Bootstrap copied BFF and local accounts with public Sendico contracts (#34)

backend/contracts/sendico/api/verification/bodies/verification.yaml

@@ -0,0 +1,17 @@
+components:
+  requestBodies:
+    VerificationCodeBody:
+      description: JSON payload used to request a new verification code.
+      required: true
+      content:
+        application/json:
+          schema:
+            $ref: ../request/verification.yaml#/components/schemas/VerificationCodeRequest
+
+    VerifyCodeBody:
+      description: JSON payload containing a verification code to validate.
+      required: true
+      content:
+        application/json:
+          schema:
+            $ref: ../request/verification.yaml#/components/schemas/CodeVerificationRequest

backend/contracts/sendico/api/verification/create.yaml

@@ -0,0 +1,37 @@
+post:
+  tags: [Verification, Auth]
+  summary: Request verification code
+  description: |
+    Creates a verification challenge for the specified purpose/target.
+    For `purpose=login`, request must be authorized with a pending account token.
+  operationId: verificationRequestCode
+  security:
+    - bearerAuth: []
+  requestBody:
+    $ref: ./bodies/verification.yaml#/components/requestBodies/VerificationCodeBody
+  responses:
+    '202':
+      description: Verification code requested
+      content:
+        application/json:
+          schema:
+            allOf:
+              - $ref: ../response/response.yaml#/components/schemas/BaseResponse
+              - type: object
+                properties:
+                  data:
+                    $ref: ./response/verification.yaml#/components/schemas/VerificationResponseData
+    '400':
+      $ref: ../response/operation.yaml#/components/responses/BadRequest
+    '401':
+      $ref: ../response/operation.yaml#/components/responses/Unauthorized
+    '403':
+      $ref: ../response/operation.yaml#/components/responses/Forbidden
+    '404':
+      $ref: ../response/operation.yaml#/components/responses/NotFound
+    '409':
+      $ref: ../response/operation.yaml#/components/responses/Conflict
+    '429':
+      $ref: ../response/operation.yaml#/components/responses/TooManyRequests
+    '500':
+      $ref: ../response/operation.yaml#/components/responses/InternalServerError

backend/contracts/sendico/api/verification/request/verification.yaml

@@ -0,0 +1,73 @@
+components:
+  schemas:
+    VerificationCodeRequest:
+      type: object
+      additionalProperties: false
+      required:
+        - purpose
+      properties:
+        purpose:
+          type: string
+          description: Verification purpose, e.g. login.
+        target:
+          type: string
+          format: email
+          description: Optional destination override. When omitted, current handler falls back to the authenticated account email/login.
+        idempotencyKey:
+          type: string
+        quoteRef:
+          description: Required when `purpose` is `payout`; omitted for login and other verification purposes.
+          type: string
+      allOf:
+        - if:
+            properties:
+              purpose:
+                const: payout
+            required:
+              - purpose
+          then:
+            required:
+              - quoteRef
+
+    CodeVerificationRequest:
+      type: object
+      additionalProperties: false
+      required:
+        - purpose
+        - code
+      properties:
+        purpose:
+          type: string
+          description: Verification purpose, e.g. login.
+        target:
+          type: string
+          format: email
+          description: Optional destination override. When omitted, current handler falls back to the authenticated account email/login.
+        idempotencyKey:
+          type: string
+        quoteRef:
+          description: Required when `purpose` is `payout`; omitted for login and other verification purposes.
+          type: string
+        code:
+          type: string
+        sessionIdentifier:
+          $ref: ../../../models/auth/session_identifier.yaml#/components/schemas/SessionIdentifier
+      allOf:
+        - if:
+            properties:
+              purpose:
+                const: login
+            required:
+              - purpose
+          then:
+            required:
+              - sessionIdentifier
+        - if:
+            properties:
+              purpose:
+                const: payout
+            required:
+              - purpose
+          then:
+            required:
+              - quoteRef

