sxchnge/backend/PROVENANCE.md

Copied Sendico source

Source repository: S_I/sendico (git.sendico.io), revision 8bb20dcd622dd8eb92d289b6b34411e7eccab083.

PROVENANCE.json records each retained file, its original path and Git blob, and whether a Go file changed beyond namespace replacement and formatting. It currently covers 232 Go source/test files and 112 public OpenAPI files. Sources came from the pinned commit, not the dirty Sendico checkout. These are SXCHNGE-owned copies that may diverge independently.

Retained implementation

• Chi HTTP runtime, process/version bootstrap, structured logging and health.
• Customer password validation/hashing, account repository and account service.
• Customer login, pending verification, session validation, refresh rotation, revocation, browser cookies/CSRF and login rate limiting.
• Verification issuance, expiry, attempts, consumption and idempotency.
• Local Mongo connection, transactions and the repository/query implementation required by account, session and verification storage, with retained tests.
• Public OpenAPI 4.2.37 and its recursive schema references, isolated under contracts/sendico. These wire files are unchanged except for trailing blank line normalization in three YAML files; they are not local domain models.

Adaptations and exclusions

Imports belong to git.sendico.io/tech/sxchnge/bff. The composition root selects local customer services. Discovery, message-bus registration, private gRPC and platform factories are absent. Process identity and the refresh cookie use SXCHNGE. Startup validates required settings and timeouts, closes failed connections and preserves process failures. Errors use merrors; logs exclude raw DB settings.

The earlier extraction retained too much. Local organizations, membership, roles, Casbin, policies, invitations, policy seeding and their repositories and models are removed. There is no replacement tenant or permissive enforcer. Unneeded financial models/errors, ledger and wallet provisioning metadata, platform service names, S3 configuration and WebSocket scaffolding are removed. Tests specific to removed features are removed with those implementations.

The copied account service now creates a local customer from a raw password, hashes it and commits the customer and activation token atomically. It uses the same configured collections as login. Deletion revokes that customer's sessions and deletes its record atomically; it has no sole-member rule. The copied Mongo transaction helper joins an active outer transaction so verification does not commit separately from customer creation. Generic repositories no longer expose organization- or permission-bound operations. Customer responses use explicit DTO fields and a mapper; they have no anonymous organization-account flag or embedded database record. Refresh and protected handlers reject inactive customers; refresh checks account-bound application clients.

Local additions and limits

Architecture tests reject private provider imports, policy-engine dependencies and local tenancy declarations. Fresh Mongo replica-set tests exercise the actual customer lifecycle, isolation, duplicate login, rollback, deletion/session revocation and runtime startup without a seed. Existing retained auth/session and verification tests remain in place.

This is a bootstrap. Signup/profile HTTP wiring, verification delivery/completion and the public Sendico HTTP adapter remain explicit work in the architecture plan. The sole Sendico organization reference belongs to that adapter's configuration, never to local customers.