docs/BACKEND_API.md no longer exists as a live file (merged into
BACKEND.md in an earlier consolidation pass, per that doc's own intro
- only docs/archive/BACKEND_API.md remains, historical only). This
mission's "update BACKEND_API.md" instruction is fulfilled by
extending the doc that actually supersedes it: new §11 "Seller
Management (Optional Capability)", added to the top-of-file table of
contents, no existing section renumbered or altered.
Every subsection explicitly tagged Implemented / Planned / Future,
matching the same legend used in docs/architecture/foundation/
Seller-Management.md (the frontend-side capability doc this section
is the backend counterpart to):
- 11.2 Future entities: Marketplace (Implemented, existing
TenantConfig unchanged), Seller/SellerBranding (Planned - frontend
types exist, no backend schema), SellerUser/SellerSettings/
SellerInvitation (Future - no type, no concept, named for roadmap
completeness only).
- 11.3 Future endpoints: Seller CRUD/Activation/Invitations/Branding/
Analytics/Dashboard - all Future, none designed, each noted as
following the existing mock-to-API-gateway pattern (SS8) once built.
- 11.4 Authentication: SellerPermissionRole (4 roles) explicitly
flagged as a separate vocabulary from the existing, live AdminRole -
not merged, no guard wired, zero auth change.
- 11.5 Domain resolution: market.com -> Marketplace is Implemented
today (ADR-001, backend-Host-resolved); nike.market.com -> Marketplace
-> Seller is Future, no backend resolves it - and per the storefront
audit, needs no frontend routing change once it does.
- 11.6 Bootstrap additions: modules/modules.sellerManagement documented
as Implemented-as-contract (typed, always false/absent today);
sellerScope/sellerBranding as Planned with an explicitly flagged open
question (SellerConfig vs SellerBranding nesting not reconciled);
permissions noted as existing/unrelated today.
- 11.7 Checkout modes: Unified Order vs Split Orders - Future, not
designed, flagged as the single most consequential undecided item
for backend design given payments/refunds/reporting all depend on it.
- 11.8 Product ownership: sellerId? on Item/AdminProduct/AdminOrder -
Implemented as schema only (optional, absent = marketplace-owned,
verified backward-compatible via tsc staying clean). Existing
products remain valid with no migration required - NULL/absent
ownership documented as a permanent state, not transitional.
No backend implemented. No frontend code touched. Documentation only.
Goal: this document alone, pasted into a fresh Claude session, should
be enough for a backend dev to implement against without getting
stuck or inventing conventions the frontend doesn't actually need.
Fixed a real bug: ~65 cross-references throughout the document pointed
to docs/AUTHENTICATION.md, docs/ERROR_CONTRACT.md, docs/MAINTENANCE_MODE.md
- three sibling docs that were deleted and fully merged into this
document's own §4/§6/§10 during the earlier doc-consolidation pass, but
the in-text references were never updated. A fresh agent following
those links would hit dead ends repeatedly. Bulk-replaced with in-
document section references; hand-fixed ~4 sentences that framed §6/
§10 as "sibling task, in progress" (stale - both are complete, this
document's §6/§10 already are the settled contract, nothing to wait on).
Added "Recommended default" to every item across the document's 5
consolidated "Requires backend decision" registers (§2.12 framework,
§3.21 CRUD cross-cutting - 18 items, §4 §12 auth open items - 9 items,
§6 error-model summary - 9 items, §10 maintenance-mode list - 5 items).
Each default is derived from what the frontend already implies or
standard REST/security convention - no invented APIs or business
rules. ~6 items are explicitly flagged as real business/security
decisions instead (order state-machine rules, Ed25519 cutover
strategy, refresh-token reuse-detection posture) since those carry
consequences no amount of frontend-code-reading can resolve.
Added a "How to use this document" preamble up front: work in §9's
dependency order not document order, apply recommended defaults and
keep moving, only stop for the explicitly-flagged business/security
items, don't invent beyond what's written or directly implied.
Frontend side: confirmed nothing else is left. docs/TODO.md already
has zero blockers; docs/KNOWN-ISSUES.md's one open item (unreachable
Ed25519 error-code UI) is correctly left open and documented rather
than faked closed - fixing it needs a real backend emitting real
distinguishable error codes, which doesn't exist yet and can't be
fabricated without inventing an API contract.
