Add ApexTrust Banking single-file MVP, specs, docs, and deployment/test plans#3
Open
support371 wants to merge 2 commits into
Open
Add ApexTrust Banking single-file MVP, specs, docs, and deployment/test plans#3support371 wants to merge 2 commits into
support371 wants to merge 2 commits into
Conversation
Reviewer's GuideIntroduce the ApexTrust Banking single-file institutional demo MVP with a self-contained web app, backed by formal product specs and operational docs for deployment, testing, and follow-up work, along with updated task proposals and README branding. Sequence diagram for client signup and auto-provisioning flowsequenceDiagram
actor Client
participant UI as BrowserUI
participant App as ApexTrustApp
participant State
participant Audit as AuditLog
Client->>UI: Fill signup form (name, email, password, region)
Client->>UI: Click Create Client Profile
UI->>App: signup(name, email, password, region)
App->>State: Validate unique email
App->>State: Create User(role=client, region)
App->>State: Create KycRecord(status=pending)
App->>App: provisionAccount(user)
App->>State: Add region-specific Account
App->>State: Set Session.currentUserId
App->>Audit: log(action=signup, payload={userId, region})
App->>State: saveState() to localStorage
App-->>UI: Navigate to dashboard
UI-->>Client: Show ledger KPIs, KYC status, reference code
Sequence diagram for deposit quote, expiry, settlement, and ledger updatesequenceDiagram
actor Client
participant UI as BrowserUI
participant App as ApexTrustApp
participant State
participant Audit as AuditLog
Client->>UI: Enter deposit amount
Client->>UI: Click Create Quote
UI->>App: createDepositQuote(amount)
App->>State: Compute fee and net
App->>State: Create Deposit(status=quoted, expiresAt)
App->>Audit: log(action=deposit_quote, payload={amount})
App->>State: saveState()
App-->>UI: Render quote with expiry and memo instructions
Client->>UI: Click Settle on quoted deposit
UI->>App: settleDeposit(depositId)
App->>State: Load Deposit by id
App->>App: checkExpiry(expiresAt)
alt Quote expired
App->>State: Update Deposit.status=expired
App->>Audit: log(action=deposit_expired, payload={depositId})
App->>State: saveState()
App-->>UI: Show expired status
else Quote valid
App->>State: Update Deposit.status=settled
App->>State: Append LedgerEntry(type=deposit_settlement, direction=credit, amount=net)
App->>Audit: log(action=deposit_settled, payload={depositId, net})
App->>State: saveState()
App-->>UI: Redirect to dashboard with updated balance
end
Sequence diagram for card eligibility, issuance, and purchase impact on ledgersequenceDiagram
actor Client
participant UI as BrowserUI
participant App as ApexTrustApp
participant State
participant Audit as AuditLog
Client->>UI: Open Cards view
UI->>App: loadCards()
App->>State: Read User, KycRecord, LedgerEntry
App->>App: cardEligibility(user)
App-->>UI: Show blockers or Issue Card button
alt All eligibility conditions met
Client->>UI: Click Issue Card
UI->>App: issueCard()
App->>State: Create Card(status=active, last4)
App->>Audit: log(action=card_issued, payload={clientId})
App->>State: saveState()
App-->>UI: Show issued card
Client->>UI: Click Simulate $25 Purchase
UI->>App: simulateCardPurchase(cardId)
App->>State: Load Card
App->>State: Append LedgerEntry(type=card_purchase, direction=debit, amount=25)
App->>Audit: log(action=card_purchase, payload={cardId, amount})
App->>State: saveState()
App-->>UI: Redirect to dashboard with reduced balance
else Eligibility blocked
UI-->>Client: Display reasons (KYC, portfolio, region)
end
Sequence diagram for audit log tamper detection and verificationsequenceDiagram
actor Admin
participant UI as BrowserUI
participant App as ApexTrustApp
participant State
participant Audit as AuditLog
Admin->>UI: Open Settings or Admin Audit view
UI->>App: verifyAudit()
App->>State: Iterate AuditEntry list
loop For each entry from second to last
App->>Audit: Compare current.prevHash with previous.hash
App->>Audit: Recompute hash from entry fields
end
alt All links and hashes match
App-->>UI: Return status OK
else Mismatch detected
App-->>UI: Return status CHECK
end
UI-->>Admin: Display Audit Integrity pill (OK or CHECK)
Admin->>UI: Click Tamper Audit Entry (test)
UI->>App: tamperAuditEntry()
