initial commit after split

2026-06-24 01:43:10 +02:00
parent b1d6c0150f
commit 30c11a6dcf
173 changed files with 25380 additions and 0 deletions
--- a/src/govoplan_core/api/init.py
+++ b/src/govoplan_core/api/init.py
@@ -0,0 +1 @@
+from __future__ import annotations
--- a/src/govoplan_core/api/v1/init.py
+++ b/src/govoplan_core/api/v1/init.py
@@ -0,0 +1 @@
+from __future__ import annotations
--- a/src/govoplan_core/api/v1/admin.py
+++ b/src/govoplan_core/api/v1/admin.py
--- a/src/govoplan_core/api/v1/admin_schemas.py
+++ b/src/govoplan_core/api/v1/admin_schemas.py
@@ -0,0 +1,486 @@
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Any, Literal
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator
+
+RETENTION_DAY_KEYS = (
+    "raw_campaign_json_retention_days",
+    "generated_eml_retention_days",
+    "stored_report_detail_retention_days",
+    "mock_mailbox_retention_days",
+    "audit_detail_retention_days",
+)
+RETENTION_POLICY_FIELD_KEYS = (
+    "store_raw_campaign_json",
+    *RETENTION_DAY_KEYS,
+    "audit_detail_level",
+)
+
+
+def default_allow_lower_level_limits() -> dict[str, bool]:
+    return {key: True for key in RETENTION_POLICY_FIELD_KEYS}
+
+
+def normalize_allow_lower_level_limits(value: Any, *, fill_defaults: bool) -> dict[str, bool] | None:
+    if value in (None, ""):
+        return default_allow_lower_level_limits() if fill_defaults else None
+    if not isinstance(value, dict):
+        raise ValueError("allow_lower_level_limits must be an object")
+    normalized = default_allow_lower_level_limits() if fill_defaults else {}
+    for key, allowed in value.items():
+        clean_key = str(key)
+        if clean_key not in RETENTION_POLICY_FIELD_KEYS:
+            raise ValueError(f"Unknown retention policy field: {clean_key}")
+        normalized[clean_key] = bool(allowed)
+    return normalized
+
+
+
+class PermissionItem(BaseModel):
+    scope: str
+    label: str
+    description: str
+    category: str
+    level: Literal["tenant", "system"]
+
+
+class PermissionCatalogResponse(BaseModel):
+    permissions: list[PermissionItem]
+
+
+class AdminOverviewResponse(BaseModel):
+    active_tenant_id: str
+    active_tenant_name: str
+    tenant_count: int | None = None
+    system_account_count: int | None = None
+    system_group_template_count: int | None = None
+    system_role_template_count: int | None = None
+    user_count: int
+    active_user_count: int
+    group_count: int
+    role_count: int
+    active_api_key_count: int
+    capabilities: list[str] = Field(default_factory=list)
+
+
+class TenantAdminItem(BaseModel):
+    id: str
+    slug: str = Field(min_length=1, max_length=100)
+    name: str = Field(min_length=1, max_length=255)
+    description: str | None = None
+    default_locale: str = Field(default="en", min_length=1, max_length=20)
+    settings: dict[str, Any] = Field(default_factory=dict)
+    allow_custom_groups: bool | None = None
+    allow_custom_roles: bool | None = None
+    allow_api_keys: bool | None = None
+    effective_governance: dict[str, bool] = Field(default_factory=dict)
+    is_active: bool
+    counts: dict[str, int] = Field(default_factory=dict)
+    created_at: datetime
+    updated_at: datetime
+
+
+class TenantListResponse(BaseModel):
+    tenants: list[TenantAdminItem]
+
+
+class TenantOwnerCandidate(BaseModel):
+    account_id: str
+    email: str
+    display_name: str | None = None
+
+
+class TenantOwnerCandidateListResponse(BaseModel):
+    accounts: list[TenantOwnerCandidate]
+
+
+class TenantCreateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    slug: str
+    name: str
+    owner_account_id: str | None = None
+    description: str | None = None
+    default_locale: str = "en"
+    settings: dict[str, Any] = Field(default_factory=dict)
+    allow_custom_groups: bool | None = None
+    allow_custom_roles: bool | None = None
+    allow_api_keys: bool | None = None
+
+
+class TenantUpdateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    name: str | None = Field(default=None, min_length=1, max_length=255)
