2.4 KiB
vitanovaPackages — backend team TODO
Everything here needs a decision or confirmation from whoever owns the central Auth API / Payment API. Nothing in this list can be resolved from the frontend side alone. Hand this file to them directly.
1. Confirm X-Marketplace-Domain CORS support (blocking)
As of 2026-08-23, @marketplaces/auth and @marketplaces/payment send the marketplace domain as a request header (X-Marketplace-Domain) exclusively. The previous query-parameter/body fallback (contextTransport: 'parameter', kept for backends that hadn't allowed the header in CORS preflight) has been removed, not just de-defaulted.
Backend must confirm: both the Auth API and the Payment API allow X-Marketplace-Domain in CORS preflight (Access-Control-Allow-Headers), and reject requests with an unknown/disabled domain in that header. See docs/BACKEND-CONTRACT.md for the full contract.
If either service can't allow that header for some environment (legacy proxy, CDN stripping custom headers, etc.), say so before this ships — the frontend has no fallback for it anymore.
2. @marketplaces/payment version discipline
@marketplaces/payment changed the same way as auth (dropped param-transport) but was never version-bumped past 0.2.0, even though it's a behavior-breaking change for anyone integrating against it. Not a backend question exactly, but flagging since payment's release process seems to have skipped a changeset for this — worth a process check.
3. Rate-limiting on admin credentials login
AdminAuthService.loginWithCredentials() (new in @marketplaces/auth 0.3.0) expects 429 with a Retry-After header (seconds) for rate-limited attempts, and maps that to a rate_limited failure code with retryAfterSeconds. Confirm the Auth API actually returns Retry-After on 429 for POST {credentialsPath} — if it uses a different mechanism (custom header, response body field), the frontend's parsing needs to match.
4. Ed25519 admin auth — still just future work
No change requested here, just a status check: packages/auth/src/ed25519/ (challenge/response admin auth) has never had a backend. As of 2026-08-23 it's also no longer exported from the package's public API (dead code in the bundle otherwise). If/when that backend gets built, this needs re-exporting and a real integration pass — flag when that's on the roadmap so the frontend side can be scheduled.