Secure Your Team's Digital Assets

# Create tenant-specific subdomain
sudo certbot --nginx -d yourcompany.passnest.com

# Configure tenant isolation
cat /etc/nginx/sites-available/yourcompany.passnest.com
server {
    listen 443 ssl;
    server_name yourcompany.passnest.com;
    
    # Set tenant ID from subdomain
    set $tenant_id "yourcompany";
    
    # Forward to app with tenant context
    location / {
        proxy_set_header X-Tenant-ID $tenant_id;
        proxy_pass http://127.0.0.1:8080;
    }
}

# Generate tenant-specific encryption keys
function generateTenantKeys($tenantId) {
    # Derive unique master key for tenant
    $masterKey = hash_pbkdf2(
        "sha256", 
        $_ENV['MASTER_KEY'], 
        $tenantId, 
        100000, 
        32, 
        true
    );
    
    # Generate data encryption key
    $dataKey = random_bytes(32);
    $encryptedDataKey = openssl_encrypt(
        $dataKey, 
        "aes-256-gcm", 
        $masterKey
    );
    
    return [
        'master_key' => $masterKey,
        'data_key' => $dataKey,
        'encrypted_data_key' => $encryptedDataKey
    ];
}

# Domain-based access validation
function validateTenantAccess($email, $tenantId) {
    # Extract domain from email
    $emailDomain = substr($email, strpos($email, '@') + 1);
    
    # Get allowed domains for tenant
    $allowedDomains = getTenantAllowedDomains($tenantId);
    
    # Check if email domain matches tenant domain
    if (in_array($emailDomain, $allowedDomains)) {
        return true;
    }
    
    # Log unauthorized access attempt
    logSecurityEvent('DOMAIN_MISMATCH', [
        'email' => $email,
        'tenant_id' => $tenantId,
        'email_domain' => $emailDomain
    ]);
    
    return false;
}

# Zero-knowledge encryption process
function encryptPassword($password, $userId, $tenantId) {
    # Generate user-specific salt
    $userSalt = getUserSalt($userId);
    
    # Derive user key from master password
    $userKey = hash_pbkdf2(
        "sha256", 
        $_SESSION['master_password'], 
        $userSalt, 
        100000, 
        32, 
        true
    );
    
    # Get tenant-specific encryption key
    $tenantKey = getTenantEncryptionKey($tenantId);
    
    # Create combined key for encryption
    $encryptionKey = $userKey . $tenantKey;
    
    # Encrypt password before storage
    $iv = random_bytes(16);
    $encrypted = openssl_encrypt(
        $password, 
        "aes-256-gcm", 
        $encryptionKey, 
        OPENSSL_RAW_DATA, 
        $iv, 
        $tag
    );
    
    # Store encrypted data with metadata
    return [
        'encrypted_data' => base64_encode($iv . $tag . $encrypted),
        'user_id' => $userId,
        'tenant_id' => $tenantId
    ];
}