+    description: str | None = None
+    default_locale: str | None = Field(default=None, min_length=1, max_length=20)
+    settings: dict[str, Any] | None = None
+    allow_custom_groups: bool | None = None
+    allow_custom_roles: bool | None = None
+    allow_api_keys: bool | None = None
+    is_active: bool | None = None
+
+
+class RoleSummary(BaseModel):
+    id: str
+    slug: str = Field(min_length=1, max_length=100)
+    name: str = Field(min_length=1, max_length=255)
+    description: str | None = None
+    permissions: list[str] = Field(default_factory=list)
+    effective_permission_count: int = 0
+    is_builtin: bool = False
+    is_assignable: bool = True
+    user_assignments: int = 0
+    group_assignments: int = 0
+    level: Literal["tenant", "system"] = "tenant"
+    system_template_id: str | None = None
+    system_required: bool = False
+
+
+class GroupSummary(BaseModel):
+    id: str
+    slug: str = Field(min_length=1, max_length=100)
+    name: str = Field(min_length=1, max_length=255)
+    description: str | None = None
+    is_active: bool = True
+    member_count: int = 0
+    member_ids: list[str] = Field(default_factory=list)
+    roles: list[RoleSummary] = Field(default_factory=list)
+    created_at: datetime
+    updated_at: datetime
+    system_template_id: str | None = None
+    system_required: bool = False
+
+
+class UserAdminItem(BaseModel):
+    id: str
+    account_id: str
+    tenant_id: str
+    email: str = Field(min_length=3, max_length=320)
+    display_name: str | None = Field(default=None, max_length=255)
+    is_active: bool
+    account_is_active: bool
+    password_reset_required: bool = False
+    last_login_at: datetime | None = None
+    groups: list[GroupSummary] = Field(default_factory=list)
+    roles: list[RoleSummary] = Field(default_factory=list)
+    effective_scopes: list[str] = Field(default_factory=list)
+    is_owner: bool = False
+    is_last_active_owner: bool = False
+    created_at: datetime
+    updated_at: datetime
+
+
+class UserListResponse(BaseModel):
+    users: list[UserAdminItem]
+
+
+class UserCreateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    email: str
+    display_name: str | None = None
+    password: str | None = Field(default=None, min_length=10)
+    password_reset_required: bool = True
+    is_active: bool = True
+    group_ids: list[str] = Field(default_factory=list)
+    role_ids: list[str] = Field(default_factory=list)
+
+
+class UserCreateResponse(BaseModel):
+    user: UserAdminItem
+    account_created: bool
+    temporary_password: str | None = None
+
+
+class UserUpdateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    display_name: str | None = Field(default=None, max_length=255)
+    is_active: bool | None = None
+    group_ids: list[str] | None = None
+    role_ids: list[str] | None = None
+
+
+class GroupListResponse(BaseModel):
+    groups: list[GroupSummary]
+
+
+class GroupCreateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    slug: str
+    name: str
+    description: str | None = None
+    is_active: bool = True
+    member_ids: list[str] = Field(default_factory=list)
+    role_ids: list[str] = Field(default_factory=list)
+
+
+class GroupUpdateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    name: str | None = Field(default=None, min_length=1, max_length=255)
+    description: str | None = None
+    is_active: bool | None = None
+    member_ids: list[str] | None = None
+    role_ids: list[str] | None = None
+
+
+class RoleListResponse(BaseModel):
+    roles: list[RoleSummary]
+
+
+class RoleCreateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    slug: str
+    name: str = Field(min_length=1, max_length=255)
+    description: str | None = None
+    permissions: list[str] = Field(default_factory=list)
+
+
+class RoleUpdateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    name: str
+    description: str | None = None
+    permissions: list[str] = Field(default_factory=list)
+    is_assignable: bool = True
+
+
