Remove platform tenancy from SXCHNGE customer BFF (#34)
This commit is contained in:
Stephan D committed
1 parent
7062672a87
commit
981e84a4b4
244 files changed
+651
-17130
No files matched your search
@@ -18,8 +18,8 @@ The source checkout's unrelated dependency edits were not copied.
|
||||
| Local component | Reused implementation |
|
||||
| --- | --- |
|
||||
| `backend/edge/shared` | Chi HTTP runtime, middleware, JWT login/pending sessions, refresh/rotation/logout, CSRF/cookies, rate limiting, Mongo verification and refresh-token stores |
|
||||
| `backend/edge/product/interface/accountservice` | Account validation, bcrypt passwords, creation, local membership/roles, activation tokens, password reset and email-change token issuance, deletion |
|
||||
| `backend/pkg` | Canonical local account/domain models, Mongo repositories/transactions, authorization, errors, structured logging, process bootstrap and health |
|
||||
| `backend/edge/product/interface/accountservice` | Account validation, bcrypt passwords, atomic customer creation, activation tokens, password reset and email-change token issuance, deletion |
|
||||
| `backend/pkg` | Canonical local account/domain models, Mongo repositories/transactions, errors, structured logging, process bootstrap and health |
|
||||
| `backend/internal/profile` | Small SXCHNGE composition layer selecting the copied local account service |
|
||||
| `backend/contracts/sendico` | Separate snapshot of Sendico's public OpenAPI contract and its referenced schemas |
|
||||
|
||||
@@ -29,10 +29,12 @@ private Sendico module requirement, gRPC client, discovery subscription or broke
|
||||
connection. Platform engines and Product's platform-provisioning bootstrap were
|
||||
not copied. The original handwritten shell and tiny replacement helpers were removed.
|
||||
|
||||
The existing local account service retains local organization membership and role
|
||||
semantics. Use one SXCHNGE local tenant when wiring registration; this does not
|
||||
create an organization in Sendico for each customer. Local database collections,
|
||||
JWT keys and registered application clients belong exclusively to SXCHNGE.
|
||||
Local customers have no organization membership, roles, policies or tenant ID.
|
||||
The account service validates and hashes passwords, creates an account and
|
||||
activation token atomically, and deletes an account with session revocation.
|
||||
Customer responses map to explicit local DTOs. Account, token and session collections and application client records belong only
|
||||
to SXCHNGE. The runtime starts without any policy or tenant seed. Casbin,
|
||||
invitations, financial models and provisioning machinery are excluded.
|
||||
|
||||
## Identity and ownership
|
||||
|
||||
@@ -98,8 +100,9 @@ Sendico task. No private transport fallback is allowed.
|
||||
## Next wiring sequence
|
||||
|
||||
1. Wire local signup, verification delivery/completion and profile endpoints onto
|
||||
the copied account and verification services. Create SXCHNGE-owned tenant,
|
||||
client and role records; keep signup independent of Sendico availability.
|
||||
the copied account and verification services. Configure the SXCHNGE application
|
||||
client for web/native sessions; keep signup independent of Sendico availability.
|
||||
Never add local organization, membership, role or policy requirements.
|
||||
2. Implement the public HTTP adapter and confirm organization/resource scoping
|
||||
with the integration principal. Agree on external-customer contracts where the
|
||||
existing public API assumes a Sendico account.
|
||||
@@ -120,6 +123,6 @@ operation details explain what has happened and what remains pending.
|
||||
This task supplies the copied starting point and isolated public contracts.
|
||||
The local runtime installs the existing authentication transport and account
|
||||
service. Local signup/profile HTTP endpoints, verification delivery/completion,
|
||||
initial tenant/client provisioning, Flutter HTTP adapters and live Sendico calls
|
||||
application client setup, Flutter HTTP adapters and live Sendico calls
|
||||
are not connected yet. The frontend continues using its existing dummy services.
|
||||
No new provider organization, customer or payment has been created.
|
||||
+47
-35
@@ -363,44 +363,56 @@ Delivery: [PR #33](https://git.sendico.io/tech/sxchnge/pulls/33) targets `main`;
|
||||
committed and pushed, unmerged. Issue #32 and PR #33 metadata verified: frontend
|
||||
label, tech owner and SXCHNGE project. No stacked dependencies.
|
||||
|
||||
## Copied BFF foundation and public Sendico contracts — task #34
|
||||
## Minimal customer BFF and public Sendico contracts — task #34
|
||||
|
||||
Bootstrapped SXCHNGE from Sendico revision
|
||||
`8bb20dcd622dd8eb92d289b6b34411e7eccab083`: shared HTTP runtime, authentication
|
||||
and session stack, verification and refresh storage, account service, Mongo
|
||||
repositories, authorization, canonical models/errors and structured logging.
|
||||
The original handwritten shell and replacement helpers were removed. File-level
|
||||
[provenance](../backend/PROVENANCE.json) records 416 copied Go files and 112 public
|
||||
OpenAPI files. The source checkout and its unrelated dependency edits were untouched.
|
||||
[Task #34](https://git.sendico.io/tech/sxchnge/issues/34), branch `bff-34`,
|
||||
[PR #35](https://git.sendico.io/tech/sxchnge/pulls/35) into `main`.