No frontend code touched. No architecture changed. No APIs invented.
Reviewed BACKEND.md top to bottom (4775 lines, 10 sections) against
the full backend-handoff checklist (auth, bootstrap, every endpoint,
media, all domains, pagination/filter/sort/search, error contract,
maintenance mode, status codes, versioning, rate limits, CORS,
security, websocket/events, mock-to-api migration).
Confirmed already covered, no action: Authentication (§4, all
sub-items), Bootstrap (§1, full), every domain's CRUD contract (§3.1-
3.20, includes Moderation under 3.17.b), Media (§7), SEO (bootstrap
SeoConfig + per-page seo + sitemap tracked as remaining work), Error
Model (§6), Maintenance Mode (§10), Migration guide (§8).
Added (genuine gaps, not covered anywhere in the doc):
- §2.10 API path versioning - no endpoint has a version segment/header
anywhere; only BootstrapConfig.schemaVersion exists and that only
versions the bootstrap payload shape, not the API surface. Flagged
as a backend/infra decision with zero frontend impact either way.
- §2.11 Real-time/WebSocket - confirmed no WebSocket/SSE exists
anywhere in the frontend; consolidated the 5 places that look "live"
(QR/Telegram login, payment status, session validity, maintenance
notice, admin monitoring) into one table, all client-side polling.
Flagged push-vs-poll as a backend decision, most relevant to payment
latency and the session-revocation propagation delay.
- Renumbered the section's "Consolidated requires-backend-decision"
list 2.9 -> 2.12 (moved after the two new subsections, no other
content changed) and added both new items to it. No other §2.x
cross-references existed elsewhere in the doc to update.
No duplication found requiring merge; docs/archive/BACKEND_API.md
cross-references are intentional (superseded-but-kept historical
detail, per the doc's own stated design), not obsolete/duplicate
content.
Audited every *.md in docs/ and root. Merged five overlapping backend
docs (BACKEND_INTEGRATION.md + AUTHENTICATION.md + ERROR_CONTRACT.md +
MAINTENANCE_MODE.md + the already-archived BACKEND_API.md/
BACKEND_API_REMAINING_WORK.md) into one canonical docs/BACKEND.md
(4775 lines, 10 numbered sections) - deleted the four standalone
files outright now that their content is fully inlined.
Archived (not deleted - real historical value): ADMIN.md (Sprint
19-28 build log, sprint-report-shaped, not a living reference) and
FRONTEND-ROADMAP.md (despite its name, a shipped-history changelog
with detail no other doc has - not a forward roadmap, so keeping it
in root alongside NEXT_PHASE.md was exactly the "10 roadmaps"
confusion being cleaned up).
Deleted outright (zero value): SPRINTS.md - a leftover copy-pasted
sprint-kickoff prompt saved as a file, not documentation.
Rewrote docs/PROJECT_STATUS.md with completion-percentage estimates
per area (frontend/backend/UI/admin/storefront) and an explicit
first-customer-readiness call. Rewrote docs/NEXT_PHASE.md to the
strict 5-phase structure (backend integration -> production testing
-> performance -> monitoring -> v2 ideas), pointing to PRODUCT_BACKLOG
.md/FUTURE_FEATURES.md for phase 5 detail instead of duplicating it.
Rewrote root README.md - was stale (referenced deleted pages/info,
pages/legal folders from a prior RC pass), now covers architecture,
frontend/backend status, how to run, mock<->API switch mechanism
(useMockData in environment.ts), current folder structure, and a
documentation map.
Updated docs/PROJECT_INDEX.md (the stated entry point) to link only
the surviving doc set - every remaining document is reachable from it.
Fixed every broken/stale cross-reference to the deleted/renamed
backend docs across ARCHITECTURE.md, EDITOR.md, FRONTEND.md,
PROJECT-STRUCTURE.md, StaticPages.md, KNOWN-ISSUES.md (10 individual
link fixes, verified by repo-wide grep before and after). Left
CHANGELOG.md's two historical entries untouched - changelogs are
append-only history, not live navigation, editing past entries would
misrepresent what was true at the time.
Not touched (explicitly out of scope): docs/architecture/foundation/**
(enforced ADRs/governance, permanent not sprint-shaped),
docs/context/** (Barry Cache infrastructure, "do not edit by hand"
per CLAUDE.md), .claude/worktrees/** (separate git worktrees
containing an unrelated project's docs, not this repo's documentation).
docs/ root: 22 files -> 16. Plus 5 in docs/archive/ (was 3).