+class SystemAccountItem(BaseModel):
+    account_id: str
+    email: str
+    display_name: str | None = None
+    is_active: bool
+    memberships: list[dict[str, Any]] = Field(default_factory=list)
+    roles: list[RoleSummary] = Field(default_factory=list)
+    last_login_at: datetime | None = None
+
+
+class SystemAccountListResponse(BaseModel):
+    accounts: list[SystemAccountItem]
+    roles: list[RoleSummary]
+
+
+class SystemAccountUpdateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    display_name: str | None = Field(default=None, max_length=255)
+    is_active: bool | None = None
+    role_ids: list[str] | None = None
+
+
+class SystemAccountRolesUpdateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    role_ids: list[str] = Field(default_factory=list)
+
+
+class SystemMembershipUpdate(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    tenant_id: str
+    is_active: bool = True
+    role_ids: list[str] = Field(default_factory=list)
+    group_ids: list[str] = Field(default_factory=list)
+
+
+class SystemAccountMembershipsUpdateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    memberships: list[SystemMembershipUpdate] = Field(default_factory=list)
+
+
+class SystemAccountCreateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    email: str
+    display_name: str | None = None
+    password: str | None = Field(default=None, min_length=10)
+    password_reset_required: bool = True
+    is_active: bool = True
+    role_ids: list[str] = Field(default_factory=list)
+    memberships: list[SystemMembershipUpdate] = Field(default_factory=list)
+
+
+class SystemAccountCreateResponse(BaseModel):
+    account: SystemAccountItem
+    temporary_password: str | None = None
+
+
+class PrivacyRetentionPolicyItem(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    store_raw_campaign_json: bool = True
+    raw_campaign_json_retention_days: int | None = Field(default=None, ge=0)
+    generated_eml_retention_days: int | None = Field(default=None, ge=0)
+    stored_report_detail_retention_days: int | None = Field(default=None, ge=0)
+    mock_mailbox_retention_days: int | None = Field(default=None, ge=0)
+    audit_detail_retention_days: int | None = Field(default=None, ge=0)
+    audit_detail_level: Literal["full", "redacted", "minimal"] = "full"
+    allow_lower_level_limits: dict[str, bool] = Field(default_factory=default_allow_lower_level_limits)
+
+    @field_validator("allow_lower_level_limits", mode="before")
+    @classmethod
+    def _normalize_allow_lower_level_limits(cls, value: Any) -> Any:
+        return normalize_allow_lower_level_limits(value, fill_defaults=True)
+
+
+class PrivacyRetentionPolicyPatchItem(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    store_raw_campaign_json: bool | None = None
+    raw_campaign_json_retention_days: int | None = Field(default=None, ge=0)
+    generated_eml_retention_days: int | None = Field(default=None, ge=0)
+    stored_report_detail_retention_days: int | None = Field(default=None, ge=0)
+    mock_mailbox_retention_days: int | None = Field(default=None, ge=0)
+    audit_detail_retention_days: int | None = Field(default=None, ge=0)
+    audit_detail_level: Literal["full", "redacted", "minimal"] | None = None
+    allow_lower_level_limits: dict[str, bool] | None = None
+
+    @field_validator("allow_lower_level_limits", mode="before")
+    @classmethod
+    def _normalize_allow_lower_level_limits(cls, value: Any) -> Any:
+        return normalize_allow_lower_level_limits(value, fill_defaults=False)
+
+
+class PrivacyRetentionPolicyScopeRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    policy: PrivacyRetentionPolicyPatchItem = Field(default_factory=PrivacyRetentionPolicyPatchItem)
+
+
+class PrivacyRetentionPolicyScopeResponse(BaseModel):
+    scope_type: Literal["system", "tenant", "user", "group", "campaign"]
+    scope_id: str | None = None
+    policy: dict[str, Any]
+    effective_policy: PrivacyRetentionPolicyItem
+    parent_policy: PrivacyRetentionPolicyItem | None = None
+
+
