Files

T

hamid 3a51305343 backend phase 2: identity — phone-OTP auth, sessions & roles (REST)

- six REST endpoints (auth/request_otp, verify_otp, refresh, logout, me,
  me/select_role) wrapping the existing JWE/TOTP/RBAC engine
- usr.UserSessions with refresh-token rotation + stolen-token (replay)
  detection → revoke-all + 401; logout rotates the security stamp
- users extended: gender, national_id (enc, NULL until KYC),
  shahkar_verified_at (auto-reset on phone change), phone_hash UNIQUE,
  is_active, deleted_at + soft-delete filter; phone/email/national_id
  encrypted at rest via IFieldEncryptor value converter
- user_roles grant/revoke audit trail + global revoked filter; 7 roles
  seeded; admin sub-roles never self-assignable (403)
- ISmsSender seam (mock logs the OTP code) replaces the TODO log lines
- OperationResult/BaseController learned enveloped 401/403
- auth knobs as platform_configs rows (resend/attempts/session TTL)
- migration IdentitySessionsAndUserExtensions applied to the dev DB
- 24 new tests incl. Baya.Test.Api (WebApplicationFactory over SQLite);
  47 total green, zero new build warnings; swagger snapshot + contract
  (identity-auth.md), handoff, report, mocks-registry updated

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-02 02:34:11 +03:30

README.md

add build development phases

2026-06-28 21:59:59 +03:30

swagger.v1.json

backend phase 2: identity — phone-OTP auth, sessions & roles (REST)

2026-07-02 02:34:11 +03:30

README.md

OpenAPI snapshots

The server already generates OpenAPI via NSwag (Swagger UI at /swagger, documents v1, v1.1). This folder holds the published swagger.json snapshot(s) so the frontend can generate/verify types without running the backend.

Backend: publish on every API-shipping phase

After adding/changing endpoints and confirming the build, export the OpenAPI document and commit it here as swagger.v1.json (overwrite — git history is the version trail). Typical options:

Run the API and save GET /swagger/v1/swagger.json to dev/contracts/openapi/swagger.v1.json, or
Use the NSwag CLI / build target the server already wires to emit the document.

Record in your handoff that the snapshot was refreshed. Keep it in sync with ../domains/*.md — the markdown is the human contract, this JSON is the machine contract; they must agree.

Frontend: consume

Generate types from swagger.v1.json (e.g. an openapi-typescript-style step) or hand-write src/services/{domain}/types.ts to match it. Either way, the wire shapes come from here — not from guessing. Casing/format questions are resolved by this file.

Until the first API-shipping backend phase runs, this folder is empty by design.