docs: record auth session parity checkpoint
This commit is contained in:
@@ -16,10 +16,10 @@ Build GoChat as a Go backend that can directly reuse the frontend from `referenc
|
||||
|
||||
## Current Baseline
|
||||
|
||||
- Latest implementation checkpoint: `56a8c5b feat(profile): align chatwoot user serializer`.
|
||||
- Latest implementation checkpoint: `e59f9f3 feat(auth): add chatwoot session routes`.
|
||||
- Worktree status at this planning checkpoint: clean.
|
||||
- `go test ./...` passes.
|
||||
- Route dump succeeds with `TOTAL: 801` after Chatwoot webhook ingress routes were added.
|
||||
- Route dump succeeds with `TOTAL: 805` after Chatwoot root auth/session routes were added.
|
||||
- Route parity artifacts now exist under `docs/parity/` and are generated by `cmd/route_parity`.
|
||||
- Tracked frontend-critical route audit covers 251 Chatwoot routes: 251 exact, 0 method-compatible, 0 parameter-compatible, 0 missing.
|
||||
- `/api/v1/widget` stubs are burned down and public inbox/contact/conversation/message core flows are backed by real handlers.
|
||||
@@ -69,18 +69,19 @@ This ledger records the committed parity checkpoints that future slices should b
|
||||
| `1c30933 test(webhook): cover whatsapp ingress verification` | Added WhatsApp route-level verification coverage for verify-token challenge echo, signed Cloud API POST persistence, and missing Meta signature rejection without persistence. | Focused webhook tests passed; full `go test ./...` passed. | Continue P6.7 review with Shopify/Twitter final classification. |
|
||||
| `ebd8f08 feat(webhook): finalize provider ingress parity` | Finalized P6.7 provider classification with Twitter CRC prefix parity, Twitter route-level webhook tests, Instagram missing-signature rejection coverage, and Shopify real-handler classification. | Focused webhook/API tests passed; full `go test ./...` passed. | Move next to serializer/API parity queue. |
|
||||
| `56a8c5b feat(profile): align chatwoot user serializer` | Aligned `/api/v1/profile`, profile update, avatar delete/update, availability, auto-offline, and reset-access-token responses to Chatwoot's raw `api/v1/models/_user.json.jbuilder` shape. Added user/account/account_user fields and personal access-token persistence needed by the serializer. | Focused profile/API tests passed; sandboxed `go test ./...` hit socket restrictions; escalated full `go test ./...` passed; `git diff --check` passed. | Continue B2 with `/auth/sign_in`, `/auth/validate_token`, auth headers/cookie contract, and current-user payload fixtures. |
|
||||
| `e59f9f3 feat(auth): add chatwoot session routes` | Added root `/auth/sign_in`, `/auth/validate_token`, `/auth/sign_out`, and `/auth/password` routes consumed by the reused Chatwoot frontend. Sign-in now emits DeviseTokenAuth-compatible `access-token`, `token-type`, `client`, `expiry`, and `uid` headers and returns raw `{ data: user }`; validate-token returns `{ payload: { success, data } }`. | Focused auth/profile tests passed; route dump regenerated with `TOTAL: 805`; route parity remained `251 exact, 0 missing`; escalated full `go test ./...` passed; `git diff --check` passed. | Continue B2 with profile settings update parity: `display_name`, `message_signature`, `ui_settings`, password update, and multipart avatar handling. |
|
||||
|
||||
## Next Slice Contract
|
||||
|
||||
Completed implementation slice: B2 profile-side serializer parity now returns the Chatwoot raw user payload for profile reads and mutations.
|
||||
|
||||
Next implementation slice: continue Q4/B2 serializer parity fixtures for auth/session and current-user validation, then move to conversations/messages.
|
||||
Next implementation slice: continue Q4/B2 profile settings serializer parity, then move to conversations/messages.