+class RetentionRunRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    dry_run: bool = True
+
+
+class RetentionRunResponse(BaseModel):
+    result: dict[str, Any]
+
+
+class SystemSettingsItem(BaseModel):
+    default_locale: str = "en"
+    allow_tenant_custom_groups: bool = True
+    allow_tenant_custom_roles: bool = True
+    allow_tenant_api_keys: bool = True
+    privacy_retention_policy: PrivacyRetentionPolicyItem = Field(default_factory=PrivacyRetentionPolicyItem)
+    settings: dict[str, Any] = Field(default_factory=dict)
+
+
+class SystemSettingsUpdateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    default_locale: str = Field(min_length=1, max_length=20)
+    allow_tenant_custom_groups: bool
+    allow_tenant_custom_roles: bool
+    allow_tenant_api_keys: bool
+    privacy_retention_policy: PrivacyRetentionPolicyItem | None = None
+
+
+class GovernanceAssignment(BaseModel):
+    tenant_id: str
+    mode: Literal["available", "required"] = "available"
+
+
+class GovernanceTemplateItem(BaseModel):
+    id: str
+    kind: Literal["group", "role"]
+    slug: str
+    name: str
+    description: str | None = None
+    permissions: list[str] = Field(default_factory=list)
+    effective_permission_count: int = 0
+    is_active: bool = True
+    assignments: list[GovernanceAssignment] = Field(default_factory=list)
+    created_at: datetime
+    updated_at: datetime
+
+
+class GovernanceTemplateListResponse(BaseModel):
+    templates: list[GovernanceTemplateItem]
+
+
+class GovernanceTemplateCreateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    kind: Literal["group", "role"]
+    slug: str
+    name: str = Field(min_length=1, max_length=255)
+    description: str | None = None
+    permissions: list[str] = Field(default_factory=list)
+    is_active: bool = True
+    assignments: list[GovernanceAssignment] = Field(default_factory=list)
+
+
+class GovernanceTemplateUpdateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    name: str = Field(min_length=1, max_length=255)
+    description: str | None = None
+    permissions: list[str] = Field(default_factory=list)
+    is_active: bool = True
+    assignments: list[GovernanceAssignment] = Field(default_factory=list)
+
+
+class ApiKeyAdminItem(BaseModel):
+    id: str
+    user_id: str
+    user_email: str
+    name: str
+    prefix: str
+    scopes: list[str] = Field(default_factory=list)
+    expires_at: datetime | None = None
+    last_used_at: datetime | None = None
+    revoked_at: datetime | None = None
+    created_at: datetime
+
+
+class ApiKeyListResponse(BaseModel):
+    api_keys: list[ApiKeyAdminItem]
+
+
+class AdminApiKeyCreateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    name: str = Field(min_length=1, max_length=255)
+    user_id: str | None = None
+    scopes: list[str] = Field(default_factory=list)
+    expires_at: datetime | None = None
+
+
+class AdminApiKeyCreateResponse(ApiKeyAdminItem):
+    secret: str
+
+
+class AuditAdminItem(BaseModel):
+    id: str
+    scope: Literal["tenant", "system"] = "tenant"
+    tenant_id: str | None = None
+    actor_email: str | None = None
+    action: str
+    object_type: str | None = None
+    object_id: str | None = None
+    details: dict[str, Any] = Field(default_factory=dict)
+    created_at: datetime
+
+
+class AuditAdminListResponse(BaseModel):
+    items: list[AuditAdminItem]
+    total: int
+    page: int = 1
+    page_size: int = 100
+    pages: int = 1
--- a/src/govoplan_core/api/v1/audit.py
+++ b/src/govoplan_core/api/v1/audit.py
@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Query
+from sqlalchemy.orm import Session
+
+from govoplan_core.api.v1.schemas import AuditLogItemResponse, AuditLogListResponse
+from govoplan_core.auth.dependencies import ApiPrincipal, require_scope
+from govoplan_core.db.models import AuditLog
+from govoplan_core.db.session import get_session
+
+router = APIRouter(prefix="/audit", tags=["audit"])
+
+
+@router.get("", response_model=AuditLogListResponse)
+def list_audit_log(
+    limit: int = Query(default=100, ge=1, le=500),
