sdarbinyan/marketplaces
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(backend): log live Telegram CORS incident, admin credentials wiring
Some checks failed
Architecture Governance / architecture (push) Failing after 1m28s
Details
Deploy Frontend / deploy (push) Successful in 2m6s
Details

Browse Source 
users.vitanova.network:456/users/sessions 403s every tested origin with
no CORS headers - the only working admin auth path is broken in prod.
Logged in §1.2 and the change log with evidence, plus the frontend's new
POST /api/identity/v1/session wiring (safe to leave in place pre-backend:
every failure surfaces one generic message).
This commit is contained in:
sdarbinyan
2026-08-27 04:05:37 +04:00
parent 80c9978e03
commit c990c10307
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/context/features/platform-vision/FACTS.jsonl
View File

@@ -12,3 +12,4 @@
{"id":"PV-20260818T104400Z-d9e2","subject":"partner-api-credentials","predicate":"are-scoped-by","object":"a single node whose subtree defines authority; we hold only the partner-generated public key, rotation runs on a bounded overlap window and revocation is immediate and irreversible","src":["docs/backend/PARTNER-PROVISIONING-API-CONTRACT.md","docs/backend/TRACK-S-SECURITY-RBAC-CONTRACT.md"],"status":"active","kind":"decision","updated_at":"2026-08-18T10:44:00Z","confidence":"high","tags":["security","credentials","partner"]}
{"id":"PV-20260818T104500Z-a6f7","subject":"checkout-payment-methods","predicate":"already-support","object":"both qr and card end to end in src/app/pages/cart/cart.component.ts (separate create paths and separate status pollers); card is not an outstanding gap","src":["src/app/pages/cart/cart.component.ts","src/app/services/api.service.ts"],"status":"active","kind":"implemented","updated_at":"2026-08-18T10:45:00Z","confidence":"high","tags":["payments","frontend"]}
{"id":"PV-20260820T095500Z-b17e","subject":"tenant-api-routing","predicate":"is-decided-to-use","object":"one runtime-derived API origin per base domain; example.com and store1.example.com both map to api.example.com for bootstrap, auth, legacy, and versioned endpoints","src":["docs/context/adrs/ADR-0005-share-api-host-across-storefront-subdomains.md","src/app/core/config/api-config.service.ts"],"status":"active","kind":"decision","updated_at":"2026-08-20T16:00:00Z","confidence":"high","tags":["architecture","multi-tenant","api","routing","dns"]}
{"id":"AUTH-20260827T000509Z-69a3","subject":"admin login/password form","predicate":"calls","object":"POST /api/identity/v1/session (not yet live; generic error on any failure)","src":["src/app/components/telegram-login/telegram-login.component.ts","docs/backend/BACKEND-INTEGRATION.md"],"status":"active","kind":"implemented","updated_at":"2026-08-27T00:05:09.874Z","confidence":"high"}