63 lines
3.6 KiB
Markdown
63 lines
3.6 KiB
Markdown
# Copied Sendico source
|
|
|
|
Source repository: `S_I/sendico` (`git.sendico.io`), revision
|
|
`8bb20dcd622dd8eb92d289b6b34411e7eccab083`.
|
|
|
|
[PROVENANCE.json](PROVENANCE.json) records each retained file, its original path
|
|
and Git blob, and whether a Go file changed beyond namespace replacement and
|
|
formatting. It currently covers 232 Go source/test files and 112 public OpenAPI
|
|
files. Sources came from the pinned commit, not the dirty Sendico checkout.
|
|
These are SXCHNGE-owned copies that may diverge independently.
|
|
|
|
## Retained implementation
|
|
|
|
- Chi HTTP runtime, process/version bootstrap, structured logging and health.
|
|
- Customer password validation/hashing, account repository and account service.
|
|
- Customer login, pending verification, session validation, refresh rotation,
|
|
revocation, browser cookies/CSRF and login rate limiting.
|
|
- Verification issuance, expiry, attempts, consumption and idempotency.
|
|
- Local Mongo connection, transactions and the repository/query implementation
|
|
required by account, session and verification storage, with retained tests.
|
|
- Public OpenAPI 4.2.37 and its recursive schema references, isolated under
|
|
`contracts/sendico`. These wire files are unchanged except for trailing blank
|
|
line normalization in three YAML files; they are not local domain models.
|
|
|
|
## Adaptations and exclusions
|
|
|
|
Imports belong to `git.sendico.io/tech/sxchnge/bff`. The composition root selects
|
|
local customer services. Discovery, message-bus registration, private gRPC and
|
|
platform factories are absent. Process identity and the refresh cookie use SXCHNGE.
|
|
Startup validates required settings and timeouts, closes failed connections and
|
|
preserves process failures. Errors use `merrors`; logs exclude raw DB settings.
|
|
|
|
The earlier extraction retained too much. Local organizations, membership,
|
|
roles, Casbin, policies, invitations, policy seeding and their repositories and
|
|
models are removed. There is no replacement tenant or permissive enforcer.
|
|
Unneeded financial models/errors, ledger and wallet provisioning metadata,
|
|
platform service names, S3 configuration and WebSocket scaffolding are removed.
|
|
Tests specific to removed features are removed with those implementations.
|
|
|
|
The copied account service now creates a local customer from a raw password,
|
|
hashes it and commits the customer and activation token atomically. It uses the
|
|
same configured collections as login. Deletion revokes that customer's sessions
|
|
and deletes its record atomically; it has no sole-member rule. The copied Mongo
|
|
transaction helper joins an active outer transaction so verification does not
|
|
commit separately from customer creation. Generic repositories no longer expose
|
|
organization- or permission-bound operations. Customer responses use explicit DTO fields and a mapper; they have no anonymous
|
|
organization-account flag or embedded database record. Refresh and protected
|
|
handlers reject inactive customers; refresh checks account-bound application
|
|
clients.
|
|
|
|
## Local additions and limits
|
|
|
|
Architecture tests reject private provider imports, policy-engine dependencies
|
|
and local tenancy declarations. Fresh Mongo replica-set tests exercise the actual
|
|
customer lifecycle, isolation, duplicate login, rollback, deletion/session
|
|
revocation and runtime startup without a seed. Existing retained auth/session and
|
|
verification tests remain in place.
|
|
|
|
This is a bootstrap. Signup/profile HTTP wiring, verification delivery/completion
|
|
and the public Sendico HTTP adapter remain explicit work in the
|
|
[architecture plan](../docs/architecture/bff.md). The sole Sendico organization
|
|
reference belongs to that adapter's configuration, never to local customers.
|