+    offset: int = Query(default=0, ge=0),
+    action: str | None = None,
+    object_type: str | None = None,
+    object_id: str | None = None,
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(require_scope("audit:read")),
+):
+    query = session.query(AuditLog).filter(AuditLog.tenant_id == principal.tenant_id)
+    if action:
+        query = query.filter(AuditLog.action == action)
+    if object_type:
+        query = query.filter(AuditLog.object_type == object_type)
+    if object_id:
+        query = query.filter(AuditLog.object_id == object_id)
+    items = query.order_by(AuditLog.created_at.desc()).offset(offset).limit(limit).all()
+    return AuditLogListResponse(items=[AuditLogItemResponse.model_validate(item) for item in items])
--- a/src/govoplan_core/api/v1/auth.py
+++ b/src/govoplan_core/api/v1/auth.py
@@ -0,0 +1,293 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException, Request, Response, status
+from sqlalchemy.orm import Session
+
+from govoplan_core.api.v1.schemas import (
+    GroupInfo,
+    LoginRequest,
+    LoginResponse,
+    MeResponse,
+    ProfileUpdateRequest,
+    RoleInfo,
+    SwitchTenantRequest,
+    TenantInfo,
+    TenantMembershipInfo,
+    UserInfo,
+)
+from govoplan_core.auth.dependencies import ApiPrincipal, get_api_principal
+from govoplan_core.audit.logging import audit_from_principal
+from govoplan_core.db.models import Account, Tenant, User
+from govoplan_core.db.session import get_session
+from govoplan_core.security.passwords import verify_password
+from govoplan_core.security.permissions import normalize_email
+from govoplan_core.settings import settings
+from govoplan_core.security.sessions import (
+    collect_system_roles,
+    collect_tenant_memberships,
+    collect_user_groups,
+    collect_user_roles,
+    collect_user_scopes,
+    create_auth_session,
+    switch_auth_session_tenant,
+)
+from govoplan_core.security.time import utc_now
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+def _cookie_samesite() -> str:
+    value = settings.auth_cookie_samesite.lower().strip()
+    if value not in {"lax", "strict", "none"}:
+        return "lax"
+    if value == "none" and not settings.auth_cookie_secure:
+        return "lax"
+    return value
+
+
+def _set_auth_cookies(response: Response, created) -> None:
+    max_age = max(0, int((created.model.expires_at - utc_now()).total_seconds()))
+    common = {
+        "secure": settings.auth_cookie_secure,
+        "samesite": _cookie_samesite(),
+        "max_age": max_age,
+        "path": "/",
+    }
+    if settings.auth_cookie_domain:
+        common["domain"] = settings.auth_cookie_domain
+    response.set_cookie(settings.auth_session_cookie_name, created.token, httponly=True, **common)
+    response.set_cookie(settings.auth_csrf_cookie_name, created.csrf_token, httponly=False, **common)
+
+
+def _clear_auth_cookies(response: Response) -> None:
+    kwargs = {"path": "/"}
+    if settings.auth_cookie_domain:
+        kwargs["domain"] = settings.auth_cookie_domain
+    response.delete_cookie(settings.auth_session_cookie_name, **kwargs)
+    response.delete_cookie(settings.auth_csrf_cookie_name, **kwargs)
+
+
+def _tenant_info(tenant: Tenant) -> TenantInfo:
+    return TenantInfo(
+        id=tenant.id,
+        slug=tenant.slug,
+        name=tenant.name,
+        is_active=tenant.is_active,
+        default_locale=tenant.default_locale,
+    )
+
+
+def _user_info(user: User, account: Account) -> UserInfo:
+    return UserInfo(
+        id=user.id,
+        account_id=account.id,
+        email=account.email,
+        display_name=account.display_name or user.display_name,
+        tenant_display_name=user.display_name,
+        is_tenant_admin=user.is_tenant_admin,
+        password_reset_required=account.password_reset_required,
+    )
+
+
+def _roles_info(roles, *, level: str = "tenant") -> list[RoleInfo]:
+    return [
+        RoleInfo(
+            id=role.id,
+            slug=role.slug,
+            name=role.name,
+            permissions=role.permissions or [],