|
||||
|
||||
The corrected [architecture](architecture/bff.md) reflects the product boundary:
|
||||
SXCHNGE owns customers/authentication; SXCHNGE itself is one Sendico organization;
|
||||
all Sendico access uses the public HTTP API. Internal gRPC, discovery, messaging,
|
||||
platform service factories and organization provisioning were excluded. Public
|
||||
OpenAPI is isolated from local models and tested for self-contained references.
|
||||
No live provider call, organization, customer or payment was created.
|
||||
The initial copy at `7062672` incorrectly retained Sendico's local tenancy model.
|
||||
The correction removes organization membership, roles, Casbin, policy storage and
|
||||
seeding, invitations and their models/repositories/tests. It also removes unused
|
||||
financial models/errors, ledger/wallet provisioning metadata, platform service
|
||||
names, S3 configuration and WebSocket scaffolding. No default tenant or bypassing
|
||||
authorizer replaces them.
|
||||
|
||||
Restored full backend guidelines and the backend-review skill, correcting scoped
|
||||
paths. Copied error constructors follow `merrors`; local adaptations also validate
|
||||
startup settings, preserve listen failures/nonzero exit, close Mongo after failed
|
||||
runtime creation and avoid logging database settings. Architecture checks enforce
|
||||
the project error model and public-only provider boundary.
|
||||
Retained Sendico source is pinned to `8bb20dcd622dd8eb92d289b6b34411e7eccab083`:
|
||||
HTTP runtime, local customer/password service and Mongo repository, customer
|
||||
sessions and verification storage, generic repository/transaction code, errors,
|
||||
logging and health. [Provenance](../backend/PROVENANCE.json) covers 232 retained
|
||||
Go files and 112 isolated public OpenAPI files; every adaptation is flagged.
|
||||
The Sendico checkout remains unchanged.
|
||||
|
||||
The copied runtime installs local authentication transport and initializes the
|
||||
account service. Signup/profile endpoints, verification delivery/completion,
|
||||
initial local tenant/client provisioning, Flutter HTTP adapters and live Sendico
|
||||
calls remain future wiring. Public external-customer compliance/ownership gaps
|
||||
are documented; internal APIs are not an allowed workaround.
|
||||
Customer creation accepts a raw password, validates/hashes it and commits the
|
||||
customer and activation token together. Token transactions join an active outer
|
||||
customer transaction. Deletion revokes only the selected customer's sessions and
|
||||
deletes its account atomically, including when it is the final local customer.
|
||||
Customer lifecycle and login use the same configured auth collections. Pending,
|
||||
active and blocked customer state and session/client binding remain local.
|
||||
|
||||
Validation: `make test` (race-enabled backend suite with real MongoDB containers,
|
||||
plus all frontend package/app tests), `make lint-backend` (architecture, gofmt,
|
||||
vet), `go build` and `git diff --check` passed. Local smoke used a disposable
|
||||
SXCHNGE Mongo replica set: health 200, invalid login 400, SIGTERM exit 0 and missing
|
||||
configuration exit 1. Earlier extraction failures were fixed: unused import,
|
||||
wrong example-config test path, an out-of-scope recipient migration test
|
||||
copied without its uncopied migration, and missing built-in policy records on
|
||||
fresh startup. The copied policy seed was run twice and retained three records. No security scan was requested or run.
|
||||
The sole Sendico organization reference belongs to the future public HTTP adapter
|
||||
configuration. [Architecture and capabilities](architecture/bff.md) document
|
||||
server-side customer/resource ownership and the public external-customer contract
|
||||
gaps. No internal service, shared database or provider resource creation is used.
|
||||
Signup/profile HTTP routes, verification delivery/completion, application client
|
||||
setup and live Sendico integration remain subsequent wiring work.
|
||||
|
||||
Delivery: [PR #35](https://git.sendico.io/tech/sxchnge/pulls/35), branch `bff-34`
|
||||
into `main`; task #34 retains backend label, tech owner and SXCHNGE project.
|
||||
This entry supersedes the earlier new-shell/delegated-provisioning proposal.
|
||||
Backend completion review covered the retained copied runtime and the full
|
||||
extraction diff. Inactive-customer checks and refresh client/account binding were
|
||||
added after review; explicit response DTOs keep storage fields out of HTTP output.
|
||||
|
||||
Validation passed: `make test` (race-enabled backend suite, including fresh Mongo
|
||||
replica-set customer lifecycle/runtime tests, plus all frontend suites),
|
||||
`make lint-backend` (architecture, formatting and vet), and
|
||||
`go test -tags integration -run '^$' ./...` from `backend` (compilation of the
|
||||
additional tagged suites; this command does not execute those tests).
|
||||
Provenance/source blobs, public contract references and `git diff --check` passed.
|
||||
Earlier extraction compile errors were corrected. The initial fresh-database test
|
||||
attempt used an unavailable image tag and then hit Docker Desktop replica-set
|
||||
address discovery; it now uses `mongo:8` and a direct connection to the disposable
|
||||
single-node replica set. No security scan was requested or run.
|
||||
|
||||
PR #35 remains unmerged. There is no deployed-data migration: this bootstrap has
|
||||
not been deployed. Existing experimental databases may retain unused tenancy
|
||||
collections; this change does not delete external database records. Customer HTTP
|
||||
responses now expose only ID, name, last name, login, locale and optional avatar.
|
||||
The frontend still uses dummy services and is unchanged.
|
||||
Reference in new issue
Block a user