Completes the rest of Sprint 28 on top of the earlier admin-scoped
a11y/skeleton pass (576f260):
- SeoService.resetToDefaults() now reads real bootstrap.seo.default /
branding instead of hardcoded placeholder text + a broken
/og-image.jpg reference; auto-reapplies via an effect() whenever
bootstrap (re)loads, same pattern as UiRuntimeFacade.
- New public/sitemap.xml (static baseline, documented per-tenant-dynamic
limitation) + public/robots.txt Sitemap directive and admin/editor
Disallow rules.
- Global prefers-reduced-motion override in styles.scss covering every
existing hover-transform/fade-in/shimmer animation in one place.
- New adminProducts/adminUsers/adminMonitoring/adminAnalytics
empty-state i18n keys (en/ru/hy) for this sprint's skeleton/empty-state
consistency fixes.
- docs/KNOWN-ISSUES.md: logged a newly-found, much larger pre-existing
gap (~178 missing adminXxx.* i18n keys across the whole admin
backoffice) - deferred to Sprint 29's translation validation, not
fixed here.
- docs/BACKEND.md: new item 17 (sitemap generation gap).
- docs/ADMIN.md, docs/SPRINT-PLAN.md: rewritten Sprint 28 sections to
describe the full, combined scope (both commits) instead of the
earlier admin-only framing.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Sprint 27.
New features/admin/analytics/ module + net-new /:lang/backoffice/analytics
route + Dashboard Quick Action.
- revenue/orders/avg-order-value/sales-over-time/top-products computed by
composing AdminOrdersLocalGateway (Sprint 23's seeded mock orders) - real
aggregation over mock data, not a separate fabricated dataset
- products/categories counts from AdminProductsLocalGateway/
AdminCategoriesLocalGateway
- visitors/funnels/heatmaps render pending-backend badges (no analytics
pipeline exists anywhere in this system) rather than fabricated numbers,
same convention as the Sprint 19 dashboard's pre-Sprint-23 Orders/Revenue
cards
- plain div-bar chart (no charting library), 7/30/90-day range toggle,
CSV export
docs/ADMIN.md + docs/BACKEND.md (new item 16) updated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Sprint 26.
New features/admin/monitoring/ module + net-new /:lang/backoffice/monitoring
route + Dashboard Quick Action.
- Health section reuses AdminDashboardFacade.healthChecks directly (real
data, unchanged since Sprint 19) instead of duplicating the logic
- unified AdminMonitoringEvent feed covering audit/security/login/
failed-login/api/error/warning, category filter + search, 40 seeded
synthetic entries (no logging backend exists anywhere in this system)
- mock queue depth/status cards, mock webhook delivery log
- intentionally kept separate from Sprint 24's per-transaction audit and
Sprint 25's per-user audit - different scopes, no consolidation attempted
Also fixed a real type error: AdminDashboardQuickActionId's union was
missing 'users' and 'monitoring' (added when wiring those Quick Actions),
caught by ng build's template type-checking even though plain tsc --noEmit
passed - a reminder that ng build is the authoritative check here.
docs/ADMIN.md + docs/BACKEND.md (new item 15) updated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Sprint 25.
New features/admin/users/ module, net-new /:lang/backoffice/users route +
Dashboard Quick Action.
- users: name, Telegram username, scope (marketplace vs office admin),
role (inline change), status (active/invited/suspended), last login
- 4 built-in roles (owner/admin/editor/viewer) with flat permission lists
- invitations: email + role + scope form, pending list + revoke (no email
actually sends - local record only)
- passwordless login confirmed already real (AdminAuthService Telegram QR,
docs/BACKEND.md item 1) - linked, not reimplemented
- per-user mock session list (device/IP/last-active, revoke) - flagged as
mock since the real AdminAuthService only ever tracks the current
browser's session
- per-user audit log dialog (role/status changes), same pattern as
Sprint 24's per-transaction audit, intentionally separate from the
system-wide log planned for Sprint 26
docs/ADMIN.md + docs/BACKEND.md (new item 14) updated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Sprint 24.