+            level=level,
+        )
+        for role in roles
+    ]
+
+
+def _groups_info(groups) -> list[GroupInfo]:
+    return [GroupInfo(id=group.id, slug=group.slug, name=group.name) for group in groups]
+
+
+def _tenant_memberships(session: Session, account: Account) -> list[TenantMembershipInfo]:
+    memberships: list[TenantMembershipInfo] = []
+    for user, tenant in collect_tenant_memberships(session, account):
+        roles = collect_user_roles(session, user)
+        memberships.append(
+            TenantMembershipInfo(
+                id=tenant.id,
+                slug=tenant.slug,
+                name=tenant.name,
+                is_active=tenant.is_active and user.is_active,
+                default_locale=tenant.default_locale,
+                roles=[role.slug for role in roles],
+            )
+        )
+    return memberships
+
+
+def _resolve_login_user(session: Session, payload: LoginRequest) -> tuple[Account, User, Tenant]:
+    account = (
+        session.query(Account)
+        .filter(Account.normalized_email == normalize_email(payload.email), Account.is_active.is_(True))
+        .one_or_none()
+    )
+    if account is None or not verify_password(payload.password, account.password_hash):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid login")
+
+    query = (
+        session.query(User, Tenant)
+        .join(Tenant, Tenant.id == User.tenant_id)
+        .filter(
+            User.account_id == account.id,
+            User.is_active.is_(True),
+            Tenant.is_active.is_(True),
+        )
+    )
+    if payload.tenant_slug:
+        query = query.filter(Tenant.slug == payload.tenant_slug)
+    row = query.order_by(Tenant.name.asc()).first()
+    if row is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="No active tenant membership")
+    return account, row[0], row[1]
+
+
+def _me_response(
+    session: Session,
+    *,
+    account: Account,
+    user: User,
+    tenant: Tenant,
+    effective_scopes: list[str] | None = None,
+    include_system: bool = True,
+    include_all_memberships: bool = True,
+) -> MeResponse:
+    tenant_roles = collect_user_roles(session, user)
+    system_roles = collect_system_roles(session, account) if include_system else []
+    groups = collect_user_groups(session, user)
+    active_tenant = _tenant_info(tenant)
+    memberships = _tenant_memberships(session, account) if include_all_memberships else [
+        TenantMembershipInfo(
+            id=tenant.id,
+            slug=tenant.slug,
+            name=tenant.name,
+            is_active=tenant.is_active and user.is_active,
+            default_locale=tenant.default_locale,
+            roles=[role.slug for role in tenant_roles],
+        )
+    ]
+    return MeResponse(
+        user=_user_info(user, account),
+        tenant=active_tenant,
+        active_tenant=active_tenant,
+        tenants=memberships,
+        scopes=effective_scopes if effective_scopes is not None else collect_user_scopes(session, user, include_system=include_system),
+        roles=_roles_info(tenant_roles) + _roles_info(system_roles, level="system"),
+        groups=_groups_info(groups),
+    )
+
+
+@router.post("/login", response_model=LoginResponse)
+def login(payload: LoginRequest, request: Request, response: Response, session: Session = Depends(get_session)):
+    account, user, tenant = _resolve_login_user(session, payload)
+    user_agent = request.headers.get("user-agent")
+    ip_address = request.client.host if request.client else None
+    created = create_auth_session(
+        session,
+        user=user,
+        hours=settings.auth_session_hours,
+        user_agent=user_agent,
+        ip_address=ip_address,
+    )
+    me_payload = _me_response(session, account=account, user=user, tenant=tenant)
+    session.commit()
+    _set_auth_cookies(response, created)
+    return LoginResponse(
+        access_token=created.token,
+        expires_at=created.model.expires_at,
+        **me_payload.model_dump(),
+    )
+
+
+@router.get("/me", response_model=MeResponse)
