From a88b49bb04c0db1151b0a4f15ed76a40de520f1e Mon Sep 17 00:00:00 2001 From: Rogee Date: Fri, 5 Jun 2026 01:18:56 +0800 Subject: [PATCH] docs: record auth session parity checkpoint --- docs/CHATWOOT_PARITY_DEVELOPMENT_PLAN.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/docs/CHATWOOT_PARITY_DEVELOPMENT_PLAN.md b/docs/CHATWOOT_PARITY_DEVELOPMENT_PLAN.md index 970bab75..27ccc0c6 100644 --- a/docs/CHATWOOT_PARITY_DEVELOPMENT_PLAN.md +++ b/docs/CHATWOOT_PARITY_DEVELOPMENT_PLAN.md @@ -16,10 +16,10 @@ Build GoChat as a Go backend that can directly reuse the frontend from `referenc ## Current Baseline -- Latest implementation checkpoint: `56a8c5b feat(profile): align chatwoot user serializer`. +- Latest implementation checkpoint: `e59f9f3 feat(auth): add chatwoot session routes`. - Worktree status at this planning checkpoint: clean. - `go test ./...` passes. -- Route dump succeeds with `TOTAL: 801` after Chatwoot webhook ingress routes were added. +- Route dump succeeds with `TOTAL: 805` after Chatwoot root auth/session routes were added. - Route parity artifacts now exist under `docs/parity/` and are generated by `cmd/route_parity`. - Tracked frontend-critical route audit covers 251 Chatwoot routes: 251 exact, 0 method-compatible, 0 parameter-compatible, 0 missing. - `/api/v1/widget` stubs are burned down and public inbox/contact/conversation/message core flows are backed by real handlers. @@ -69,18 +69,19 @@ This ledger records the committed parity checkpoints that future slices should b | `1c30933 test(webhook): cover whatsapp ingress verification` | Added WhatsApp route-level verification coverage for verify-token challenge echo, signed Cloud API POST persistence, and missing Meta signature rejection without persistence. | Focused webhook tests passed; full `go test ./...` passed. | Continue P6.7 review with Shopify/Twitter final classification. | | `ebd8f08 feat(webhook): finalize provider ingress parity` | Finalized P6.7 provider classification with Twitter CRC prefix parity, Twitter route-level webhook tests, Instagram missing-signature rejection coverage, and Shopify real-handler classification. | Focused webhook/API tests passed; full `go test ./...` passed. | Move next to serializer/API parity queue. | | `56a8c5b feat(profile): align chatwoot user serializer` | Aligned `/api/v1/profile`, profile update, avatar delete/update, availability, auto-offline, and reset-access-token responses to Chatwoot's raw `api/v1/models/_user.json.jbuilder` shape. Added user/account/account_user fields and personal access-token persistence needed by the serializer. | Focused profile/API tests passed; sandboxed `go test ./...` hit socket restrictions; escalated full `go test ./...` passed; `git diff --check` passed. | Continue B2 with `/auth/sign_in`, `/auth/validate_token`, auth headers/cookie contract, and current-user payload fixtures. | +| `e59f9f3 feat(auth): add chatwoot session routes` | Added root `/auth/sign_in`, `/auth/validate_token`, `/auth/sign_out`, and `/auth/password` routes consumed by the reused Chatwoot frontend. Sign-in now emits DeviseTokenAuth-compatible `access-token`, `token-type`, `client`, `expiry`, and `uid` headers and returns raw `{ data: user }`; validate-token returns `{ payload: { success, data } }`. | Focused auth/profile tests passed; route dump regenerated with `TOTAL: 805`; route parity remained `251 exact, 0 missing`; escalated full `go test ./...` passed; `git diff --check` passed. | Continue B2 with profile settings update parity: `display_name`, `message_signature`, `ui_settings`, password update, and multipart avatar handling. | ## Next Slice Contract Completed implementation slice: B2 profile-side serializer parity now returns the Chatwoot raw user payload for profile reads and mutations. -Next implementation slice: continue Q4/B2 serializer parity fixtures for auth/session and current-user validation, then move to conversations/messages. +Next implementation slice: continue Q4/B2 profile settings serializer parity, then move to conversations/messages. | Step | Required result | Reference source | Verification | | --- | --- | --- | --- | -| N1 | Add Chatwoot auth route aliases and response fixtures for `/auth/sign_in`, `/auth/sign_out`, `/auth/validate_token`, and password routes used by the reused frontend. | `reference/chatwoot/app/controllers/devise_overrides/*`, `reference/chatwoot/app/views/devise/_auth.json.jbuilder`, frontend `api/auth.js`. | Handler tests assert token headers, body shape, and