backend/contracts/sendico/api/verification/resend.yaml

@@ -0,0 +1,37 @@
+post:
+  tags: [Verification, Auth]
+  summary: Resend verification code
+  description: |
+    Re-issues a verification challenge using the same request shape as `/verification`.
+    Cooldown and retry limits are enforced by backend verification storage policy.
+  operationId: verificationResendCode
+  security:
+    - bearerAuth: []
+  requestBody:
+    $ref: ./bodies/verification.yaml#/components/requestBodies/VerificationCodeBody
+  responses:
+    '202':
+      description: Verification code resent
+      content:
+        application/json:
+          schema:
+            allOf:
+              - $ref: ../response/response.yaml#/components/schemas/BaseResponse
+              - type: object
+                properties:
+                  data:
+                    $ref: ./response/verification.yaml#/components/schemas/VerificationResponseData
+    '400':
+      $ref: ../response/operation.yaml#/components/responses/BadRequest
+    '401':
+      $ref: ../response/operation.yaml#/components/responses/Unauthorized
+    '403':
+      $ref: ../response/operation.yaml#/components/responses/Forbidden
+    '404':
+      $ref: ../response/operation.yaml#/components/responses/NotFound
+    '409':
+      $ref: ../response/operation.yaml#/components/responses/Conflict
+    '429':
+      $ref: ../response/operation.yaml#/components/responses/TooManyRequests
+    '500':
+      $ref: ../response/operation.yaml#/components/responses/InternalServerError

backend/contracts/sendico/api/verification/response/verification.yaml

@@ -0,0 +1,35 @@
+components:
+  schemas:
+    VerificationResponseData:
+      description: Response data returned after requesting a verification code.
+      type: object
+      additionalProperties: false
+      required:
+        - idempotencyKey
+        - ttl_seconds
+        - cooldown_seconds
+        - target
+      properties:
+        idempotencyKey:
+          description: Idempotency key associated with the verification request.
+          type: string
+        ttl_seconds:
+          description: Verification code validity period in seconds.
+          type: integer
+          format: int32
+        cooldown_seconds:
+          description: Cooldown period before another code can be requested.
+          type: integer
+          format: int32
+        target:
+          description: Destination where the verification code was sent.
+          type: string
+        quoteRef:
+          description: Payment quote reference echoed for payout verification requests.
+          type: string
+
+    VerifyResultData:
+      description: Result payload returned after code verification succeeds.
+      oneOf:
+        - $ref: ../../accounts/response/auth.yaml#/components/schemas/LoginData
+        - $ref: ../../response/response.yaml#/components/schemas/SuccessResultData

backend/contracts/sendico/api/verification/verify.yaml

@@ -0,0 +1,37 @@
+post:
+  tags: [Verification, Auth]
+  summary: Verify code and complete pending flow
+  description: |
+    Verifies submitted code and consumes verification token.
+    For login purpose, returns full auth payload (access + refresh tokens); for other purposes returns operation result.
+  operationId: verificationVerifyCode
+  security:
+    - bearerAuth: []
+  requestBody:
+    $ref: ./bodies/verification.yaml#/components/requestBodies/VerifyCodeBody
+  responses:
+    '200':
+      description: Verification successful
+      content:
+        application/json:
+          schema:
+            allOf:
+              - $ref: ../response/response.yaml#/components/schemas/BaseResponse
+              - type: object
+                properties:
+                  data:
+                    $ref: ./response/verification.yaml#/components/schemas/VerifyResultData
+    '400':
+      $ref: ../response/operation.yaml#/components/responses/BadRequest
+    '401':
+      $ref: ../response/operation.yaml#/components/responses/Unauthorized
+    '403':
+      $ref: ../response/operation.yaml#/components/responses/Forbidden
+    '404':
+      $ref: ../response/operation.yaml#/components/responses/NotFound
+    '410':
+      $ref: ../response/operation.yaml#/components/responses/Gone
+    '409':
+      $ref: ../response/operation.yaml#/components/responses/Conflict
+    '500':
+      $ref: ../response/operation.yaml#/components/responses/InternalServerError