+def me(principal: ApiPrincipal = Depends(get_api_principal), session: Session = Depends(get_session)):
+    tenant = session.get(Tenant, principal.tenant_id)
+    if tenant is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Active tenant not found")
+    return _me_response(
+        session,
+        account=principal.account,
+        user=principal.user,
+        tenant=tenant,
+        effective_scopes=principal.scopes,
+        include_system=principal.auth_session is not None,
+        include_all_memberships=principal.auth_session is not None,
+    )
+
+
+@router.patch("/profile", response_model=MeResponse)
+def update_profile(
+    payload: ProfileUpdateRequest,
+    principal: ApiPrincipal = Depends(get_api_principal),
+    session: Session = Depends(get_session),
+):
+    if principal.auth_session is None:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="API keys cannot edit an interactive user profile")
+
+    if "display_name" in payload.model_fields_set:
+        principal.account.display_name = payload.display_name.strip() if payload.display_name else None
+        session.add(principal.account)
+    if "tenant_display_name" in payload.model_fields_set:
+        principal.user.display_name = payload.tenant_display_name.strip() if payload.tenant_display_name else None
+        session.add(principal.user)
+
+    audit_from_principal(
+        session,
+        principal,
+        action="profile.updated",
+        object_type="account",
+        object_id=principal.account.id,
+        details={"fields": sorted(payload.model_fields_set)},
+    )
+    tenant = session.get(Tenant, principal.tenant_id)
+    if tenant is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Active tenant not found")
+    session.commit()
+    return _me_response(
+        session,
+        account=principal.account,
+        user=principal.user,
+        tenant=tenant,
+        include_system=True,
+        include_all_memberships=True,
+    )
+
+
+@router.post("/switch-tenant", response_model=MeResponse)
+def switch_tenant(
+    payload: SwitchTenantRequest,
+    principal: ApiPrincipal = Depends(get_api_principal),
+    session: Session = Depends(get_session),
+):
+    if principal.auth_session is None:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="API keys cannot switch tenant context")
+    try:
+        membership = switch_auth_session_tenant(session, principal.auth_session, payload.tenant_id)
+    except LookupError as exc:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=str(exc)) from exc
+    tenant = session.get(Tenant, membership.tenant_id)
+    if tenant is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Tenant not found")
+    session.commit()
+    return _me_response(session, account=principal.account, user=membership, tenant=tenant)
+
+
+@router.post("/logout")
+def logout(
+    response: Response,
+    principal: ApiPrincipal = Depends(get_api_principal),
+    session: Session = Depends(get_session),
+):
+    if principal.auth_session is not None:
+        principal.auth_session.revoked_at = utc_now()
+        session.add(principal.auth_session)
+        session.commit()
+    _clear_auth_cookies(response)
+    return {"ok": True}
--- a/src/govoplan_core/api/v1/schemas.py
+++ b/src/govoplan_core/api/v1/schemas.py
@@ -0,0 +1,111 @@
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Any, Literal
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class AuditLogItemResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: str
+    tenant_id: str | None = None
+    user_id: str | None = None
+    api_key_id: str | None = None
+    action: str
+    object_type: str | None = None
+    object_id: str | None = None
+    details: dict[str, Any] | None = None
+    created_at: datetime
+
+
+class AuditLogListResponse(BaseModel):
+    items: list[AuditLogItemResponse]
+
+
+class LoginRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    email: str
+    password: str
+    # Kept optional for backwards compatibility and future tenant-switch login flows.