current-user validation payloads. | -| N2 | Preserve profile raw user serializer behavior for `/api/v1/profile`, update, availability, auto-offline, avatar, and reset access token. | `reference/chatwoot/app/controllers/api/v1/profiles_controller.rb`, `reference/chatwoot/app/views/api/v1/models/_user.json.jbuilder`. | Existing profile fixtures remain green. | -| N3 | Move next serializer fixtures to conversations/messages once auth/session is compatible with the frontend cookie/header contract. | Chatwoot conversation/message Jbuilder views and frontend stores. | Fixture tests for list/show/create/status/assignment payloads. | +| N1 | Complete profile settings update parity for `display_name`, `message_signature`, `ui_settings`, password update, and frontend multipart profile form handling. | `reference/chatwoot/app/controllers/api/v1/profiles_controller.rb`, frontend `api/auth.js`. | Handler tests assert persisted settings and raw user serializer response. | +| N2 | Preserve auth/session route aliases and response fixtures for `/auth/sign_in`, `/auth/sign_out`, `/auth/validate_token`, and password routes used by the reused frontend. | `reference/chatwoot/app/controllers/devise_overrides/*`, `reference/chatwoot/app/views/devise/_auth.json.jbuilder`, frontend `api/auth.js`. | Existing auth fixture tests remain green. | +| N3 | Move next serializer fixtures to conversations/messages after profile settings is compatible with the frontend store contract. | Chatwoot conversation/message Jbuilder views and frontend stores. | Fixture tests for list/show/create/status/assignment payloads. | | N4 | Regenerate route artifacts only if routes change; otherwise preserve `TOTAL: 801` and tracked route zero-missing status. | `cmd/dump_routes`, `cmd/route_parity`. | Route commands run when applicable. | | N5 | Update this tracker after every implementation checkpoint. | This document. | `git diff --check`; `go test ./...` for Go changes. | @@ -91,6 +92,7 @@ Current B2 profile checkpoint: - Availability and auto-offline endpoints now return the full current-user serializer, matching frontend store expectations. - User creation now assigns a `pubsub_token` like Chatwoot's `Pubsubable` concern, avoiding duplicate empty token rows and enabling ActionCable-compatible profile payloads. - Added migration `000017_add_profile_serializer_fields` for profile serializer fields on users, accounts, and account_users. +- Added Chatwoot root auth/session routes. `/auth/sign_in` now accepts normalized email/password login, emits the auth headers stored by frontend `cw_d_session_info`, and returns the profile serializer under `data`. `/auth/validate_token` validates the same `access-token` header and returns the frontend-expected `payload.data` shape. `/auth/sign_out` revokes the refresh session. ## Immediate Execution Queue @@ -141,7 +143,7 @@ Work proceeds top-down unless a failing test or frontend blocker forces a narrow | Slice | Work | Reference source | Verification | Status | | --- | --- | --- | --- | --- | | B1 | Webhook ingress route and handler parity. | `reference/chatwoot/config/routes.rb:614-624`, `reference/chatwoot/app/controllers/webhooks/*`, `reference/chatwoot/app/controllers/api/v1/webhooks_controller.rb` | Provider lookup tests, router route dump, `go test ./...`. | Done | -| B2 | Auth/profile serializer fixtures. | `reference/chatwoot/app/controllers/api/v1/profile*`, frontend auth client. | Fixture tests for login/current user/profile/availability/settings. | Doing: profile serializer fixtures done; auth/session aliases and validate-token remain. | +| B2 | Auth/profile serializer fixtures. | `reference/chatwoot/app/controllers/api/v1/profile*`, frontend auth client. | Fixture tests for login/current user/profile/availability/settings. | Doing: profile serializer and auth/session fixtures done; profile settings/password/multipart avatar remain. | | B3 | Conversation/message serializer and behavior fixtures. | Chatwoot conversation/message controllers, entities, jobs. | Fixture tests for list/show/create/update/private notes/attachments/status/assignment. | Todo | | B4 | Contact/company behavior fixtures. | Chatwoot contact/company controllers, merge/import/export/notes/labels. | Fixture tests for CRUD/search/merge/relation/import-export shells. | Todo | | B5 | Inbox/channel behavior fixtures. | Chatwoot inbox/channel controllers and channel models. | Fixture tests for inbox CRUD, settings, business hours, members, avatar, channel config. | Todo |