This project, BASIS Core, is a modular, multi-tenant enterprise platform built with PHP. It implements a robust PSR-7/PSR-15 compliant architecture with advanced security features and modern frontend integration via Hotwire Turbo.

Based on the provided UML sequence diagram and codebase, here is a structured introduction to the project:

The application uses a layered middleware pipeline to process requests securely before they reach the business logic:

• Entry Point & Kernel: Requests enter via public/index.php and are dispatched by the Http\Kernel (core/Http/Kernel.php).
• Tenant Resolution: TenantResolutionMiddleware (src/Http/Middleware/TenantResolutionMiddleware.php) resolves the current tenant from the request host and switches the database connection context accordingly.
• RLS Session Context: DbSessionMiddleware (core/Http/Middleware/DbSessionMiddleware.php) sets PostgreSQL session variables (like app.current_user_id) to enforce Row-Level Security (RLS) policies at the database level.
• Security Middlewares: CsrfMiddleware validates CSRF tokens, and RateLimiterMiddleware prevents brute-force attacks.
• Turbo Detection: TurboStreamDetector (core/Http/TurboStreamDetector.php) identifies if the request originates from Hotwire Turbo, allowing the controller to return TurboStreamResponse instead of full HTML.

The platform implements a sophisticated, multi-layered authentication system:

• Core Authentication: AuthService (core/Auth/AuthService.php) handles credential verification and session creation via SessionManager.
• Multi-Factor Authentication (MFA): If enabled, MfaService (core/Auth/MfaService.php) enforces a TOTP challenge. Users can verify via authenticator apps or backup codes.
• WebAuthn/Biometrics: As an alternative MFA factor, WebAuthnService (core/Auth/WebAuthn/WebAuthnService.php) handles biometric authentication (FaceID, fingerprint) and hardware security keys.
• User Context: Upon successful login, UserProfileAgent (core/Agents/UserProfileAgent.php) initializes the user's profile, permissions, and runtime context.

Instead of building a heavy SPA, the project uses Hotwire Turbo for a fast, modern UX:

• The TurboStreamDetector intercepts responses from the App Controller.
• If the client expects a Turbo Stream, the system formats a TurboStreamResponse (core/Http/Response/TurboStreamResponse.php), sending only the modified DOM fragments to the browser.
• This allows seamless, SPA-like navigation without writing custom JavaScript, while keeping the server as the source of truth.

The project is structured as a monorepo containing distinct “apps” and “modules”:

• Multi-App Support: It hosts multiple business applications like Operand (ERP), Nexus (BI/Strategy), Axis (Field Operations), and Vector (Engineering). Each app has its own controllers, views, and routing (apps/operand, apps/nexus, etc.).
• Core Modules: Shared functionalities are abstracted into modules like core-auth (Authentication), core-admin (Administration), audit, and files (modules/).
• Database Isolation: The db_auth schema centralizes user identities, while TenantResolutionMiddleware ensures data isolation per company using database-level RLS.