The external fund_administrator role (relabeled Administrator) now signs
into the full admin interface, fenced to the funds and SPVs granted to
it via EntityAccess:
- Partners, capital accounts, documents (upload and delete), entity
edits, and eNAV imports for its own funds only; no fund creation,
valuation sign-off, audit log, or investor view.
- Scoped user management: sees and manages only investors tied to its
funds; creates investor accounts only; updates preserve grants on
funds outside its scope.
- New DELETE /api/users/{id} (in-app Delete user button) with the
cascade cleanup factored out of the CLI; Service Admin and self are
protected, and an Administrator can only delete an investor who
belongs solely to its funds.
- Internal fund_admin relabeled 'Staff (all funds)' and dropped from
the create picker to end the two-similar-names confusion.
- Version badge removed from the UI (sidebar and portal header); the
build version now logs to the browser console instead.
- deploy/.startos (signing key) added to .gitignore.
- BTC prices: btc_prices table, CSV upload on Import page (auto-detected
date/close columns, upsert by date), entities.close_date as the BTC entry
mark; statements carry btc_price_cents (as-of) + btc_close_price_cents.
LP capital blocks show paid-in vs current value in bitcoin terms.
- First login: accounts on the shared default password are flagged
(must_change_password) and blocked behind a full-screen password change;
external accounts then get a one-time welcome tour with a 2FA offer
(users.onboarded_at).
- LP portal: Unfunded (callable commitment) metric; Tax documents center
aggregating K-1/tax docs across funds, grouped by year.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Address the security-auditor findings the user selected (items 2, 3, 4):
Default admin credentials (P2): remove the fixed `Ten31` default. First
boot now generates a strong random admin password (secrets.token_urlsafe),
records it 0600 at /data/.admin-password, and surfaces it once via a new
"Show Initial Admin Password" StartOS action (CLI `show-admin-password`).
The stored password is cleared when the admin is reset (CLI reset-password)
or self-changes it (change-password endpoint).
Login hardening (P2): add a per-IP in-memory sliding-window rate limiter
(10 failures / 5 min -> 429 + Retry-After) in ratelimit.py; run a dummy
argon2 verify when the user is unknown so timing can't enumerate usernames;
keep a single generic 401 for unknown-user and wrong-password.
Hardening (P3): server process now runs unprivileged -- Dockerfile adds
uid 10001 appuser; start.sh (still root) chowns the mounted /data then
drops via `setpriv` before exec'ing uvicorn. Spreadsheet imports are
size-capped via storage.read_capped (413 past MAX_UPLOAD_SIZE) in the
schedule, capital preview, and batch paths. batch_import no longer returns
raw exception text (generic per-file messages).
Verified in the packed amd64 container: PID1 uvicorn runs as uid 10001,
/data owned 10001 with 0600 secrets; generated admin password retrievable
via CLI and logs in (200); 11th bad login -> 429; admin reset clears the
stored password. Tests: test_auth_hardening.py (4). Full suite 21 passed;
frontend tsc + StartOS bundle clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Snapshot commit bringing the uncommitted phase-2 work into version control
together with four new features and the 0.2.22 version bump.
New features:
- Investor capital-over-time chart (value, paid-in, distributions per
quarter), rendered from existing capital-account history.
- Admin Investor View: read-only reconstruction of an investor's portal
(GET /api/users/{id}/investor-view), reusing the investor portal UI.
- Document upload scoped to the selected fund's own investors, with an
explicit upload-target confirmation to prevent mis-attaching.
- GP/mgmt entities gain an Assets tab listing their stakes in the funds
they manage (new entity_stakes table + /api/entities/{id}/stakes).
- Edit-entity form (change type/status/etc.), so GP entities can be
categorized correctly.
Verified: 11/11 backend tests pass; alembic upgrades to head b8c9d0e1f2a3;
frontend tsc + vite build clean; s9pk packs at 0.2.22:0 (x86_64).
Also: ignore .DS_Store and *.s9pk artifacts.
- Disambiguate duplicate (company, security) pairs in Carta exports:
e.g. two 'Warrants' under BIP21 become 'Warrants' and 'Warrants (2)'
- Tested against Fund II: 33 holdings, 41 positions (3 companies with
duplicate tranches), zero errors
- Frontend: graceful handling of 500 responses (shows status code
instead of JSON parse crash)
Issue 19:
- entity_id now optional on POST /api/import/schedule
- Resolution: explicit entity_id > name match from row 1 > auto-create
- New params: create_entity_type (default fund), create_vintage_year
- Dry-run reports resolution (will_create/matched/existing)
- Frontend: radio toggle between 'Create from file' and 'Use existing'
Issue 20:
- GET /api/entities/rollup: invested_cents and last_signed_value_cents
per entity in one pass (SQL aggregates, no waterfall)
- EntitiesList uses rollup instead of N+1 API calls
- Parse Carta XLSX natively (openpyxl) instead of CSV-only
- Column map confirmed against Fund I export: Investment/Asset/
Investment date/Shares/Cost/Value/Last Valuation date
- Handle grouped layout: company subtotal rows + indented position rows
- SAFEs: shares=0 in source → null in DB (not additive)
- Money already in dollars in XLSX cells, convert to cents directly
- Dates parsed from Excel datetime objects
- CSV fallback preserved for other formats
- Re-import guard catches both seed and non-seed existing rounds
- Tested: 14 holdings, 17 positions, total value $8,527,204.58 matches
Jonathan Kirkwood