Authentication & Identity Isolation

The system establishes two strictly separated security perimeters:

1. Human Interactive Access (Read-Only)
2. Machine Ingestion Access (Write-Only)

1. Human Access Policy

Human access to financial data and private documentation is restricted exclusively to the verified Google email:

nicolasdelauretis122@gmail.com

Protection Mechanisms

• Edge Layer: Cloudflare Access application protecting docs.delauretis.com.ar and human routes on api.delauretis.com.ar.
• Application Layer: In Nuxt/Nitro, requireAdminGoogleSession(event) validates either:
  1. Sealed cookie session via nuxt-auth-utils (session.user.email).
  2. Cloudflare Access JWT header (Cf-Access-Jwt-Assertion / cf-access-authenticated-user-email).

Any request originating from an unauthorized Google account or an unauthenticated client returns:

• 401 Unauthorized: When no valid identity proof is provided.
• 403 Forbidden: When the authenticated email does not match nicolasdelauretis122@gmail.com.

2. Machine Ingestion Policy (GrokBot & Mango)

Machine agents such as GrokBot and Mango ingest Notion modifications using server-to-server credentials.

Authentication Headers

Ingestion requests must supply an API Key in one of two headers:

X-API-Key: <SECRET_API_KEY>

or

Authorization: Bearer <SECRET_API_KEY>

Storage and Verification

• Plaintext API keys are never stored in the database.
• Keys are hashed with SHA-256 and matched against the api_keys table:

  SELECT ak.*, u.email
  FROM api_keys ak
  JOIN users u ON u.id = ak.user_id
  WHERE (ak.key_hash = ? OR ak.raw_key = ?) AND ak.active = 1

• Nicolás can generate new API keys at runtime using POST /v1/finances/api-keys.

Role-Based Permissions

Principal	Permitted Routes	Forbidden Routes
Nicolás De Lauretis (nicolasdelauretis122@gmail.com)	GET /v1/finances/**, POST /v1/finances/api-keys, Docs site	Direct write without CAS batching
GrokBot / Mango (api_keys)	POST /v1/finances/changes	GET /v1/finances/**, Dashboard, Docs site