App->>State: Mutate stored AuditEntry.actor
App->>State: saveState()
Admin->>UI: Re-run Verify Integrity
UI->>App: verifyAudit()
App-->>UI: Return status CHECK
UI-->>Admin: Highlight audit chain failure
ER diagram for ApexTrust Banking MVP data modelerDiagram
USERS {
string id
string name
string email
string password
string role
string region
string referenceCode
}
ACCOUNTS {
string id
string clientId
string region
string rail
string routing
string sortCode
string account
string clabe
string pixKey
string iban
string bic
string createdAt
}
KYC_RECORDS {
string id
string clientId
string status
string updatedAt
}
KYC_DOCUMENTS {
string kycRecordId
string name
string submittedAt
}
DEPOSITS {
string id
string clientId
number amount
number fee
number net
number rate
string status
string expiresAt
string createdAt
}
CARDS {
string id
string clientId
string last4
string status
string createdAt
}
LEDGER_ENTRIES {
string id
string clientId
string type
number amount
string currency
string direction
string ts
string source
}
RATINGS {
string id
string clientId
number reliability
number support
number transparency
string assertion
string comment
string createdAt
}
INCIDENTS {
string id
string severity
string status
string impact
string mitigation
string rca
string createdAt
string updatedAt
string resolvedAt
string owner
}
COMPLIANCE_POSTURE {
string id
string kycAml
string sanctions
string dataProtection
string incidentResponse
string changeMgmt
string vendorRisk
string uptime
string latency
string errorRate
string lastDeploy
string lastIncident
}
AUDIT_ENTRIES {
string id
string ts
string actor
string action
string payload
string prevHash
string hash
}
CONSENTS {
string id
string clientId
string version
string ts
}
USERS ||--o{ ACCOUNTS : owns
USERS ||--o{ KYC_RECORDS : has
KYC_RECORDS ||--o{ KYC_DOCUMENTS : includes
USERS ||--o{ DEPOSITS : funds
USERS ||--o{ CARDS : holds
USERS ||--o{ LEDGER_ENTRIES : balanceFrom
USERS ||--o{ RATINGS : rates
USERS ||--o{ CONSENTS : accepts
DEPOSITS ||--o{ LEDGER_ENTRIES : settlesInto
CARDS ||--o{ LEDGER_ENTRIES : charges
COMPLIANCE_POSTURE ||--o{ INCIDENTS : records
USERS ||--o{ AUDIT_ENTRIES : actor
Class diagram for ApexTrust Banking single-file MVP state and domain modelclassDiagram
class ApexTrustApp {
+string storageKey
+State state
+string currentRoute
+loadState()
+saveState()
+getCurrentUser() User
+isAdmin() bool
+log(action, payload)
+verifyAudit() string
+provisionAccount(user)
+render()
}
class State {
+User[] users
+Session sessions
+Account[] accounts
+KycRecord[] kyc
+Deposit[] deposits
+Card[] cards
+LedgerEntry[] ledger
+Rating[] ratings
+Incident[] incidents
+CompliancePosture compliance
+AuditEntry[] audit
+Consent[] consents
}
class Session {
+string currentUserId
}
class User {
+string id
+string name
+string email
+string password
+string role
+string region
+string referenceCode
}
class Account {
+string id
+string clientId
+string region
+string rail
+string routing
+string sortCode
+string account
+string clabe
+string pixKey
+string iban
+string bic
+string createdAt
}
class KycRecord {
+string id
+string clientId
+string status
+KycDocument[] documents
+string updatedAt
}
class KycDocument {
+string name
+string submittedAt
}
class Deposit {
+string id
+string clientId
+number amount
+number fee
+number net
+number rate
+string status
+string expiresAt
+string createdAt
}
class Card {
+string id
+string clientId
+string last4
+string status
+string createdAt
}
class LedgerEntry {
+string id
+string clientId
+string type
+number amount
+string currency
+string direction
+string ts
+string source
}
class Rating {
+string id
+string clientId
+number reliability
+number support
+number transparency
+string assertion
+string comment
+string createdAt
}
class Incident {
+string id
+string severity
+string status
+string impact
+string mitigation
+string rca
+string createdAt
+string updatedAt
+string resolvedAt
+string owner
}
class CompliancePosture {
+string kycAml
+string sanctions
+string dataProtection
+string incidentResponse
+string changeMgmt
+string vendorRisk
+string uptime
+string latency
+string errorRate
+string lastDeploy
+string lastIncident
}
class AuditEntry {
+string id
+string ts
+string actor
+string action
+any payload
