bbf12cad33
Some checks failed
Architecture Governance / architecture (push) Has been cancelled
Direct question caught a real gap: "everything is there? payment auth?" The census only grepped src/app/ - auth moved into the external @marketplaces/auth package this session, and its HTTP calls were never captured. Seven real endpoints were silently absent from a doc that called itself "complete": - 3 Telegram QR/session endpoints (POST/GET/DELETE .../users/sessions) - live today, customer and admin login share them, which is exactly why every admin endpoint must independently verify authorization server-side - 4 ed25519 admin challenge/response endpoints - specified in BACKEND-HANDOFF.md §3 and the package's own auth-api.model.ts, but not built server-side. Client shows backend-unavailable until they exist. Added §0.3 stating plainly what actually connects auth to payment: there is no separate payment login. Checkout, order pricing (§20), and partner credentials (§16) each ride on whichever of the two sessions above is active, or on the partner API's own separate signed-request auth (§6 of that contract - unrelated to Telegram/ed25519, already built, not a gap). The real payment gap is §1 (QR/card creation and polling, undocumented anywhere), not auth. Counts corrected: 51->54 specified, 90->97 total. Added item 0 to the action list, ahead of everything else: the ed25519 endpoints are the single most serious open issue named anywhere in docs/backend/, and every other item on the list assumes a working admin session to authorize against. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>