iQ Key Value Foundation

👥 Identity & Access (IAM)

• Hybrid Tenancy: Multi-tenant (B2B) or Single-tenant (B2C) rollout modes
• Self-service signup, invitation flows, and 2-layer token revocation (JTI denylist + global signout)
• RBAC with TENANT_OWNER, ADMIN, MEMBER, and PLATFORM_ADMIN
• OAuth2/OIDC Federation: Social login via Google, GitHub, and Microsoft; account linking/unlinking
• Enterprise SSO: Tenant-scoped custom OIDC provider configuration with AES-256-GCM encrypted secrets
• Magic Link Auth: Passwordless sign-in with configurable TTL and rate limiting
• Token Exchange: Seamless workspace switching without re-authentication
• Avatar Uploads: Two-phase presigned S3/MinIO flow with auto-cleanup
• In-App Notifications: Real-time WebSocket/STOMP push + persisted unread badges
• Global Announcements: Multi-lingual with async fan-out to all users

💳 Billing & Payments

• Dual payment gateway: Stripe and Lemon Squeezy — runtime configurable via a single property
• Two pricing models: FLAT (fixed price) and PER_SEAT (per-user billing with seat count enforcement)
• Plan catalog management via YAML config; idempotent normalized webhook processing for both gateways
• Plan Feature Enforcement: plan_code JWT claim propagated through Gateway; PlanFeatureGuard annotation; HTTP 402 on quota or feature violations
• Entitlement evaluation with typed quotas (maxUsers, maxProjects) and open feature map
• Refunds API: Full refund management for tenants and platform admin
• Customer Portal: Self-service billing management (both Stripe and Lemon Squeezy)
• Trial period support with isInTrial and trialDaysLeft on subscription responses

💬 AI Chat (Spring AI 2.0 + Ollama)

• LLM-backed conversational API with session and message persistence per user
• Configurable system prompt, input char limit, output token budget, and temperature — all via env vars without rebuild
• Default model llama3.1:8b on Ollama; swappable to any OpenAI-compatible provider via config
• JWT RS256 resource server validated via IAM JWKS; gateway route with 180s timeout for LLM inference
• Admin oversight addon in Platform Admin — read all sessions, view full chat history with markdown rendering
• Tenant app addon — chat interface with session list, markdown bubbles, animated UI

📱 Included UI Applications

• Tenant App: React 19 SPA — workspace members (team management, billing self-service, notifications, connected accounts, SSO configuration, AI Chat addon, i18n: en/bg/de/fr)
• Platform Admin: Operator console — global user/org management, subscriptions, audit logs, announcements, refunds, AI Chat Sessions addon, user identity management (i18n: en/bg/de/fr)
• Landing Kit: Performance-optimized Astro site with auth-aware navigation, plan selector with per-seat pricing support

Backend Services (100+ REST endpoints, 20+ domain event types):

• IAM Service: Auth / Tenancy / OAuth2-OIDC / Invitations / Announcements / Notifications / Magic Link
• Gateway Service: Spring Cloud Gateway (WebFlux) / RS256 JWT validation / Header sanitization / Plan enforcement / Audit context propagation
• Billing Service: Payments / Subscriptions / Seat management / Refunds / Dual gateway (Stripe + Lemon Squeezy)
• Audit Service: Passive event-driven audit logs; SPI pattern; JSONB metadata; severity filtering
• CMS Service: Content management, multi-language support, hierarchical pages, SEO metadata
• AI Chat Service: Spring AI 2.0 + Ollama; chat session/message persistence; prompt engineering controls; PLATFORM_ADMIN oversight API

Frontend SPAs (60+ UI routes): Feature-Sliced Design (FSD), TanStack Router/Query, Zustand, Lingui 6 i18n, React Hook Form + Zod, Vitest + Playwright, OxLint / OxFmt

Infrastructure: PostgreSQL 17 (schema-per-tenant isolation), RabbitMQ (topic exchange, DLQ), Redis (OAuth2 PKCE state, token denylist), MinIO S3, Ollama (local LLM inference), Prometheus + Grafana + Loki, Helm / Kubernetes

Technical Standards:

• Backend: Domain-driven design, MyBatis schema routing, ShedLock scheduled jobs, Micrometer custom metrics
• Security: PKCE OAuth2 flow, header sanitization, JTI denylist, brute-force lockout, JWKS, BCrypt strength 12
• Observability: Prometheus metrics on all services, pre-provisioned Grafana dashboards (JVM, IAM, Gateway, Billing, Audit), structured JSON logging with correlation ID
• Quality: SonarQube, JaCoCo 80% gate, PMD, SpotBugs, ArchUnit, Testcontainers
• Operations: Multi-stage Docker builds (JDK build → JRE runtime, non-root), semantic versioning, automated changelogs, HPA (2–10 replicas)

Platform Numbers:

• 6 backend services · 3 frontend applications · 2 shared libraries
• 2 deployment modes (MULTI_TENANT / SINGLE_TENANT) with zero-migration path
• 2 payment gateways (Stripe + Lemon Squeezy)
• 3 social login providers (Google, GitHub, Microsoft)
• 5 PostgreSQL databases (schema-per-tenant in IAM and CMS; system schema in AI Chat)