cleanup phases 6

2026-08-02 18:48:32 +03:30
parent e2db97392a
commit 51e86a1e5f
239 changed files with 118 additions and 70 deletions
@@ -0,0 +1,35 @@
+# Handoff — after refinement-phase-0 (Local end-to-end bring-up)
+
+**Date:** 2026-07-12 · **Track:** integration (both projects) · **Unlocks:** every other refinement phase.
+
+## What the frontend can now do
+- **Actually call the backend cross-origin.** The API now has a CORS policy (`BalinyaarWebClient`) allowing
+  `http://localhost:3000` (config `Cors:AllowedOrigins`, default in Dev) with the four headers the client
+  sends (`Authorization`, `Content-Type`, `Accept-Language`, `Idempotency-Key`). A browser at `:3000` calling
+  `https://localhost:5002` is no longer blocked by same-origin policy.
+- **Stand the stack up in ~5 minutes** via `dev/post-phase/refinement/RUNBOOK.md` (dev-cert trust → local SQL
+  Server via `docker compose` → connection string via `dotnet user-secrets` → `dotnet run` + `npm run dev`).
+- **Complete a real login end-to-end.** Request an OTP, read the 6-digit code from the **server console**
+  (`MOCK SMS — OTP code … for phone ending in …`) or from the Development-only helper
+  `GET /api/v1/dev/last_otp/{phone}`, verify → real tokens + `/me`.
+
+## What did NOT change (important)
+- **No `USE_*_MOCK` flag was flipped.** `auth` is still the only real client domain; the home/search/bookings
+  are still in-browser mocks until [Refinement Phase 4](../../../post-phase/refinement/refinement-phase-4-frontend-de-mock.md).
+- **No client app code changed** — only verified `client/.env.development` (already `https://localhost:5002`)
+  and added the runbook. If you run the API elsewhere, override with `client/.env.local`.
+- **Auth crypto, the money path, and the `ApiResult` envelope are untouched.**
+
+## New endpoint (Development only — not a contract)
+- `GET /api/v1/dev/last_otp/{phone}` → `{ data: { phone, code } }` when a code was issued, else 404. **404 in
+  every non-Development environment** (the capture isn't even wired there). For manual/e2e login only;
+  superseded by real SMS in [Refinement Phase 8](../../../post-phase/refinement/refinement-phase-8-external-rails.md).
+  Do not build client features on it.
+
+## Gotchas
+- The API binds **HTTP/2** (`Kestrel:Protocols = Http2`, for gRPC). Browsers negotiate h2-over-TLS via ALPN
+  automatically, so `fetch` works; `curl` needs `--http2`.
+- The dev HTTPS cert **must be trusted** (`dotnet dev-certs https --trust`) or `fetch` to `:5002` fails with an
+  opaque network error.
+- Committed `appsettings*.json` connection strings are **placeholders** — the API will not boot until you set
+  `ConnectionStrings:SqlServer` via user-secrets (or the `ConnectionStrings__SqlServer` env var).