hamid
36 lines
2.5 KiB
Markdown
36 lines
2.5 KiB
Markdown
# Handoff — after refinement-phase-0 (Local end-to-end bring-up)
|
|
|
|
**Date:** 2026-07-12 · **Track:** integration (both projects) · **Unlocks:** every other refinement phase.
|
|
|
|
## What the frontend can now do
|
|
- **Actually call the backend cross-origin.** The API now has a CORS policy (`BalinyaarWebClient`) allowing
|
|
`http://localhost:3000` (config `Cors:AllowedOrigins`, default in Dev) with the four headers the client
|
|
sends (`Authorization`, `Content-Type`, `Accept-Language`, `Idempotency-Key`). A browser at `:3000` calling
|
|
`https://localhost:5002` is no longer blocked by same-origin policy.
|
|
- **Stand the stack up in ~5 minutes** via `dev/post-phase/refinement/RUNBOOK.md` (dev-cert trust → local SQL
|
|
Server via `docker compose` → connection string via `dotnet user-secrets` → `dotnet run` + `npm run dev`).
|
|
- **Complete a real login end-to-end.** Request an OTP, read the 6-digit code from the **server console**
|
|
(`MOCK SMS — OTP code … for phone ending in …`) or from the Development-only helper
|
|
`GET /api/v1/dev/last_otp/{phone}`, verify → real tokens + `/me`.
|
|
|
|
## What did NOT change (important)
|
|
- **No `USE_*_MOCK` flag was flipped.** `auth` is still the only real client domain; the home/search/bookings
|
|
are still in-browser mocks until [Refinement Phase 4](../../../post-phase/refinement/refinement-phase-4-frontend-de-mock.md).
|
|
- **No client app code changed** — only verified `client/.env.development` (already `https://localhost:5002`)
|
|
and added the runbook. If you run the API elsewhere, override with `client/.env.local`.
|
|
- **Auth crypto, the money path, and the `ApiResult` envelope are untouched.**
|
|
|
|
## New endpoint (Development only — not a contract)
|
|
- `GET /api/v1/dev/last_otp/{phone}` → `{ data: { phone, code } }` when a code was issued, else 404. **404 in
|
|
every non-Development environment** (the capture isn't even wired there). For manual/e2e login only;
|
|
superseded by real SMS in [Refinement Phase 8](../../../post-phase/refinement/refinement-phase-8-external-rails.md).
|
|
Do not build client features on it.
|
|
|
|
## Gotchas
|
|
- The API binds **HTTP/2** (`Kestrel:Protocols = Http2`, for gRPC). Browsers negotiate h2-over-TLS via ALPN
|
|
automatically, so `fetch` works; `curl` needs `--http2`.
|
|
- The dev HTTPS cert **must be trusted** (`dotnet dev-certs https --trust`) or `fetch` to `:5002` fails with an
|
|
opaque network error.
|
|
- Committed `appsettings*.json` connection strings are **placeholders** — the API will not boot until you set
|
|
`ConnectionStrings:SqlServer` via user-secrets (or the `ConnectionStrings__SqlServer` env var).
|