parity(apps+api): complete_profile in both apps [ref: henza_server Major/CustomerController::complete]
Ports "تکمیل پروفایل" end to end (D22). API - POST customer/me/complete-profile — three required document ids, the customer taken from the token, verification step set to the reference's LIVE value (approved outright; its `= 1` line is commented out at :83 in favour of `= 2` at :85). Both SMS messages byte-identical and non-blocking per D20. - POST customer/me/documents — the reference let the app upload through the same file/create the admin used, inside its auth:api-customer group (routes/api.php:95); the target's copy is admin-guarded, so the page could not have uploaded at all. Reuses AdminUploadsService unchanged, so both paths share one size limit, MIME whitelist and naming scheme (UPL-01). - PROFILE_ADMIN_MOBILES replaces the reference's four hardcoded personal numbers; blank means nobody is notified and the upload still succeeds. Three reference behaviours deliberately NOT ported, all in ISSUES.md: - SEC-14: `$customer->update($request->all())` mass-assigned the whole request body, letting the app write its own credit limit, making charge, gold debt, active flag or mobile. Replaced with a three-field whitelist. - SEC-15: four real personal mobiles hardcoded in the source. - APP-03: refresh()'s unterminated setInterval page reload. Apps (both, template+script byte-identical, per-app styling only) - CompleteProfileView + SingleImageUploader - route /complete_profile, redirecting home once the documents are in, as the reference's guard did (router/index.ts:266) - the entry point on the profile screen, shown only while they are missing (profile.vue:96-102) Also (D23): JWT_CUSTOMER_SECRET now warns loudly at boot when unset. It falls back to JWT_SECRET, which signs app and admin tokens with the same key and leaves the `typ` check as the only barrier — and an expert's app token carries their AdminUser id in `sub`. Warn rather than refuse to boot (D19, lowest risk); DELIVERY.md lists it as the first pre-release step (REL-03). Verified: build 5/5 · jest 45/45 · complete-profile 38/38 (new) · expert login 36/36 · apps smoke 43/43 · admin smoke 43/43 · B2B scan 34 ok/0 broken · typecheck clean on all four apps. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
s.esmaeili
co-authored by
Claude Opus 5
Claude Opus 5
parent
f71fd5bfe1
commit
5ad1083aee
+17
-5
@@ -8,14 +8,23 @@ Both merged with **no conflicts** (`phase-1-admin` already contained
|
||||
|
||||
---
|
||||
|
||||
## ⚠ Before the real release — do these two things
|
||||
## ⚠ Before the real release — do these three things
|
||||
|
||||
1. **Remove `OTP_MASTER_CODE` from the environment.** While it is set, **any
|
||||
1. **Set `JWT_CUSTOMER_SECRET` to its own random value.** This one is a real
|
||||
security boundary, not a default. If it is unset, the API signs customer and
|
||||
sales-expert **app** tokens with `JWT_SECRET` — *the same key admin tokens
|
||||
use* — so the two token realms stop being cryptographically separate. The
|
||||
only thing still keeping an app token off the admin routes is the `typ`
|
||||
check in `jwt.strategy.ts`, and a sales expert's app token carries their
|
||||
**AdminUser id** in `sub`. Two independent defences become one. The API
|
||||
prints a loud banner at boot while it is missing. Tracked as **REL-03
|
||||
(Critical)**.
|
||||
2. **Remove `OTP_MASTER_CODE` from the environment.** While it is set, **any
|
||||
active customer can sign in with that one fixed code**. Unset or empty
|
||||
disables it completely, and the API prints a warning banner at boot for as
|
||||
long as it is armed. Tracked as **REL-01 (Critical)** in
|
||||
`docs/parity/ISSUES.md`.
|
||||
2. **Configure the SMS credentials** (`SMS_TREZ_*`). Until then no customer can
|
||||
3. **Configure the SMS credentials** (`SMS_TREZ_*`). Until then no customer can
|
||||
receive a real login code — messages are written to the log instead of sent.
