sdarbinyan/marketplaces
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): clarify admin login flow
Some checks failed
Architecture Governance / architecture (push) Has been cancelled
Details
Deploy Frontend / deploy (push) Has been cancelled
Details

Browse Source 
Use admin-specific Telegram copy and define the missing credential API. Replace predictable bootstrap passwords with random one-time secrets.
This commit is contained in:
sdarbinyan
2026-08-21 07:39:30 +04:00
parent 14d46ceaa6
commit 98c39f6844
8 changed files with 125 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/backend/BACKEND-HANDOFF.md
View File

@@ -79,7 +79,7 @@ Nothing here is done yet — this is the setup a backend dev does on day one.
4. Implement the **bootstrap config endpoint** (§1a) — without it the frontend cannot render for any tenant.
5. Implement the Telegram session endpoints — the login flow is fully built client-side and blocked only on these.
6. Implement `GET /api/identity/v1/session/permissions` ([TRACK-S §2](TRACK-S-SECURITY-RBAC-CONTRACT.md)) — frontend route guards derive from it.
7. Seed per-marketplace bootstrap admins ([TRACK-S §8](TRACK-S-SECURITY-RBAC-CONTRACT.md)): login = marketplace slug, password = `{slug}2026$`, `mustChangePassword: true`.
7. Seed per-marketplace bootstrap admins ([TRACK-S §8](TRACK-S-SECURITY-RBAC-CONTRACT.md)): login = marketplace slug, cryptographically random one-time password delivered out of band, `mustChangePassword: true`.
Steps 4–6 unblock the entire frontend. Everything after is feature work.