+    # The WebUI no longer sends it. If omitted, the backend resolves the user by email.
+    tenant_slug: str | None = None
+
+
+class SwitchTenantRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    tenant_id: str
+
+
+class TenantInfo(BaseModel):
+    id: str
+    slug: str
+    name: str
+    is_active: bool = True
+    default_locale: str = "en"
+
+
+class TenantMembershipInfo(TenantInfo):
+    roles: list[str] = Field(default_factory=list)
+    is_active: bool = True
+
+
+class UserInfo(BaseModel):
+    id: str
+    account_id: str
+    email: str
+    # Global account identity used by the title bar and account settings.
+    display_name: str | None = None
+    # Optional tenant-local alias used in tenant administration and ownership.
+    tenant_display_name: str | None = None
+    is_tenant_admin: bool = False
+    password_reset_required: bool = False
+
+
+class ProfileUpdateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    display_name: str | None = Field(default=None, max_length=255)
+    tenant_display_name: str | None = Field(default=None, max_length=255)
+
+
+class RoleInfo(BaseModel):
+    id: str
+    slug: str
+    name: str
+    permissions: list[str] = Field(default_factory=list)
+    level: Literal["tenant", "system"] = "tenant"
+
+
+class GroupInfo(BaseModel):
+    id: str
+    slug: str
+    name: str
+
+
+class LoginResponse(BaseModel):
+    access_token: str
+    token_type: str = "bearer"
+    expires_at: datetime
+    user: UserInfo
+    # Backwards-compatible alias for the active tenant.
+    tenant: TenantInfo
+    active_tenant: TenantInfo
+    tenants: list[TenantMembershipInfo] = Field(default_factory=list)
+    scopes: list[str]
+    roles: list[RoleInfo] = Field(default_factory=list)
+    groups: list[GroupInfo] = Field(default_factory=list)
+
+
+class MeResponse(BaseModel):
+    user: UserInfo
+    # Backwards-compatible alias for the active tenant.
+    tenant: TenantInfo
+    active_tenant: TenantInfo
+    tenants: list[TenantMembershipInfo] = Field(default_factory=list)
+    scopes: list[str]
+    roles: list[RoleInfo] = Field(default_factory=list)
+    groups: list[GroupInfo] = Field(default_factory=list)
--- a/src/govoplan_core/api/v1/system.py
+++ b/src/govoplan_core/api/v1/system.py
@@ -0,0 +1,29 @@
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import APIRouter, Depends, HTTPException, status
+
+from govoplan_core.auth.dependencies import ApiPrincipal, require_any_scope
+
+router = APIRouter(prefix="/schemas", tags=["schemas"])
+
+
+def _load_campaign_schema() -> dict[str, Any]:
+    try:
+        from govoplan_campaign.backend.campaign.loader import load_campaign_schema
+    except ModuleNotFoundError as exc:
+        if exc.name == "govoplan_campaign" or exc.name.startswith("govoplan_campaign."):
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Campaign module is not installed") from exc
+        raise
+    return load_campaign_schema()
+
+
+@router.get("/campaign")
+def get_campaign_schema(
+    principal: ApiPrincipal = Depends(require_any_scope("campaigns:campaign:read", "campaigns:campaign:create", "admin:roles:read")),
+) -> dict[str, Any]:
+    """Return the authoritative campaign JSON Schema used by the backend."""
+
+    del principal
+    return _load_campaign_schema()