# Global Enterprise Rules
## Tujuan
Platform Enterprise Portal berbasis Laravel, PostgreSQL, LDAP, CMS, API Management.

## Prinsip
- Security First
- Audit First
- API First
- Approval First
- Production Ready Only

## Requirement Wajib
- MFA Ready
- SSO Ready
- Audit Trail Immutable
- Maker Checker
- Four Eyes Principle
- Multi Database
- Docker Ready
- PWA Ready

---

## Status Implementasi (geonet-console vs cursor-exsisting)

Referensi audit: `cursor-exsisting/`, kode `geonet-console/`, tanggal 2026-06-12.

### Tujuan

| Poin | Status | Catatan | Dapat diimplementasi |
|------|--------|---------|----------------------|
| Laravel | ✅ Sudah | Laravel 11 (`composer.json` ^11.31). Bukan Laravel 12 seperti baseline enterprise. | Ya — upgrade major saat siap |
| PostgreSQL | ✅ Sudah | App metadata + audit di PostgreSQL Docker (`audit-postgres`). Koneksi terpisah `pgsql` + `audit`. | Sudah ada |
| LDAP | ✅ Sudah | Auth web & API via `LdapAuthService`, manajemen user/grup, password reset. | Sudah ada |
| CMS | ❌ Belum | Tidak ada modul CMS (page, post, workflow). Scope geonet-console = ops console, bukan portal CMS. | Tidak relevan untuk scope saat ini; bisa modul terpisah jika portal CMS dibutuhkan |
| API Management | ⚠️ Partial | API v1 + Passport OAuth2 + API token + scope middleware + Swagger UI. Belum ada gateway/rate-plan/portal developer penuh. | Ya — perluas API management layer |

### Prinsip

| Poin | Status | Catatan | Dapat diimplementasi |
|------|--------|---------|----------------------|
| Security First | ⚠️ Partial | CSRF, LDAP auth, API scope, throttle login, encrypted DB passwords. Belum MFA/SSO formal, RBAC granular, security headers khusus. | Ya |
| Audit First | ✅ Sudah | `AuditLogService`, middleware web/API, beacon UI page-view/duration, halaman audit logs. | Sudah ada |
| API First | ⚠️ Partial | REST API v1 lengkap untuk DB/LDAP; web UI juga ada. Bukan headless-only. | Ya — sudah dual channel |
| Approval First | ❌ Belum | Tidak ada workflow approval / maker-checker di UI maupun API. Aksi admin langsung dieksekusi. | Ya — butuh desain workflow + tabel approval |
| Production Ready Only | ⚠️ Partial | Docker + healthcheck + deploy script + Nginx reverse proxy produksi. Tidak ada test suite, Tailwind CDN di prod, default password di compose example. | Ya — hardening bertahap |

### Requirement Wajib

| Poin | Status | Catatan | Dapat diimplementasi |
|------|--------|---------|----------------------|
| MFA Ready | ❌ Belum | Tidak ada TOTP/WebAuthn/SMS. Login hanya username+password LDAP. | Ya — integrasi LDAP + step-up MFA atau IdP |
| SSO Ready | ❌ Belum | OAuth2 hanya untuk **API client credentials**, bukan SSO user (SAML/OIDC federation). Login web = LDAP bind langsung. | Ya — SAML/OIDC via Laravel Socialite atau IdP proxy |
| Audit Trail Immutable | ⚠️ Partial | Append-only di praktik (hanya `create`, tidak ada route update/delete). Belum ada DB trigger, hash chain, atau WORM storage. Model Eloquent tetap bisa diubah lewat kode. | Ya — trigger PostgreSQL + revoke UPDATE/DELETE role |
| Maker Checker | ❌ Belum | Tidak ada entitas maker/checker, antrian persetujuan, atau pemisahan role submit/approve. | Ya — modul baru (queue approval + UI) |
| Four Eyes Principle | ❌ Belum | Aksi sensitif (offline DB, reset password LDAP, revoke token) tanpa verifikasi dual control. | Ya — bergantung maker-checker |
| Multi Database | ✅ Sudah | Koneksi dinamis SQL Server, PostgreSQL, MySQL/MariaDB via `DatabaseConnectionManager`. UI switch connection. | Sudah ada |
| Docker Ready | ✅ Sudah | `Dockerfile`, `compose.yaml`, volume eksternal, healthcheck, Dockge stack produksi. | Sudah ada |
| PWA Ready | ⚠️ Partial | Manifest, SW, install prompt, offline shell/login cache (`cursor-exsisting/08-pwa-offline.mdc`). Belum push notification & background sync. | Ya — push/sync fase lanjutan |

### Ringkasan 00-global
- **Sudah (5):** Laravel, PostgreSQL, LDAP, Multi Database, Docker Ready
- **Partial (6):** API Management, Security/Audit/API/Production principles, Audit Immutable, PWA Ready
- **Belum (5):** CMS, MFA, SSO user, Maker Checker, Four Eyes, Approval First