sxchnge/backend/PROVENANCE.md

Copied Sendico source

Source repository: S_I/sendico (git.sendico.io), revision 8bb20dcd622dd8eb92d289b6b34411e7eccab083.

PROVENANCE.json records each retained file, its original path and Git blob, and whether a Go file changed beyond import-path replacement and formatting. It currently covers 233 Go source/test entries across product and shared (one original configuration file contributes to two feature packages). Sources came from the pinned commit, not the dirty Sendico checkout. These are SXCHNGE-owned copies that may diverge independently.

Retained implementation

• Chi HTTP runtime, process/version bootstrap, structured logging and health.
• Customer password validation/hashing, account repository and account service.
• Customer login, pending verification, session validation, refresh rotation, revocation, browser cookies/CSRF and login rate limiting.
• Verification issuance, expiry, attempts, consumption and idempotency.
• Local Mongo connection, transactions and the repository/query implementation required by account, session and verification storage, with retained tests.

Adaptations and exclusions

The backend contains Go modules git.sendico.io/tech/sxchnge/product and git.sendico.io/tech/sxchnge/shared. Product owns its executable entry point; shared is a dependency library with no executable or domain-module imports. The composition root selects local customer services. Discovery, message-bus registration, private gRPC and platform factories are absent. Process identity and the refresh cookie use SXCHNGE. Startup validates required settings and timeouts, closes failed connections and preserves process failures. Errors use merrors; logs exclude raw DB settings.

The earlier extraction retained too much. Local organizations, membership, roles, Casbin, policies, invitations, policy seeding and their repositories and models are removed. There is no replacement tenant or permissive enforcer. Unneeded financial models/errors, ledger and wallet provisioning metadata, platform service names, S3 configuration and WebSocket scaffolding are removed. Tests specific to removed features are removed with those implementations.

The copied account service now creates a local customer from a raw password, hashes it and commits the customer and activation token atomically. It uses the same configured collections as login. Deletion revokes that customer's sessions and deletes its record atomically; it has no sole-member rule. The copied Mongo transaction helper joins an active outer transaction so verification does not commit separately from customer creation. Generic repositories no longer expose organization- or permission-bound operations. Customer responses use explicit DTO fields and a mapper; they have no anonymous organization-account flag or embedded database record. Refresh and protected handlers reject inactive customers; refresh checks account-bound application clients.

Local additions and limits

Architecture tests reject private provider imports, policy-engine dependencies and local tenancy declarations. Fresh Mongo replica-set tests exercise the actual customer lifecycle, isolation, duplicate login, rollback, deletion/session revocation and runtime startup without a seed. Existing retained auth/session and verification tests remain in place.

This is a bootstrap. Signup/profile HTTP wiring, verification delivery/completion and the public Sendico HTTP adapter remain explicit work in the architecture plan. The sole Sendico organization reference belongs to that adapter's configuration, never to local customers.

Module organization

backend/ groups modules; it has no root go.mod. The inherited cmd, edge, internal, pkg and empty scripts top-level directories are gone. product contains main.go, its manifest and app/customer/auth/session/verification code. shared owns its manifest and generic infrastructure. Models moved beside their owning features. Customer repository construction moved out of shared database code. Auth and verification configurations moved out of application interfaces.

All 112 unconsumed public API snapshot files and their snapshot-only check were removed. Future public adapters will own just the wire types they consume. Backoffice is a separate future executable module, not an alias for product.