|
||||
Tracked as **REL-02**.
|
||||
|
||||
@@ -34,7 +43,7 @@ container.
|
||||
| `DATABASE_URL` | PostgreSQL connection string. Inside Docker the host is `db`. |
|
||||
| `POSTGRES_USER`, `POSTGRES_PASSWORD`, `POSTGRES_DB` | Credentials for the bundled `db` service. |
|
||||
| `JWT_SECRET` | Signs **admin** tokens. Without it the API falls back to a well-known development string — set it. |
|
||||
| `JWT_CUSTOMER_SECRET` | Signs **customer** tokens. Deliberately separate from `JWT_SECRET` so an admin token can never validate as a customer token. |
|
||||
| `JWT_CUSTOMER_SECRET` | Signs **customer and sales-expert app** tokens. Must be its own value — see the warning at the top of this file. Unset, it falls back to `JWT_SECRET` and the two token realms merge. |
|
||||
|
||||
### Optional
|
||||
|
||||
@@ -47,6 +56,7 @@ container.
|
||||
| `ADMIN_PANEL_PORT`, `USER_APP_PORT`, `USER_APP_V2_PORT` | 5180–5182 | Dev servers only. |
|
||||
| `RUN_MIGRATIONS` | `true` | Set `false` to skip the boot-time migration run. |
|
||||
| `RUN_SEED` | `true` | Set `false` to skip seeding. |
|
||||
| `PROFILE_ADMIN_MOBILES` | *(blank)* | Comma-separated admin mobiles told when a customer completes their profile. The reference hardcoded four numbers; blank means nobody is notified and the upload still succeeds. |
|
||||
|
||||
### SMS — all optional; blank means "log, do not send"
|
||||
|
||||
@@ -141,6 +151,8 @@ All green on `release/delivery`:
|
||||
| `smoke-admin-b2b-writes.cjs` — order + document writes | **25/25** |
|
||||
| `auth-smoke.sh` — permissions/401/403 | **32/32** |
|
||||
| `test-sales-expert-roundtrip.cjs` | **33/33** |
|
||||
| `test-sales-expert-app-login.cjs` — expert app login (D21) | **36/36** |
|
||||
| `test-complete-profile.cjs` — «تکمیل پروفایل» | **38/38** |
|
||||
| `test-name-trigger.cjs` | **9/9** |
|
||||
| typecheck (api, admin-panel, user-app, user-app-v2) | ✅ clean |
|
||||
|
||||
@@ -173,7 +185,6 @@ priority order:
|
||||
| Page | Reference | Notes |
|
||||
|---|---|---|
|
||||
| `report` + `report/detail` | `henza_pwa/src/views/report/` | The accounting statement — a store plus two components (`Accounting.vue`, `AccountingDetail.vue`). The largest of the four. |
|
||||
| `completeProfile` | `.../completeProfile.vue` | No trace in the target — no page and no route. |
|
||||
|
||||
### Delivered tonight
|
||||
|
||||
@@ -183,6 +194,7 @@ priority order:
|
||||
| **«سفارش مشتریان» (ChildOrder)** | ✅ Done in both apps. Their referred customers' orders at «تحویل مسئول فروش», searchable, infinite-scrolled. |
|
||||
| **«مشتریان من» (customerChoice)** | ✅ Done in both apps. Their referred customers, searchable, with a read-only detail sheet. |
|
||||
| **APP-02 — admin home slider in v2** | ✅ Fixed. v2 now prefers admin-configured slides and keeps its category-derived hero as the fallback. |
|
||||
| **«تکمیل پروفایل» (complete_profile)** | ✅ Done in both apps. Three document uploads (جواز کسب، سردر مغازه، کارت ملی), then the profile is marked verified. Reached from the profile screen, and only while the documents are missing — exactly the reference's condition. |
|
||||
|
||||
An expert's own order lands on their **own trading account**, with the making
|
||||
charge from `AdminUser.wagePercent` and the credit limit from
|
||||
|
||||
Reference in New Issue
Block a user