# vitanovaPackages

Shared client packages consumed by `marketplaces` and other projects.

- `packages/auth` — `@marketplaces/auth`. Standalone Angular UI + gateway for QR, credentials and Yandex auth.
- `packages/payment` — `@marketplaces/payment`. Standalone Angular UI + gateway for QR, card, SBP and Yandex Pay.

The packages call separate central services. They never derive or call the tenant API. Each request automatically includes the page hostname as `X-Marketplace-Domain`; central Auth/Payment APIs resolve that domain to the project.

```ts
bootstrapApplication(AppComponent, {
  providers: [
    provideHttpClient(),
    provideMarketplacesAuth({ apiUrl: 'https://auth.example.net' }),
    provideMarketplacesPayment({ apiUrl: 'https://payments.example.net' }),
  ],
});
```

```html
<mp-auth qr credentials yandex mode="admin"
  (authenticated)="onLogin($event)" />

<mp-payment qr card sbp yandexPay [request]="checkout"
  (completed)="onPaid($event)" />
```

Import `MarketplacesAuthComponent` / `MarketplacesPaymentComponent` into the consuming standalone component. See `docs/BACKEND-CONTRACT.md` for central API and CORS requirements.

### Admin credentials login

`<mp-auth credentials mode="admin">` already posts `{login, password, mode}` to `credentialsPath`. `AdminAuthService.loginWithCredentials()` is a convenience wrapper for apps building their own login screen instead of the built-in component — it calls the gateway and activates the resulting session in one step:

```ts
export class MyAdminLoginComponent {
  private readonly adminAuth = inject(AdminAuthService);

  submit(login: string, password: string) {
    this.adminAuth.loginWithCredentials({ login, password }).subscribe({
      next: () => this.router.navigateByUrl('/admin'),
      error: (failure: AuthFailure) => {
        if (failure.code === 'invalid_credentials') this.error = 'Wrong login or password.';
        else if (failure.code === 'rate_limited') this.error = `Too many attempts, retry in ${failure.retryAfterSeconds ?? 60}s.`;
        else this.error = failure.message;
      },
    });
  }
}
```

The package has no notion of who the account is — it carries `{login, password}` to the backend exactly like any other admin login and stores whatever session/tokens come back. There is nothing to configure for a "superadmin" or any other privileged account: that decision (which login is special, what tenant to scope the resulting session to, audit logging) is entirely server-side. No password, username, or secret is ever hardcoded in this package.

Consumer documentation lives in the `marketplaces` repo: `docs/PACKAGES-USAGE.md`. Rationale: `docs/context/adrs/ADR-0001-extract-auth-and-payment-into-shared-marketplaces-packages.md`.

## Installing (no registry, no token)

Each package is published to a **release branch** where the repo root *is* the package, so npm can install it straight over git:

```json
{
  "dependencies": {
    "@marketplaces/auth": "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#release/auth",
    "@marketplaces/payment": "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#release/payment"
  }
}
```

No npm registry, no auth token, no SSH tunnel, no CI secret. Anonymous git read is all that's required — a fresh clone plus `npm install` works on any machine and any CI runner.

`release/auth` and `release/payment` are **generated**. Never commit to them by hand; they are force-pushed on every release.

## Layout

npm workspaces monorepo. Each package builds standalone with `tsc` to `dist/`.

```bash
npm ci
npm run build     # all workspaces
npm test          # all workspaces
```

Angular and rxjs are `peerDependencies`, so the consuming app supplies exactly one copy at runtime.

## Making a change

1. Edit under `packages/<name>/src`, export from `index.ts`.
2. `npx changeset` — pick the package and bump type, write one line. CI rejects PRs without one.
3. Open a PR against `main`. `ci.yml` builds, tests, and verifies the changeset exists.
4. On merge, `release.yml` rebuilds and force-pushes the release branches, and opens a "Version Packages" PR if there are unreleased changesets. Merging that PR bumps versions and triggers another release.
5. In the consuming project, run `npm update @marketplaces/auth` (git deps track the branch tip, so pin to a tag or commit SHA instead of the branch if you need reproducible installs).

### Pinning

Branch refs move. For reproducible builds, pin to a commit:

```
git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#<commit-sha>
```

`marketplaces` currently tracks `#release/auth` (branch tip) — deliberate while the package churns, worth pinning once it stabilises.

## Workflow syntax

`ci.yml` / `release.yml` are GitHub Actions. Gitea/Forgejo Actions are compatible. Other CI needs translating — the steps are just: install, build, test, force-push a branch.

## A private npm registry also exists

A Verdaccio instance runs on the dev server (`213.21.246.138:4873`, Docker container `verdaccio`, storage `/srv/marketplaces/verdaccio/`) and holds `@marketplaces/auth@0.1.0` and `@marketplaces/payment@0.1.0`. It is **not** the path anything uses today — it is only reachable from the server itself or through an SSH tunnel, which is exactly why the git-branch approach above exists. Keep it or delete it; nothing depends on it.