+string prevHash
+string hash
}
class Consent {
+string id
+string clientId
+string version
+string ts
}
ApexTrustApp o-- State
State o-- Session
State o-- User
State o-- Account
State o-- KycRecord
State o-- Deposit
State o-- Card
State o-- LedgerEntry
State o-- Rating
State o-- Incident
State o-- CompliancePosture
State o-- AuditEntry
State o-- Consent
User "1" --> "*" Account : owns
User "1" --> "1" KycRecord : has
User "1" --> "*" Deposit : creates
User "1" --> "*" Card : holds
User "1" --> "*" LedgerEntry : balanceFrom
User "1" --> "*" Rating : submits
User "1" --> "*" Consent : records
Deposit "1" --> "*" LedgerEntry : settlement
Card "1" --> "*" LedgerEntry : purchases
ApexTrustApp --> AuditEntry : log
ApexTrustApp --> AuditEntry : verifyAudit
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
support371
marked this pull request as ready for review
February 26, 2026 04:58
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Comment on lines
+392
to
+398
| download('apextrust-user-transparency-pack.json', { | ||
| user: me, | ||
| kyc: state.kyc.find(k => k.clientId === me.id), | ||
| accounts: state.accounts.filter(a => a.clientId === me.id), | ||
| deposits: state.deposits.filter(d => d.clientId === me.id), | ||
| ledger: state.ledger.filter(l => l.clientId === me.id) | ||
| }); |
There was a problem hiding this comment.
🔴 User Transparency Pack export leaks plaintext password
When a user clicks "Export User Transparency Pack" on the Compliance Center page, the downloaded JSON file includes the user's plaintext password.
Root Cause
At app/index.html:392, the export serializes the full me object (user: me), which is the raw user record from state.users. This record includes the password field (see the user schema at app/index.html:65 and signup at app/index.html:187).
The exported JSON will contain:
{
"user": {
"id": "u_abc",
"name": "John",
"email": "john@example.com",
"password": "mysecretpassword",
...
},
...
}Impact: Any user who exports their transparency pack and shares or stores the file will have their password exposed in cleartext. This is especially problematic since the export is framed as a "transparency pack" that users might share with third parties.
Suggested change
| download('apextrust-user-transparency-pack.json', { | |
| user: me, | |
| kyc: state.kyc.find(k => k.clientId === me.id), | |
| accounts: state.accounts.filter(a => a.clientId === me.id), | |
| deposits: state.deposits.filter(d => d.clientId === me.id), | |
| ledger: state.ledger.filter(l => l.clientId === me.id) | |
| }); | |
| download('apextrust-user-transparency-pack.json', { | |
| user: { id: me.id, name: me.name, email: me.email, role: me.role, region: me.region, referenceCode: me.referenceCode }, | |
| kyc: state.kyc.find(k => k.clientId === me.id), | |
| accounts: state.accounts.filter(a => a.clientId === me.id), | |
| deposits: state.deposits.filter(d => d.clientId === me.id), | |
| ledger: state.ledger.filter(l => l.clientId === me.id) | |
| }); |
Was this helpful? React with 👍 or 👎 to provide feedback.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
APT-,apextrust_*) and audit/compliance focus.Description
app/index.htmlimplementing signup provisioning, region-specific account rails, deposit quote/expiry/settlement, ledger-derived balances, KYC workflow, card eligibility (GEM-ATR), ratings, incidents, compliance center, append-only audit chain with hash verification, JSON exports, and admin surfaces.SPEC.mdcapturing the MVP requirements, data model, acceptance criteria, and branding/naming rules.AGENT_TASKS.mdwith a phased task plan andDEPLOYMENT.mdtemplate documenting release metadata, pre-deploy checklist, and rollback guidance.docs/TEST_PLAN.mdwith a manual smoke test checklist and updateTASK_PROPOSALS.mdandREADME.mdto reflect the ApexTrust branding and quick-start instructions.Testing
docs/TEST_PLAN.mdto guide manual verification.app/index.htmland exercising the manual smoke checklist.verifyAudit()function documented in the app.TASK_PROPOSALS.mdbut not yet implemented.Codex Task
Summary by Sourcery
Introduce the ApexTrust Banking single-file MVP demo with aligned specifications, branding, and operational artifacts for deployment and manual testing.
New Features:
Enhancements:
Tests: