Orça Aí

Construction and renovation companies need to keep customers, estimates, proposals and services in one place, with the whole team working on the same data.

A SaaS platform where each company has its own account and team. The current foundation covers company signup, authentication, team management and the first business module — customers. Estimates and proposals are the next modules.

• Modular monolith in Spring Boot: identity, organizations, users, customers and team are packages with clear boundaries that reference each other by ID, not JPA associations.
• Shared-database multi-tenancy: the company comes only from the authenticated session, Hibernate filters by @TenantId and PostgreSQL enforces Row Level Security.
• Server-side sessions with Spring Session JDBC instead of JWT, HttpOnly cookies and double-submit CSRF protection.
• The Next.js frontend only talks to its own origin; /api is routed to the backend, with no CORS. Errors follow RFC 9457 (problem+json).

• Company signup with an OWNER user and email verification.
• Login, logout, password recovery and reset with single-use tokens.
• Team management with invitations, OWNER / ADMIN / MEMBER roles, user deactivation and reactivation.
• Customers: create, paginated search, edit, archive and restore, with concurrency control through ETag and If-Match.
• Login rate limiting per address and per account.

• Making sure a company can never reach another company's data, even knowing the record's exact UUID — covered by cross-tenant isolation tests.
• Single-use email tokens under concurrency: consumption is an atomic UPDATE … RETURNING in PostgreSQL, tested with multiple threads.
• Preventing account enumeration: signup and password recovery always respond the same way, with the same BCrypt cost.
• Integration tests against a real PostgreSQL with Testcontainers and versioned migrations with Flyway.