82 lines
4.7 KiB
Markdown
82 lines
4.7 KiB
Markdown
# Copied Sendico source
|
|
|
|
Source repository: `S_I/sendico` (`git.sendico.io`), revision
|
|
`8bb20dcd622dd8eb92d289b6b34411e7eccab083`.
|
|
|
|
[PROVENANCE.json](PROVENANCE.json) records each retained file, its original path
|
|
and Git blob, and whether a Go file changed beyond import-path replacement and
|
|
formatting. It currently covers 233 Go source/test entries across `product` and `shared`
|
|
(one original configuration file contributes to two feature packages). Sources came from the pinned commit, not the dirty Sendico checkout.
|
|
These are SXCHNGE-owned copies that may diverge independently.
|
|
|
|
## Retained implementation
|
|
|
|
- Chi HTTP runtime, process/version bootstrap, structured logging and health.
|
|
- Customer password validation/hashing, account repository and account service.
|
|
- Customer login, pending verification, session validation, refresh rotation,
|
|
revocation, browser cookies/CSRF and login rate limiting.
|
|
- Verification issuance, expiry, attempts, consumption and idempotency.
|
|
- Local Mongo connection, transactions and the repository/query implementation
|
|
required by account, session and verification storage, with retained tests.
|
|
## Adaptations and exclusions
|
|
|
|
The backend contains Go modules `git.sendico.io/tech/sxchnge/product` and
|
|
`git.sendico.io/tech/sxchnge/shared`. Product owns its executable entry point;
|
|
shared is a dependency library with no executable or domain-module imports. The composition root selects
|
|
local customer services. Discovery, message-bus registration, private gRPC and
|
|
platform factories are absent. Process identity and the refresh cookie use SXCHNGE.
|
|
Startup validates required settings and timeouts, closes failed connections and
|
|
preserves process failures. Errors use `merrors`; logs exclude raw DB settings.
|
|
|
|
The earlier extraction retained too much. Local organizations, membership,
|
|
roles, Casbin, policies, invitations, policy seeding and their repositories and
|
|
models are removed. There is no replacement tenant or permissive enforcer.
|
|
Unneeded financial models/errors, ledger and wallet provisioning metadata,
|
|
platform service names, S3 configuration and WebSocket scaffolding are removed.
|
|
Tests specific to removed features are removed with those implementations.
|
|
|
|
The copied account service now creates a local customer from a raw password,
|
|
hashes it and commits the customer and activation token atomically. It uses the
|
|
same configured collections as login. Deletion revokes that customer's sessions
|
|
and deletes its record atomically; it has no sole-member rule. The copied Mongo
|
|
transaction helper joins an active outer transaction so verification does not
|
|
commit separately from customer creation. Generic repositories no longer expose
|
|
organization- or permission-bound operations. Customer responses use explicit DTO fields and a mapper; they have no anonymous
|
|
organization-account flag or embedded database record. Refresh and protected
|
|
handlers reject inactive customers; refresh checks account-bound application
|
|
clients.
|
|
|
|
## Local additions and limits
|
|
|
|
Architecture tests reject private provider imports, policy-engine dependencies
|
|
and local tenancy declarations. Fresh Mongo replica-set tests exercise the actual
|
|
customer lifecycle, isolation, duplicate login, rollback, deletion/session
|
|
revocation and runtime startup without a seed. Existing retained auth/session and
|
|
verification tests remain in place.
|
|
|
|
This is a bootstrap. Signup/profile HTTP wiring, verification delivery/completion
|
|
and the public Sendico HTTP adapter remain explicit work in the
|
|
[architecture plan](../docs/architecture/bff.md). The sole Sendico organization
|
|
reference belongs to that adapter's configuration, never to local customers.
|
|
|
|
## Module organization
|
|
|
|
`backend/` groups modules; it has no root `go.mod`. The inherited `cmd`, `edge`,
|
|
`internal`, `pkg` and empty `scripts` top-level directories are gone. `product`
|
|
contains `main.go`, its manifest and app/customer/auth/session/verification code.
|
|
`shared` owns its manifest and generic infrastructure. Models moved beside their
|
|
owning features. Customer repository construction moved out of shared database
|
|
code. Auth and verification configurations moved out of application interfaces.
|
|
|
|
All 112 unconsumed public API snapshot files and their snapshot-only check were
|
|
removed. Future public adapters will own just the wire types they consume.
|
|
Backoffice is a separate future executable module, not an alias for product.
|
|
|
|
## Second-factor separation (#40)
|
|
|
|
The new `product/twofactor` domain service reuses the already copied
|
|
`product/verification/store` issuance and consumption implementation at the pinned
|
|
Sendico revision. No additional Sendico source files were copied. Coupled
|
|
verification HTTP/session/private-messaging handlers were inspected but excluded.
|
|
See [reuse decisions and domain boundary](../docs/architecture/two-factor.md).
|