Security & Permissions

Authentication

The Multi-Query API uses standard BizFirst JWT Bearer authentication. Tokens are validated on every request using the following settings:

All requests must include the token in the Authorization header:

Authorization: Bearer <your-jwt-token>

Authorization

Every Multi-Query controller action is decorated with [AuthorizeTenantAdminAttribute]. This attribute enforces that the authenticated principal holds at least one of the following roles:

• Admin — global platform administrator
• TenantAdmin — administrator scoped to a specific tenant

Requests from users without either role receive an HTTP 403 Forbidden response immediately after token validation, before any template or database logic executes. Standard user roles (Employee, Manager, etc.) do not have access to any Multi-Query endpoint.

// Applied to all Multi-Query controller actions
[AuthorizeTenantAdminAttribute]
[ApiLimit("MultiQuery.Execute")]
public async Task<IActionResult> ExecuteJson(string templateCode) { ... }

Tenant Isolation

Rate Limiting

Each operation class has its own rate limit bucket, configured via ApiLimit attributes. Limits are applied per-tenant and per-user. Exceeding the limit returns HTTP 429 Too Many Requests.

Rate limit thresholds are configured in platform settings and can be adjusted per-environment. The eOperationLimitType.Custom designation on the Execute endpoints allows the platform administrator to set a higher ceiling for read-heavy reporting use cases.

Template SQL Security

Templates stored in dbo.Shared_Configurations are trusted SQL authored by platform administrators. The following rules govern what is permitted:

• Only SELECT statements are permitted in query templates — no INSERT, UPDATE, DELETE, or DDL
• All user-supplied values (parameters passed via EvaluationContext or request body) are bound as parameterized SQL parameters — never string-concatenated
• Dynamic SQL construction (EXEC sp_executesql with variable strings) is prohibited within templates
• Stored scripts referenced by the run-stored endpoint must be reviewed and pre-approved before registration in dbo.Shared_Configurations
• Run-direct SQL is intended for trusted administrator tools only — it must never accept text sourced from end-user input
• Template JSON is stored and retrieved verbatim; no server-side template interpolation occurs outside of parameterized SQL binding

Audit Trail

CORS

The platform is configured with an AllowAll CORS policy in development and staging environments for ease of integration testing. In production environments you must restrict CORS to specific trusted origins:

// Production configuration — restrict to known origins
builder.Services.AddCors(options => {
    options.AddPolicy("MultiQueryPolicy", policy => {
        policy.WithOrigins(
            "https://app.bizfirstai.com",
            "https://admin.bizfirstai.com"
        )
        .AllowAnyHeader()
        .AllowAnyMethod();
    });
});