# Annotation catalog — Analytics module (ClientVerse Modules 0.4.0)
# Structural facts are authoritative in ../catalog.json. See ../README.md, ../../_conventions.md.
module: analytics
package: modules
applies_to: [modules]
status: shipped-early-access
summary: >
  Analytics ships in Modules 0.4.0 and supersedes the 0.1–0.3 guidance that recorded the module
  as "not present". It embeds Tableau views and Power BI reports inside ClientVerse screen flows
  and Lightning pages, so the firm's existing dashboards appear in the workflow rather than in a
  separate tool. Record context (the Account a flow is running on, say) is passed into the
  visualization as filters mapped in a custom property editor, and Tableau mark selections flow
  back into flow variables. The module contributes one configuration object and six LWCs; it is
  OFF until CV_BI_Visualization is assigned, and engineering still tracks it as maturing —
  document it as "available, early access, off by default".
security_notes: >
  Each platform's own permissions and row-level security still apply — Tableau authenticates via
  a Connected App JWT minted server-side for the running user, and Power BI rides the viewer's
  existing Microsoft Entra session. ClientVerse does not re-implement BI-tool permissions, so a
  user who can open the ClientVerse page may still be unable to render the dashboard inside it;
  verify with a real non-admin account. Connections double as an embed host allowlist — content
  whose host does not match an active connection's Base URL is refused. Secrets are read
  server-side from Key Vault metadata and never sent to the client.
permission_sets:
  - {api_name: CV_BI_Visualization, purpose: "The switch for BI embedding — grants flow users the supporting Apex."}
annotation_status: drafted

objects:
  - api_name: CV_BI_Connection__mdt
    label: CV BI Connection
    kind: custom_metadata
    data_source: Configuration (custom metadata)
    audience: [admins, it]
    description: >
      One registered BI environment — which platform, where it lives, and how a viewer is
      identified to it. Doubles as the **embed host allowlist**: a visualization whose host does
      not exactly match an active connection's Base URL host is refused, so registering a
      connection is a security decision as much as a convenience one.
    key_fields:
      - {api_name: Platform__c, purpose: "Tableau or Power BI."}
      - {api_name: Base_URL__c, purpose: "The BI environment's base URL — also the host allowlist entry."}
      - {api_name: Is_Active__c, purpose: "Only active connections are accepted at runtime."}
      - {api_name: User_Identity_Source__c, purpose: "Which Salesforce user field identifies the viewer to the BI platform."}
      - {api_name: Connected_App_Client_Id__c, purpose: "Tableau Connected App client id (Direct Trust)."}
      - {api_name: Connected_App_Secret_Id__c, purpose: "Tableau Connected App secret id; the secret value itself lives in Key Vault metadata."}
      - {api_name: Secret_Key_Name__c, purpose: "The Key Vault record holding the Connected App secret — never stored here."}
      - {api_name: Tableau_Site__c, purpose: "Target Tableau site."}
      - {api_name: Entra_Tenant_Id__c, purpose: "Microsoft Entra tenant for Power BI embedding."}