New features/admin/transactions/ module. AdminTransactionsLocalGateway
derives one synthetic transaction per Sprint 23's seeded mock order rather
than a separate dataset, keeping order numbers/totals consistent across
the two mock feature areas.
- list: search, status filter, type filter (payment/refund/qr_payment),
pagination, CSV export
- retry failed transactions (appends an audit entry)
- fraud flag toggle
- per-transaction audit log (creation/retry/fraud-flag-change), viewed via
dialog - intentionally separate from the system-wide audit/security log
planned for Sprint 26 (Monitoring)
- wired into /:lang/backoffice/transactions, replacing the coming-soon
placeholder
docs/ADMIN.md + docs/BACKEND.md (new item 13) updated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Sprint 23.
New features/admin/orders/ module, same container/facade/service split as
admin/products and admin/categories.
- AdminOrder model + AdminOrdersLocalGateway seeding 24 deterministic
synthetic orders (no real order data source exists anywhere in this
repo - explicitly a placeholder, not a mock of production volume)
- list: search, status filter, pagination, CSV export (client-side Blob
download)
- detail: customer/payment/shipping, itemized total, status timeline,
change-status dropdown, refund request + cancel (window.confirm-gated),
separate customer-facing vs internal notes, print invoice via
window.print() with @media print hiding non-invoice chrome
- wired into /:lang/backoffice/orders(/:id), replacing the coming-soon
placeholder
docs/ADMIN.md + docs/BACKEND.md updated; dashboard's Orders/Revenue cards
(Sprint 19) remain intentionally un-wired to this mock and still render
pending-backend.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Sprint 21.
- archived (soft archive/restore, distinct from visible) with an
include-archived list filter
- barcode field alongside sku
- variants: lightweight name|price|quantity list, same textarea-parse
convention as specifications/attributes
- relatedProductIds: checkbox picker in the editor
- gallery images now added/removed via the shared MediaPickerComponent
instead of a raw URL textarea
- read-only discounted-price preview in the editor
- infinite-scroll toggle on the list (loadMore() appends a page instead
of replacing it; pagination UI swaps for a Load more button)
- category dropdown now sourced from AdminCategoriesGateway (Sprint 20)
instead of AdminProductsLocalGateway's own BackofficeDataService seed
docs/ADMIN.md + docs/BACKEND.md updated with the new field list and the
known trade-off that related-products search is scoped to the currently
loaded page, not the full catalog.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Sprint 20. Adds features/admin/categories/ (model, gateway interface +
local gateway, facade, list/editor pages), mirroring the admin/products
container/facade/service split.
- indented hierarchy view + native HTML5 drag-and-drop reorder
- visibility toggle, item counter, empty state, include-deleted filter
- editor: slug uniqueness validation, translations, SEO fields, breadcrumb
preview, image via existing MediaPickerComponent
- soft delete/restore, blocked when a category has children or items
- draft/publish status + localStorage draft recovery (mirrors Project
Editor autosave) + CanDeactivate unsaved-changes guard
- wired into app.routes.ts (replaces the categories coming-soon placeholder)
- docs/ADMIN.md + docs/BACKEND.md updated with the new gap detail
Not yet done: admin/products' category dropdown still reads from its own
AdminProductsGateway.loadCategories() rather than this gateway (Sprint 21).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Replace ~35 organically-grown docs (docs/platform/*, docs/backend-platform/*,
one-off sprint reports, Search.md, Diagnostics.md, Content-Management.md,
Backend-Handoff-Sprint16.md, docs/superpowers/*, docs/Project-Editor.md,
untracked docs/total.md) with the six canonical docs declared in
.claude/CLAUDE.md: PROJECT.md, ARCHITECTURE.md, BACKEND.md, FRONTEND.md,
BOOTSTRAP.md, EDITOR.md, plus a new PROJECT-STRUCTURE.md.
- BACKEND.md is a punch list per domain (auth, bootstrap draft/publish,
static pages, categories, products, orders, dashboard metrics, activity,
translations, search, product engagement) plus a Known reliability issues
section on the prod 502/504 root cause.
- ARCHITECTURE.md links to (does not duplicate) the enforced
docs/architecture/foundation/** ADRs and standards docs.
- docs/ADMIN.md and docs/architecture/foundation/** and docs/context/** are
left untouched per instructions.
- Updated the one dangling docs/Project-Editor.md reference in
admin-auth.service.ts to point at docs/BACKEND.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
