Local development

Summarized from LOCAL-DEV.md. Requires Docker Desktop running.

Ports

Windows Hyper-V may block 5433–5532 — the stack uses 25xxx host ports.

Service	Host port
Platform Postgres	25434
VectraLabel Postgres	25433
TenaBill Postgres	25435
Redis	26379
MinIO	9000 / 9001
Mailpit	18025 / 11025
SaaSRuntime API	15096
VectraLabel API	15153
TenaBill API	15160
TenaBill Web (merchant console)	15165
TenancyEngine Console	15200

Start all

PowerShell

cd D:\repos\tenancy-platform; docker compose up -d
cd D:\repos\vectralabel; docker compose up -d
cd D:\repos\tenabill; docker compose up -d

# APIs (3 terminals)
dotnet run --project D:\repos\tenancy-platform\src\SaaSRuntime.Api --launch-profile http
dotnet run --project D:\repos\vectralabel\src\VectraLabel.Api --launch-profile http
dotnet run --project D:\repos\tenabill\src\TenaBill.Api --launch-profile http

# Console UI
cd D:\repos\tenancy-platform\src\TenancyEngine.Console
npm install
npm run dev

bash

cd tenancy-platform && docker compose up -d
cd vectralabel && docker compose up -d
cd tenabill && docker compose up -d

# APIs (3 terminals)
dotnet run --project tenancy-platform/src/SaaSRuntime.Api --launch-profile http
dotnet run --project vectralabel/src/VectraLabel.Api --launch-profile http
dotnet run --project tenabill/src/TenaBill.Api --launch-profile http

# Console UI
cd tenancy-platform/src/TenancyEngine.Console
npm install
npm run dev

Sign-in (OIDC)

User	Password	OIDC client
[email protected]	ChangeMe!Dev123	tenancyengine-console
[email protected]	ChangeMe!Dev123	app-scoped (e.g. vectralabel)
[email protected]	ChangeMe!Dev123	tenabill-merchant-console

Dev URLs (*.lab.* via Cloudflare tunnel)

What	URL
SaaSRuntime / OIDC	https://auth.lab.saasruntime.com
Platform API	https://api.lab.saasruntime.com
TE Console login	https://console.lab.tenancyengine.com/login
TE Console app	https://console.lab.tenancyengine.com/console
Mailpit	http://127.0.0.1:18025
VectraLabel app	https://app.lab.vectralabel.com
VectraLabel API	https://api.lab.vectralabel.com
TenaBill console	https://console.lab.tenabill.com

Lane labels: lab. = local ORION dev lane, stage. = METEOR staging lane, none = production; dev./staging. labels denote the ISV app environment, not the platform lane.

Platform login UI (/account/login) only works with a valid OIDC returnUrl — use the console login link above.

OIDC login flow

1. Open https://console.lab.tenancyengine.com/login
2. Redirects to SaaSRuntime login (PKCE authorize)
3. Sign in → MFA challenge if enrolled → back to console

Org signup + email verify

curl -X POST https://auth.lab.saasruntime.com/api/v1/signup/organization `
  -H "Content-Type: application/json" `
  -d '{"organizationName":"Test Co","organizationSlug":"test-co","email":"[email protected]","password":"ChangeMe!Dev12345","displayName":"Owner"}'

Check verification email in Mailpit → click link on https://auth.lab.saasruntime.com/account/verify-email?...

MFA challenge methods

After TOTP enrollment, sign out and sign in via https://console.lab.tenancyengine.com/login to trigger the MFA challenge:

• Email OTP → Mailpit
• SMS OTP → API log line Dev SMS code for +1... (dev only)
• Authenticator → TOTP app

Swagger UI (Development only)

API	Swagger
SaaSRuntime	https://auth.lab.saasruntime.com/swagger
VectraLabel	https://api.lab.vectralabel.com/swagger
TenaBill	https://api.lab.tenabill.com/swagger

• Admin APIs: Authorize → Bearer token from POST /connect/token (grant_type=console_password)
• VectraLabel: sign in at /login in the same browser (cookie), or use Bearer JWT from SaaSRuntime

After pulling backend changes (PATCH/DELETE for environments, tenants, etc.), restart SaaSRuntime so edits are not 404.