Bootstrap copied BFF and local accounts with public Sendico contracts (#34)

backend/contracts/sendico/api/accounts/auth_login.yaml

@@ -0,0 +1,29 @@
+post:
+  tags: [Accounts, Auth]
+  summary: Login using email/password and receive pending verification token
+  description: |
+    Validates account credentials and returns a short-lived `pendingToken`.
+    This endpoint does not return final access/refresh tokens; complete verification flow via `/verification/verify`.
+  operationId: accountsLogin
+  requestBody:
+    $ref: ./bodies/auth.yaml#/components/requestBodies/LoginBody
+  responses:
+    '202':
+      description: Pending verification token issued
+      content:
+        application/json:
+          schema:
+            allOf:
+              - $ref: ../response/response.yaml#/components/schemas/BaseResponse
+              - type: object
+                properties:
+                  data:
+                    $ref: ./response/auth.yaml#/components/schemas/PendingLoginData
+    '400':
+      $ref: ../response/operation.yaml#/components/responses/BadRequest
+    '401':
+      $ref: ../response/operation.yaml#/components/responses/Unauthorized
+    '403':
+      $ref: ../response/operation.yaml#/components/responses/Forbidden
+    '500':
+      $ref: ../response/operation.yaml#/components/responses/InternalServerError

backend/contracts/sendico/api/accounts/auth_login_api.yaml

@@ -0,0 +1,30 @@
+post:
+  tags: [Accounts, Auth]
+  summary: API login using email/password and client credentials
+  description: |
+    Validates account credentials and eligible API client credentials, then returns final auth payload.
+    This endpoint bypasses login OTP/2FA and is intended only for approved API clients.
+    If the client definition includes `allowedCIDRs`, request source IP must match one of those CIDRs.
+  operationId: accountsApiLogin
+  requestBody:
+    $ref: ./bodies/auth.yaml#/components/requestBodies/ApiLoginBody
+  responses:
+    '200':
+      description: Login successful
+      content:
+        application/json:
+          schema:
+            allOf:
+              - $ref: ../response/response.yaml#/components/schemas/BaseResponse
+              - type: object
+                properties:
+                  data:
+                    $ref: ./response/auth.yaml#/components/schemas/LoginData
+    '400':
+      $ref: ../response/operation.yaml#/components/responses/BadRequest
+    '401':
+      $ref: ../response/operation.yaml#/components/responses/Unauthorized
+    '403':
+      $ref: ../response/operation.yaml#/components/responses/Forbidden
+    '500':
+      $ref: ../response/operation.yaml#/components/responses/InternalServerError

backend/contracts/sendico/api/accounts/auth_refresh.yaml

@@ -0,0 +1,31 @@
+post:
+  tags: [Accounts, Auth]
+  summary: Refresh access token by refresh token
+  description: |
+    Validates refresh token + session identifiers and issues a new access token.
+    Use this endpoint when refresh token stays the same.
+  operationId: accountsRefreshAccessToken
+  requestBody:
+    $ref: ./bodies/auth.yaml#/components/requestBodies/RefreshTokenBody
+  responses:
+    '200':
+      description: Access token refreshed
+      content:
+        application/json:
+          schema:
+            allOf:
+              - $ref: ../response/response.yaml#/components/schemas/BaseResponse
+              - type: object
+                properties:
+                  data:
+                    $ref: ./response/auth.yaml#/components/schemas/AccountAuthData
+    '400':
+      $ref: ../response/operation.yaml#/components/responses/BadRequest
+    '401':
+      $ref: ../response/operation.yaml#/components/responses/Unauthorized
+    '403':
+      $ref: ../response/operation.yaml#/components/responses/Forbidden
+    '404':
+      $ref: ../response/operation.yaml#/components/responses/NotFound
+    '500':
+      $ref: ../response/operation.yaml#/components/responses/InternalServerError

backend/contracts/sendico/api/accounts/auth_rotate.yaml

@@ -0,0 +1,31 @@
+post:
+  tags: [Accounts, Auth]
+  summary: Rotate refresh token and issue new access/refresh tokens
+  description: |
+    Validates refresh token + session identifiers and returns a new token pair.
+    Use this endpoint when replacing both access and refresh tokens.
+  operationId: accountsRotateRefreshToken
+  requestBody:
+    $ref: ./bodies/auth.yaml#/components/requestBodies/RefreshTokenBody
+  responses:
+    '200':
+      description: New token pair issued
+      content:
+        application/json:
+          schema:
+            allOf:
+              - $ref: ../response/response.yaml#/components/schemas/BaseResponse
+              - type: object
+                properties:
+                  data:
+                    $ref: ./response/auth.yaml#/components/schemas/LoginData
+    '400':
+      $ref: ../response/operation.yaml#/components/responses/BadRequest
+    '401':
+      $ref: ../response/operation.yaml#/components/responses/Unauthorized
+    '403':
+      $ref: ../response/operation.yaml#/components/responses/Forbidden
+    '404':
+      $ref: ../response/operation.yaml#/components/responses/NotFound
+    '500':
+      $ref: ../response/operation.yaml#/components/responses/InternalServerError

