sxchnge/backend/README.md

SXCHNGE BFF

A locally owned copy of Sendico's reusable BFF runtime, authentication/session stack and account service. See provenance and the architecture and public API plan.

SXCHNGE owns its customers and authentication. SXCHNGE itself is one organization in Sendico. Provider integration uses only Sendico's public HTTP API; the pinned OpenAPI snapshot is isolated from local models.

Run locally

Requires Go 1.27 and an SXCHNGE-owned MongoDB replica set for transactions. Copy config.example.yml to an untracked config.yml. Set:

• SXCHNGE_MONGO_URI: URI for the local SXCHNGE database.
• SXCHNGE_JWT_SECRET: private random signing key, at least 32 bytes for HS256.
• SXCHNGE_DOMAIN: local API hostname (for example localhost:8082).
• SXCHNGE_API_PROTOCOL: http locally, https in deployment.
• SXCHNGE_API_ENDPOINT: /api/v1.

Seed the local policy descriptions before first startup (requires mongosh):

mongosh "$SXCHNGE_MONGO_URI" --file backend/scripts/seed-policies.js

The seed is repeatable and creates only the three local built-in policy descriptions required by the copied runtime. It grants no role permissions. Run make run-backend from the repository root. The copied CLI accepts -config.file, -version and -debug. Configure exact browser origins in YAML; secure refresh cookies require HTTPS for browser session testing.

The runtime mounts /api/v1/health and the copied account login, API login, refresh, rotation and logout handlers. Customer/client records must exist in the local database. The account service is initialized locally; signup/profile and verification-delivery/completion routes are the next wiring work. This is a bootstrap, not a finished authentication deployment. No Sendico calls are made.

Validate

Run make test and make lint-backend. Backend tests include real MongoDB integration tests through Testcontainers, so Docker must be running. make test-backend runs the backend suite with the race detector. Architecture checks reject private Sendico imports/transports and ad hoc error constructors. The frontend still uses dummy services; no Flutter source changed.