refinement phase 0

dev/shared-working-context/backend/STATUS.md

@@ -12,6 +12,27 @@ One block per completed backend phase. Newest at the top. Backend lane writes he
 - **Notes for frontend:** <anything load-bearing>
 -->
 
+## refinement-phase-0 — Local end-to-end bring-up & the integration seam — 2026-07-12
+- **Shipped (integration/plumbing — no business logic):** **CORS** (`Baya.WebFramework/ServiceConfiguration/
+  CorsServiceExtension.cs` → `AddCorsPolicies`, policy `BalinyaarWebClient` from `Cors:AllowedOrigins`, default
+  `http://localhost:3000`; `app.UseCors` after `UseRouting` / before `UseRateLimiter`; no `AllowCredentials`).
+  **Local DB story** — `server/docker-compose.yml` rewritten to SQL Server 2022 Developer on `localhost:1433`
+  (dev-only SA password); committed `appsettings*.json` connection strings replaced with **non-working
+  placeholders** (real value via `dotnet user-secrets`); added `<UserSecretsId>` to the API csproj.
+  **Development-only OTP helper** `GET /api/v1/dev/last_otp/{phone}` (`DevController` + `DevOtpStore` +
+  `DevCapturingSmsSender`, wired only in Development via `AddDevelopmentOtpCapture`; **404 outside
+  Development**). Wrote `dev/post-phase/refinement/RUNBOOK.md`.
+- **Contracts:** none produced; swagger snapshot **not** regenerated (only new path is the dev-only helper).
+- **Mocked:** no new seam; `ISmsSender` (`LoggingSmsSender`) row updated in mocks-registry (interim OTP channel
+  + the Development-only capture affordance).
+- **Gate:** build clean (0 new warnings) / tests green (**369**: 4 identity + 248 foundation + 117 API, incl.
+  3 new CORS/dev-otp integration tests + 8 dev-otp store/decorator unit tests).
+- **Handoff:** backend/handoff/after-refinement-phase-0.md
+- **Notes for frontend:** the client now really reaches the API cross-origin (CORS unblocked). **No mock flag
+  was flipped — `auth` is still the only real domain** (that's Phase 4). `client/.env.development` already
+  points at `https://localhost:5002`; the API speaks HTTP/2 (browsers negotiate h2-over-TLS automatically).
+  Read the OTP from the server console or `GET /api/v1/dev/last_otp/{phone}` (Development only).
+
 ## backend-phase-15 — Messaging (tickets), partner centers & admin backoffice — 2026-07-10
 - **Shipped (FINAL backend phase):** new `messaging` schema — `Tickets` (`UNIQUE(reference_code)`, status/
   category, nullable `booking_id`/`refund_id`), `TicketParticipants` (`UNIQUE(ticket_id, user_id)`, soft-remove

dev/shared-working-context/backend/handoff/after-refinement-phase-0.md

@@ -0,0 +1,35 @@
+# Handoff — after refinement-phase-0 (Local end-to-end bring-up)
+
+**Date:** 2026-07-12 · **Track:** integration (both projects) · **Unlocks:** every other refinement phase.
+
+## What the frontend can now do
+- **Actually call the backend cross-origin.** The API now has a CORS policy (`BalinyaarWebClient`) allowing
+  `http://localhost:3000` (config `Cors:AllowedOrigins`, default in Dev) with the four headers the client
+  sends (`Authorization`, `Content-Type`, `Accept-Language`, `Idempotency-Key`). A browser at `:3000` calling
+  `https://localhost:5002` is no longer blocked by same-origin policy.
+- **Stand the stack up in ~5 minutes** via `dev/post-phase/refinement/RUNBOOK.md` (dev-cert trust → local SQL
+  Server via `docker compose` → connection string via `dotnet user-secrets` → `dotnet run` + `npm run dev`).
+- **Complete a real login end-to-end.** Request an OTP, read the 6-digit code from the **server console**
+  (`MOCK SMS — OTP code … for phone ending in …`) or from the Development-only helper
+  `GET /api/v1/dev/last_otp/{phone}`, verify → real tokens + `/me`.
+
+## What did NOT change (important)
+- **No `USE_*_MOCK` flag was flipped.** `auth` is still the only real client domain; the home/search/bookings
+  are still in-browser mocks until [Refinement Phase 4](../../../post-phase/refinement/refinement-phase-4-frontend-de-mock.md).
+- **No client app code changed** — only verified `client/.env.development` (already `https://localhost:5002`)
+  and added the runbook. If you run the API elsewhere, override with `client/.env.local`.
+- **Auth crypto, the money path, and the `ApiResult` envelope are untouched.**
+
+## New endpoint (Development only — not a contract)
+- `GET /api/v1/dev/last_otp/{phone}` → `{ data: { phone, code } }` when a code was issued, else 404. **404 in
+  every non-Development environment** (the capture isn't even wired there). For manual/e2e login only;
+  superseded by real SMS in [Refinement Phase 8](../../../post-phase/refinement/refinement-phase-8-external-rails.md).
+  Do not build client features on it.
+
+## Gotchas
+- The API binds **HTTP/2** (`Kestrel:Protocols = Http2`, for gRPC). Browsers negotiate h2-over-TLS via ALPN
+  automatically, so `fetch` works; `curl` needs `--http2`.
+- The dev HTTPS cert **must be trusted** (`dotnet dev-certs https --trust`) or `fetch` to `:5002` fails with an
+  opaque network error.
+- Committed `appsettings*.json` connection strings are **placeholders** — the API will not boot until you set
+  `ConnectionStrings:SqlServer` via user-secrets (or the `ConnectionStrings__SqlServer` env var).