backend/contracts/sendico/api/accounts/bodies/auth.yaml

@@ -0,0 +1,24 @@
+components:
+  requestBodies:
+    LoginBody:
+      description: JSON credentials payload for standard login.
+      required: true
+      content:
+        application/json:
+          schema:
+            $ref: ../request/auth.yaml#/components/schemas/LoginRequest
+    ApiLoginBody:
+      description: JSON credentials payload for API client login.
+      required: true
+      content:
+        application/json:
+          schema:
+            $ref: ../request/auth.yaml#/components/schemas/ApiLoginRequest
+
+    RefreshTokenBody:
+      description: JSON payload containing session and refresh token data.
+      required: true
+      content:
+        application/json:
+          schema:
+            $ref: ../request/auth.yaml#/components/schemas/RefreshTokenRequest

backend/contracts/sendico/api/accounts/request/auth.yaml

@@ -0,0 +1,34 @@
+components:
+  schemas:
+    LoginRequest:
+      type: object
+      additionalProperties: false
+      required:
+        - login
+      properties:
+        clientId:
+          type: string
+          description: Client identifier bound to refresh token lifecycle and client policy checks.
+        deviceId:
+          type: string
+          description: Device/server identifier associated with the client session.
+        login:
+          $ref: ../../../models/auth/login_data.yaml#/components/schemas/LoginData
+
+    ApiLoginRequest:
+      allOf:
+        - $ref: ./auth.yaml#/components/schemas/LoginRequest
+        - type: object
+          additionalProperties: false
+          required:
+            - clientId
+            - deviceId
+            - clientSecret
+          properties:
+            clientSecret:
+              type: string
+              format: password
+              description: Client secret for `client_secret_post` authentication.
+
+    RefreshTokenRequest:
+      $ref: ../../../models/auth/client_refresh_token.yaml#/components/schemas/ClientRefreshToken

backend/contracts/sendico/api/accounts/response/auth.yaml

@@ -0,0 +1,62 @@
+components:
+  schemas:
+    AccountAuthData:
+      description: Authentication response containing account profile and access token.
+      type: object
+      additionalProperties: false
+      required:
+        - accessToken
+        - account
+      properties:
+        accessToken:
+          description: Access token used for authenticated requests.
+          $ref: ../../../models/auth/token_data.yaml#/components/schemas/TokenData
+        account:
+          description: Authenticated account data.
+          $ref: ../../../models/account/account.yaml#/components/schemas/AccountData
+
+    LoginData:
+      description: Full login response including access and refresh tokens.
+      type: object
+      additionalProperties: false
+      required:
+        - accessToken
+        - account
+        - refreshToken
+      properties:
+        accessToken:
+          description: Access token used for authenticated requests.
+          $ref: ../../../models/auth/token_data.yaml#/components/schemas/TokenData
+        account:
+          description: Authenticated account data.
+          $ref: ../../../models/account/account.yaml#/components/schemas/AccountData
+        refreshToken:
+          description: Refresh token used to obtain a new access token.
+          $ref: ../../../models/auth/token_data.yaml#/components/schemas/TokenData
+
+    PendingLoginData:
+      description: Pending login response requiring additional verification.
+      type: object
+      additionalProperties: false
+      required:
+        - account
+        - pendingToken
+        - target
+      properties:
+        account:
+          description: Interim authentication payload prepared for verification completion.
+          type: object
+          additionalProperties: false
+          properties:
+            accessToken:
+              description: Temporary access token issued before verification is completed.
+              $ref: ../../../models/auth/token_data.yaml#/components/schemas/TokenData
+            account:
+              description: Account data associated with the pending login flow.
+              $ref: ../../../models/account/account.yaml#/components/schemas/AccountData
+        pendingToken:
+          description: Token proving the pending verification session.
+          $ref: ../../../models/auth/token_data.yaml#/components/schemas/TokenData
+        target:
+          description: Verification target destination (for example email or phone).
+          type: string