall_rule (tenant_id, created_by_user_id);

migrations/sqlite/000030_audit_log.down.sql

@@ -0,0 +1,4 @@
+DROP INDEX IF EXISTS idx_audit_log_tenant_action;
+DROP INDEX IF EXISTS idx_audit_log_tenant_created;
+DROP INDEX IF EXISTS idx_audit_log_event_id;
+DROP TABLE IF EXISTS audit_log;

migrations/sqlite/000030_audit_log.up.sql

@@ -0,0 +1,27 @@
+CREATE TABLE IF NOT EXISTS audit_log (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    event_id TEXT NOT NULL,
+    source_app TEXT NOT NULL DEFAULT 'bgp',
+    action TEXT NOT NULL,
+    severity TEXT NOT NULL DEFAULT 'info',
+    actor_user_id TEXT,
+    actor_email TEXT,
+    actor_name TEXT,
+    actor_api_key_prefix TEXT,
+    target_type TEXT,
+    target_id TEXT,
+    summary TEXT NOT NULL,
+    details_json TEXT,
+    ip TEXT,
+    created_at TEXT NOT NULL,
+    portal_pushed_at TEXT
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_log_event_id ON audit_log (event_id);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_created
+    ON audit_log (tenant_id, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_action
+    ON audit_log (tenant_id, action, created_at DESC);