fix: API frontend readiness, documentation, and project cleanup - #9
Merged
Conversation
…ecret Adds PaymentCheckoutResponse DTO that includes client_secret so the frontend can call stripe.confirmPayment() via Stripe.js after order placement. Adds GetPaymentByOrderID to service interface and implementation; ownership check (UserID match) is enforced before returning the secret. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…y route - GET /inventory/:product_id no longer requires auth — product pages can now display stock availability without an admin token - PUT /inventory/:product_id remains admin-only - GET /payments/order/:order_id proxied to payment-service with auth required Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
All endpoints now return { success: true, data: {...} } on success and
{ success: false, error: "..." } on failure, matching the envelope
used by every other service in the platform.
Login and refresh token responses are unchanged ({ access_token, refresh_token })
as they are auth-protocol responses, not resource envelopes.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sequential curl commands for auth, user, address, category, product, inventory, cart, order, and payment flows including error cases. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GORM's AutoMigrate generates malformed SQL (unbound $ parameter) when using the type:GIN index tag. The GIN index is already created correctly by applySearchIndex via raw SQL (CREATE INDEX IF NOT EXISTS ... USING GIN). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GORM AutoMigrate fails with tsvector column type (insufficient arguments error from the postgres driver). The search_vector column is created and indexed by applySearchIndex via raw SQL — GORM does not need to own it. The WHERE clause in the repository uses it as a raw SQL string so no struct field scanning needed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ervices PostgreSQL reports numeric columns as 'numeric', not 'decimal'. When GORM AutoMigrate detects a type mismatch it attempts an ALTER COLUMN and generates TYPE decimal($1,$2) with unbound parameters — causing an 'insufficient arguments' error. Aligning the tag to 'numeric' prevents the spurious ALTER. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GORM v1.31.1 generates malformed ALTER statements for columns with precision type specifiers (numeric(12,2), tsvector) when comparing against existing PostgreSQL column metadata. Guard with HasTable check so AutoMigrate only runs on a fresh database. applySearchIndex always runs since its raw SQL statements are fully idempotent (IF NOT EXISTS / CREATE OR REPLACE). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Use ConstructEventWithOptions with IgnoreAPIVersionMismatch:true so the payment-service accepts webhooks from Stripe CLI (API 2024-04-10) while stripe-go v76 uses API version 2023-10-16 - Add AllowRedirects:"never" to PaymentIntent creation so redirect-based payment methods (iDEAL, BACS etc.) are excluded and no return_url is required at confirmation; cards continue to work with stripe.confirmPayment() Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…responses All 30 endpoints confirmed working end-to-end including the full Stripe payment flow: order → Kafka → PaymentIntent → CLI confirm → webhook → status completed. Documents the stripe-go API version mismatch workaround and allow_redirects:never PaymentIntent configuration. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- API_DOCS.md covers all 30 endpoints across 8 services with request/response shapes, query parameters, auth requirements, and error codes - Auron.postman_collection.json provides a ready-to-import Postman collection with collection variables, Bearer auth pre-configured, and test scripts that auto-save IDs (tokens, order_id, product_id, etc.) after each response Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Covers architecture diagram, full tech stack, all 7 services and their responsibilities, Kafka event flow, getting started steps (env setup, