# DBIS Portal Login Credentials & Endpoints

**Last Updated:** 2026-04-15

---

## Login Credentials

### Current Authentication Status

The portals now use the backend `/api/auth/*` endpoints. The old mock-auth behavior is no longer active.

There are now two supported login patterns:
- `core.d-bis.org` and `admin.d-bis.org` use employee-backed portal auth.
- `secure.d-bis.org` uses member-backed portal auth.

### Login Instructions

1. Go to the portal surface you need:
   - `https://core.d-bis.org/login`
   - `https://admin.d-bis.org/login`
   - `https://secure.d-bis.org/login`
2. Enter the username for that surface.
3. Enter the matching secret or credential.
4. Click `Sign In`.
5. For `core` and `admin`, enter the 6-digit authenticator code when prompted if MFA is enabled on the employee account.

### Credential Rules

#### Employee-backed surfaces: `core` and `admin`

The username must match an active `employee_credentials` record by employee ID or email.

The password must match the employee's stored `portalPasswordHash` credential.

If MFA is enabled, the login flow requires a valid TOTP code after the password step.

#### Member surface: `secure`

The username must match an active `portal_member_accounts` record by member ID or email.

The password must match the member account's stored `portalPasswordHash` credential.

The member account must also be `approved` and linked to either:
- a live participant record with GLEIF-backed LEI validation, or
- a stored institution snapshot containing a registry-validated LEI, institution name, and country.

---

## Frontend Routes (Client-Side)

### Public Routes

| Route | Description | Component |
|-------|-------------|-----------|
| `/login` | Login page | `LoginPage` |
| `/404` | 404 error page | `PageError` |
| `/403` | 403 forbidden page | `PageError` |
| `/500` | 500 server error page | `PageError` |

### Protected Routes (Require Authentication)

#### DBIS Admin Console Routes

| Route | Description | Component |
|-------|-------------|-----------|
| `/` | Redirects to `/dbis/overview` | - |
| `/dbis/overview` | Global Overview Dashboard | `DBISOverviewPage` |
| `/dbis/participants` | Participants & Jurisdictions | `DBISParticipantsPage` |
| `/dbis/gru` | GRU Command Center | `DBISGRUPage` |
| `/dbis/gas-qps` | GAS & QPS Control Panel | `DBISGASQPSPage` |
| `/dbis/cbdc-fx` | CBDC & FX Management | `DBISCBDCFXPage` |
| `/dbis/metaverse-edge` | Metaverse & Edge Management | `DBISMetaverseEdgePage` |
| `/dbis/risk-compliance` | Risk & Compliance Dashboard | `DBISRiskCompliancePage` |

#### SCB Admin Console Routes

| Route | Description | Component |
|-------|-------------|-----------|
| `/scb/overview` | SCB Overview Dashboard | `SCBOverviewPage` |
| `/scb/fi-management` | FI Management & Nostro/Vostro | `SCBFIManagementPage` |
| `/scb/corridors` | Corridor & FX Policy | `SCBCorridorPolicyPage` |

---

## Backend API Endpoints

### Base URL

**Development:** `http://localhost:3000`  
**Production:** Configured via `VITE_API_BASE_URL` environment variable  
**Default:** `http://192.168.11.150:3000` (based on deployment config)

### Authentication Endpoints

| Method | Endpoint | Description | Status |
|--------|----------|-------------|--------|
| `POST` | `/api/auth/login` | Portal login | Live |
| `POST` | `/api/auth/logout` | Portal logout | Live |
| `GET` | `/api/auth/me` | Resolve current portal user from token | Live |
| `POST` | `/api/auth/password/change` | Authenticated password rotation | Live |
| `POST` | `/api/auth/password/reset/request` | Record password reset request | Live |
| `POST` | `/api/auth/password/reset/complete` | Complete reset with one-time token | Live |
| `GET` | `/api/auth/mfa/status` | Employee MFA status | Live |
| `POST` | `/api/auth/mfa/setup` | Generate employee MFA enrollment secret | Live |
| `POST` | `/api/auth/mfa/enable` | Enable employee MFA | Live |
| `POST` | `/api/auth/mfa/disable` | Disable employee MFA | Live |
| `POST` | `/api/auth/admin/accounts/employee` | Issue or update employee portal account | Live |
| `GET` | `/api/auth/admin/accounts/member` | List member portal accounts | Live |
| `POST` | `/api/auth/admin/accounts/member` | Issue member portal account | Live |
| `POST` | `/api/auth/admin/accounts/member/:memberId/approve` | Approve member portal account | Live |
| `POST` | `/api/auth/admin/password-reset/issue` | Issue one-time reset token | Live |
| `POST` | `/api/auth/admin/accounts/deactivate` | Deactivate employee or member account | Live |
| `POST` | `/api/auth/refresh` | Refresh token | Not implemented |

### DBIS Admin API Endpoints

#### Dashboard & Overview

| Method | Endpoint | Description |
|--------|----------|-------------|
| `GET` | `/api/admin/dbis/dashboard/overview` | Global overview dashboard data |
| `GET` | `/api/admin/dbis/participants` | List all participants |
| `GET` | `/api/admin/dbis/participants/:scbId` | Get participant details |
| `GET` | `/api/admin/dbis/participants/:scbId/jurisdiction` | Get jurisdiction settings |
| `GET` | `/api/admin/dbis/corridors` | Get all corridors |

#### GRU Command Center

| Method | Endpoint | Description |
|--------|----------|-------------|
| `GET` | `/api/admin/dbis/gru/command` | GRU command dashboard |
| `POST` | `/api/admin/dbis/gru/issuance/proposal` | Create GRU issuance proposal |
| `POST` | `/api/admin/dbis/gru/lock` | Lock/unlock GRU class |
| `POST` | `/api/admin/dbis/gru/circuit-breakers` | Set circuit breakers |
| `POST` | `/api/admin/dbis/gru/bonds/window` | Manage bond issuance window |
| `POST` | `/api/admin/dbis/gru/bonds/buyback` | Trigger emergency buyback |

#### GAS & QPS

| Method | Endpoint | Description |
|--------|----------|-------------|
| `GET` | `/api/admin/dbis/gas-qps` | GAS & QPS dashboard |

#### CBDC & FX

| Method | Endpoint | Description |
|--------|----------|-------------|
| `GET` | `/api/admin/dbis/cbdc-fx` | CBDC & FX dashboard |

#### Metaverse & Edge

| Method | Endpoint | Description |
|--------|----------|-------------|
| `GET` | `/api/admin/dbis/metaverse-edge` | Metaverse & Edge dashboard |

#### Risk & Compliance

| Method | Endpoint | Description |
|--------|----------|-------------|
| `GET` | `/api/admin/dbis/risk-compliance` | Risk & Compliance dashboard |

#### Network Controls

| Method | Endpoint | Description |
|--------|----------|-------------|
| `POST` | `/api/admin/dbis/network/quiesce` | Quiesce subsystem |
| `POST` | `/api/admin/dbis/network/kill-switch` | Activate kill switch |
| `POST` | `/api/admin/dbis/network/escalate` | Escalate incident |

#### Corridor Controls

| Method | Endpoint | Description |
|--------|----------|-------------|
| `POST` | `/api/admin/dbis/corridors/caps` | Adjust corridor caps |
| `POST` | `/api/admin/dbis/corridors/throttle` | Throttle corridor |
| `POST` | `/api/admin/dbis/corridors/enable-disable` | Enable/disable corridor |

#### Liquidity Engine

| Method | Endpoint | Description |
|--------|----------|-------------|
| `GET` | `/api/admin/liquidity/decision-map` | Get liquidity decision map |
| `PUT` | `/api/admin/liquidity/decision-map` | Update liquidity decision map |
| `GET` | `/api/admin/liquidity/quotes` | Get liquidity quotes |
| `GET` | `/api/admin/liquidity/routing-stats` | Get routing statistics |
| `POST` | `/api/admin/liquidity/simulate-route` | Simulate routing |

### SCB Admin API Endpoints

#### SCB Overview

| Method | Endpoint | Description |
|--------|----------|-------------|
| `GET` | `/api/admin/scb/dashboard/overview` | SCB overview dashboard |

#### FI Management

| Method | Endpoint | Description |
|--------|----------|-------------|
| `GET` | `/api/admin/scb/fi` | Get FI management dashboard |
| `POST` | `/api/admin/scb/fi/approve-suspend` | Approve or suspend FI |
| `POST` | `/api/admin/scb/fi/limits` | Set FI limits |
| `POST` | `/api/admin/scb/fi/api-profile` | Assign API profile |

#### Corridor & FX Policy

| Method | Endpoint | Description |
|--------|----------|-------------|
| `GET` | `/api/admin/scb/corridors` | Get corridor policy dashboard |

#### CBDC & GRU Controls

| Method | Endpoint | Description |
|--------|----------|-------------|
| `POST` | `/api/admin/scb/cbdc/parameters` | Update CBDC parameters |
| `POST` | `/api/admin/scb/gru/policy` | Update GRU policy |

---

## 🔑 Authentication Details

### Current Implementation

- **Type:** Live backend-backed portal authentication
- **Token Storage:** `sessionStorage` (cleared on tab close)
- **Token Format:** `SOV-TOKEN <token>`
- **Token Header:** `Authorization: SOV-TOKEN <token>`
- **Employee MFA:** TOTP for `core` and `admin` when enabled on the employee record
- **Lockout Policy:** Failed login attempts trigger temporary account lockout
- **Password Lifecycle:** Change-password, admin-issued reset token, and reset completion flows are available

### Request Headers

All API requests include:

```
Authorization: SOV-TOKEN <token>
X-SOV-Timestamp: <timestamp>
X-SOV-Nonce: <random-nonce>
Content-Type: application/json
```

### User Roles

| Role | Permissions | Access Level |
|------|-------------|--------------|
| `DBIS_Super_Admin` | `['all']` | Full access to all features |
| `DBIS_Ops` | Specific permissions | DBIS operations access |
| `DBIS_Risk` | Specific permissions | Risk & compliance access |
| `SCB_Admin` | SCB-specific | SCB-level access only |

---

## Quick Reference

### Login
- **Core:** `https://core.d-bis.org/login`
- **Admin:** `https://admin.d-bis.org/login`
- **Member:** `https://secure.d-bis.org/login`
- **After Login:** Redirects to the runtime portal home route

### Main Dashboards
- **Core Overview:** `https://core.d-bis.org/`
- **Admin Overview:** `https://admin.d-bis.org/`
- **Member Overview:** `https://secure.d-bis.org/`

### API Base URL
- **Default:** `http://192.168.11.150:3000`
- **Configurable:** Via `VITE_API_BASE_URL` environment variable

---

## Important Notes

1. **Real portal auth:** The frontend calls the backend auth routes and no longer accepts arbitrary credentials.
2. **Backend required:** Portal login depends on the live DBIS API.
3. **Token format:** Portal sessions use JWT bearer tokens.
4. **Session storage:** Tokens and user state are kept in `sessionStorage`.
5. **Member surface:** `secure.d-bis.org` uses the member shared-secret login path.

---

## Next Steps

1. Replace shared-secret employee bootstrap access with individually managed credentials only.
2. Add token refresh or httpOnly cookie sessions.
3. Add role-specific operator runbooks for issuing portal accounts.
