Remove platform tenancy from SXCHNGE customer BFF (#34)

backend/PROVENANCE.md

@@ -1,64 +1,62 @@
 # Copied Sendico source
 
-Source repository: `S_I/sendico` (`git.sendico.io`). Revision:
+Source repository: `S_I/sendico` (`git.sendico.io`), revision
 `8bb20dcd622dd8eb92d289b6b34411e7eccab083`.
 
-[PROVENANCE.json](PROVENANCE.json) records each copied file, original path and
-Git blob, plus whether a Go file changed beyond import namespace and formatting.
-It contains 416 Go source/test files, 112 public OpenAPI files and one adapted policy seed. Sources were
-read from the pinned commit, not Sendico's dirty working tree. These are owned
-SXCHNGE copies, not submodules or automatic synchronization links.
+[PROVENANCE.json](PROVENANCE.json) records each retained file, its original path
+and Git blob, and whether a Go file changed beyond namespace replacement and
+formatting. It currently covers 232 Go source/test files and 112 public OpenAPI
+files. Sources came from the pinned commit, not the dirty Sendico checkout.
+These are SXCHNGE-owned copies that may diverge independently.
 
-## What was retained
+## Retained implementation
 
-- Shared BFF Chi runtime, process/version/logger bootstrap, HTTP middleware,
-  auth transport and response conventions.
-- Password/account service, local Mongo account/role/policy repositories,
-  transactions and local organization membership.
-- Verification issuance, expiry, attempt limits, consumption and idempotency;
-  refresh-session rotation/revocation and login rate-limit storage.
-- Canonical models, `merrors`, structured logging, health and retained tests.
-- The public OpenAPI 4.2.37 entry point and recursive local schema references,
-  copied into `contracts/sendico` without schema changes (trailing blank lines
-  normalized in three YAML files).
+- Chi HTTP runtime, process/version bootstrap, structured logging and health.
+- Customer password validation/hashing, account repository and account service.
+- Customer login, pending verification, session validation, refresh rotation,
+  revocation, browser cookies/CSRF and login rate limiting.
+- Verification issuance, expiry, attempts, consumption and idempotency.
+- Local Mongo connection, transactions and the repository/query implementation
+  required by account, session and verification storage, with retained tests.
+- Public OpenAPI 4.2.37 and its recursive schema references, isolated under
+  `contracts/sendico`. These wire files are unchanged except for trailing blank
+  line normalization in three YAML files; they are not local domain models.
 
-## Deliberate adaptations
+## Adaptations and exclusions
 
-- Import roots now belong to `git.sendico.io/tech/sxchnge/bff`. Versions are seeded
-  from committed Sendico manifests and tidied for the selected dependency set.
-- Product's composition root selects local account services instead of platform
-  services/provisioning. Its shared HTTP runtime remains the implementation.
-- Removed internal discovery and broker configuration, registration, startup and
-  teardown. An instance ID uses the existing UUID dependency without discovery.
-- Excluded internal gRPC/protobuf clients/converters and unused model files.
-  Local account-role values remain; private protobuf conversion helpers do not.
-- Program identity and the refresh-cookie name use SXCHNGE.
-- The policy seed retains the existing upsert helpers and three local
-  organization/account/role definitions, with an SXCHNGE database default.
-  Platform policies, automatic role backfills and pruning are excluded.
-- Startup configuration now rejects missing database/middleware/HTTP settings
-  and invalid HTTP timeouts. Runtime-construction failure closes the database.
-  Listen/start failures preserve the cause and produce a nonzero CLI exit.
-- Copied Casbin adapter errors and test sentinel errors use canonical `merrors`
-  instead of `errors.New`. Removed raw database settings from error logs.
-- The recipient-migration-only test was excluded together with its migration:
-  neither that platform feature nor historical Sendico data migration is part of
-  this bootstrap. Tests for every retained runtime/component remain included.
+Imports belong to `git.sendico.io/tech/sxchnge/bff`. The composition root selects
+local customer services. Discovery, message-bus registration, private gRPC and
+platform factories are absent. Process identity and the refresh cookie use SXCHNGE.
+Startup validates required settings and timeouts, closes failed connections and
+preserves process failures. Errors use `merrors`; logs exclude raw DB settings.
 
-No financial engine, internal service client, gateway, platform organization
-provisioning, deployment configuration, credential or generated binary was copied.
-The local account service's organization is an SXCHNGE authorization tenant;
-it does not create Sendico organizations per customer.
+The earlier extraction retained too much. Local organizations, membership,
+roles, Casbin, policies, invitations, policy seeding and their repositories and
+models are removed. There is no replacement tenant or permissive enforcer.
+Unneeded financial models/errors, ledger and wallet provisioning metadata,
+platform service names, S3 configuration and WebSocket scaffolding are removed.
+Tests specific to removed features are removed with those implementations.
 
-## Local additions
+The copied account service now creates a local customer from a raw password,
+hashes it and commits the customer and activation token atomically. It uses the
+same configured collections as login. Deletion revokes that customer's sessions
+and deletes its record atomically; it has no sole-member rule. The copied Mongo
+transaction helper joins an active outer transaction so verification does not
+commit separately from customer creation. Generic repositories no longer expose
+organization- or permission-bound operations. Customer responses use explicit DTO fields and a mapper; they have no anonymous
+organization-account flag or embedded database record. Refresh and protected
+handlers reject inactive customers; refresh checks account-bound application
+clients.
 
-`internal/profile` composes the copied account service. Architecture checks enforce
-project errors, no private provider imports/transports and self-contained public
-contract references. Configuration tests cover the executable example and missing
-settings. Guidelines and the backend-review skill are restored from Sendico with
-SXCHNGE paths and the public-only integration boundary.
+## Local additions and limits
 
-The source includes complete local auth building blocks, not a fully wired
-SXCHNGE product API. Remaining endpoint, email, local tenant/client provisioning
-and public Sendico integration work is explicit in the
-[architecture plan](../docs/architecture/bff.md).
+Architecture tests reject private provider imports, policy-engine dependencies
+and local tenancy declarations. Fresh Mongo replica-set tests exercise the actual
+customer lifecycle, isolation, duplicate login, rollback, deletion/session
+revocation and runtime startup without a seed. Existing retained auth/session and
+verification tests remain in place.
+
+This is a bootstrap. Signup/profile HTTP wiring, verification delivery/completion
+and the public Sendico HTTP adapter remain explicit work in the
+[architecture plan](../docs/architecture/bff.md). The sole Sendico organization
+reference belongs to that adapter's configuration, never to local customers.