Make product HTTP API versions independently installable at startup, supporting simultaneous versions with shared domain services and infrastructure.
Approach
The product registry explicitly selects v1. YAML api.versions configures installed versions and mounts; omitted configuration preserves v1 at the existing endpoint and an empty list disables application routes. Runtime opens shared stores, customer/auth/factor services and notification resources once. Installers receive typed dependencies, independent routers, URL providers and cookie scopes. Auth and second-factor wire contracts live in their owning v1 transport packages. Middleware no longer creates product services or installs auth routes.
Acceptance criteria
v1 is explicitly installed and existing contracts remain compatible.
Independent versions can coexist; disabled versions have no routes.
Unknown versions and conflicting mounts fail startup.
Shared dependencies initialize and close once, including installation failure cleanup.
Cookies and generated API URLs use the installed mount.
Focused regression tests, make test and make lint-backend pass.
Documentation, commit, push and pull request are delivered.
Notes
Delivered in PR #45: #45 on product-api-44. Implementation commit d04c8b1. Owner tech; project SXCHNGE; label backend. Product HTTP only; notifications gRPC is unchanged.
Validation passed on final code: make test (backend race tests and all frontend suites), make lint-backend and git diff --check. Regression coverage includes independent contracts, shared dependency identity, absent disabled routes, omitted/empty/explicit YAML, invalid mounts/origins, scoped links and cookie set/delete, failed bootstrap/installation cleanup, repeated/concurrent shutdown and runtime import boundaries. Existing v1 auth/factor tests and Mongo-backed startup pass. Initial focused compile and relative-route failures were corrected before final successful checks.
Only v1 ships; two distinct test installers verify coexistence. Internal Go composition APIs changed. No database migration; default v1 HTTP/JSON and operational URLs remain compatible. Moving a mount requires reauthentication because refresh cookies are path-scoped. Activation URLs remain configured frontend links. See docs/api-versions.md and docs/implementation.md.
Stacked delivery: merge PR #43 (dev-env-42) into main first, then retarget PR #45 to main before merging. No merge, deployment or optional security scans performed. The uncommitted notifications sender configuration is preserved and excluded.
### Goal
Make product HTTP API versions independently installable at startup, supporting simultaneous versions with shared domain services and infrastructure.
### Approach
The product registry explicitly selects v1. YAML `api.versions` configures installed versions and mounts; omitted configuration preserves v1 at the existing endpoint and an empty list disables application routes. Runtime opens shared stores, customer/auth/factor services and notification resources once. Installers receive typed dependencies, independent routers, URL providers and cookie scopes. Auth and second-factor wire contracts live in their owning v1 transport packages. Middleware no longer creates product services or installs auth routes.
### Acceptance criteria
- [x] v1 is explicitly installed and existing contracts remain compatible.
- [x] Independent versions can coexist; disabled versions have no routes.
- [x] Unknown versions and conflicting mounts fail startup.
- [x] Shared dependencies initialize and close once, including installation failure cleanup.
- [x] Cookies and generated API URLs use the installed mount.
- [x] Focused regression tests, make test and make lint-backend pass.
- [x] Documentation, commit, push and pull request are delivered.
### Notes
Delivered in PR #45: https://git.sendico.io/tech/sxchnge/pulls/45 on product-api-44. Implementation commit d04c8b1. Owner tech; project SXCHNGE; label backend. Product HTTP only; notifications gRPC is unchanged.
Validation passed on final code: make test (backend race tests and all frontend suites), make lint-backend and git diff --check. Regression coverage includes independent contracts, shared dependency identity, absent disabled routes, omitted/empty/explicit YAML, invalid mounts/origins, scoped links and cookie set/delete, failed bootstrap/installation cleanup, repeated/concurrent shutdown and runtime import boundaries. Existing v1 auth/factor tests and Mongo-backed startup pass. Initial focused compile and relative-route failures were corrected before final successful checks.
Only v1 ships; two distinct test installers verify coexistence. Internal Go composition APIs changed. No database migration; default v1 HTTP/JSON and operational URLs remain compatible. Moving a mount requires reauthentication because refresh cookies are path-scoped. Activation URLs remain configured frontend links. See docs/api-versions.md and docs/implementation.md.
Stacked delivery: merge PR #43 (dev-env-42) into main first, then retarget PR #45 to main before merging. No merge, deployment or optional security scans performed. The uncommitted notifications sender configuration is preserved and excluded.
tech
added the backend label 2026-09-13 08:11:37 +00:00
tech
self-assigned this 2026-09-13 08:11:37 +00:00
tech
added this to the SXCHNGE project 2026-09-13 08:11:37 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Make product HTTP API versions independently installable at startup, supporting simultaneous versions with shared domain services and infrastructure.
Approach
The product registry explicitly selects v1. YAML
api.versionsconfigures installed versions and mounts; omitted configuration preserves v1 at the existing endpoint and an empty list disables application routes. Runtime opens shared stores, customer/auth/factor services and notification resources once. Installers receive typed dependencies, independent routers, URL providers and cookie scopes. Auth and second-factor wire contracts live in their owning v1 transport packages. Middleware no longer creates product services or installs auth routes.Acceptance criteria
Notes
Delivered in PR #45: #45 on product-api-44. Implementation commit
d04c8b1. Owner tech; project SXCHNGE; label backend. Product HTTP only; notifications gRPC is unchanged.Validation passed on final code: make test (backend race tests and all frontend suites), make lint-backend and git diff --check. Regression coverage includes independent contracts, shared dependency identity, absent disabled routes, omitted/empty/explicit YAML, invalid mounts/origins, scoped links and cookie set/delete, failed bootstrap/installation cleanup, repeated/concurrent shutdown and runtime import boundaries. Existing v1 auth/factor tests and Mongo-backed startup pass. Initial focused compile and relative-route failures were corrected before final successful checks.
Only v1 ships; two distinct test installers verify coexistence. Internal Go composition APIs changed. No database migration; default v1 HTTP/JSON and operational URLs remain compatible. Moving a mount requires reauthentication because refresh cookies are path-scoped. Activation URLs remain configured frontend links. See docs/api-versions.md and docs/implementation.md.
Stacked delivery: merge PR #43 (dev-env-42) into main first, then retarget PR #45 to main before merging. No merge, deployment or optional security scans performed. The uncommitted notifications sender configuration is preserved and excluded.
product-api-44to product-api-44