|
||||
|
||||
| Step | Required result | Reference source | Verification |
|
||||
| --- | --- | --- | --- |
|
||||
| N1 | Add Chatwoot auth route aliases and response fixtures for `/auth/sign_in`, `/auth/sign_out`, `/auth/validate_token`, and password routes used by the reused frontend. | `reference/chatwoot/app/controllers/devise_overrides/*`, `reference/chatwoot/app/views/devise/_auth.json.jbuilder`, frontend `api/auth.js`. | Handler tests assert token headers, body shape, and current-user validation payloads. |
|
||||
| N2 | Preserve profile raw user serializer behavior for `/api/v1/profile`, update, availability, auto-offline, avatar, and reset access token. | `reference/chatwoot/app/controllers/api/v1/profiles_controller.rb`, `reference/chatwoot/app/views/api/v1/models/_user.json.jbuilder`. | Existing profile fixtures remain green. |
|
||||
| N3 | Move next serializer fixtures to conversations/messages once auth/session is compatible with the frontend cookie/header contract. | Chatwoot conversation/message Jbuilder views and frontend stores. | Fixture tests for list/show/create/status/assignment payloads. |
|
||||
| N1 | Complete profile settings update parity for `display_name`, `message_signature`, `ui_settings`, password update, and frontend multipart profile form handling. | `reference/chatwoot/app/controllers/api/v1/profiles_controller.rb`, frontend `api/auth.js`. | Handler tests assert persisted settings and raw user serializer response. |
|
||||
| N2 | Preserve auth/session route aliases and response fixtures for `/auth/sign_in`, `/auth/sign_out`, `/auth/validate_token`, and password routes used by the reused frontend. | `reference/chatwoot/app/controllers/devise_overrides/*`, `reference/chatwoot/app/views/devise/_auth.json.jbuilder`, frontend `api/auth.js`. | Existing auth fixture tests remain green. |
|
||||
| N3 | Move next serializer fixtures to conversations/messages after profile settings is compatible with the frontend store contract. | Chatwoot conversation/message Jbuilder views and frontend stores. | Fixture tests for list/show/create/status/assignment payloads. |
|
||||
| N4 | Regenerate route artifacts only if routes change; otherwise preserve `TOTAL: 801` and tracked route zero-missing status. | `cmd/dump_routes`, `cmd/route_parity`. | Route commands run when applicable. |
|
||||
| N5 | Update this tracker after every implementation checkpoint. | This document. | `git diff --check`; `go test ./...` for Go changes. |
|
||||
|
||||
@@ -91,6 +92,7 @@ Current B2 profile checkpoint:
|
||||
- Availability and auto-offline endpoints now return the full current-user serializer, matching frontend store expectations.
|
||||
- User creation now assigns a `pubsub_token` like Chatwoot's `Pubsubable` concern, avoiding duplicate empty token rows and enabling ActionCable-compatible profile payloads.
|
||||
- Added migration `000017_add_profile_serializer_fields` for profile serializer fields on users, accounts, and account_users.
|
||||
- Added Chatwoot root auth/session routes. `/auth/sign_in` now accepts normalized email/password login, emits the auth headers stored by frontend `cw_d_session_info`, and returns the profile serializer under `data`. `/auth/validate_token` validates the same `access-token` header and returns the frontend-expected `payload.data` shape. `/auth/sign_out` revokes the refresh session.
|
||||
|
||||
## Immediate Execution Queue
|
||||
|
||||
@@ -141,7 +143,7 @@ Work proceeds top-down unless a failing test or frontend blocker forces a narrow
|
||||
| Slice | Work | Reference source | Verification | Status |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| B1 | Webhook ingress route and handler parity. | `reference/chatwoot/config/routes.rb:614-624`, `reference/chatwoot/app/controllers/webhooks/*`, `reference/chatwoot/app/controllers/api/v1/webhooks_controller.rb` | Provider lookup tests, router route dump, `go test ./...`. | Done |
|
||||
| B2 | Auth/profile serializer fixtures. | `reference/chatwoot/app/controllers/api/v1/profile*`, frontend auth client. | Fixture tests for login/current user/profile/availability/settings. | Doing: profile serializer fixtures done; auth/session aliases and validate-token remain. |
|
||||
| B2 | Auth/profile serializer fixtures. | `reference/chatwoot/app/controllers/api/v1/profile*`, frontend auth client. | Fixture tests for login/current user/profile/availability/settings. | Doing: profile serializer and auth/session fixtures done; profile settings/password/multipart avatar remain. |
|
||||
| B3 | Conversation/message serializer and behavior fixtures. | Chatwoot conversation/message controllers, entities, jobs. | Fixture tests for list/show/create/update/private notes/attachments/status/assignment. | Todo |
|
||||
| B4 | Contact/company behavior fixtures. | Chatwoot contact/company controllers, merge/import/export/notes/labels. | Fixture tests for CRUD/search/merge/relation/import-export shells. | Todo |
|
||||
| B5 | Inbox/channel behavior fixtures. | Chatwoot inbox/channel controllers and channel models. | Fixture tests for inbox CRUD, settings, business hours, members, avatar, channel config. | Todo |
|
||||
|
||||
Reference in New Issue
Block a user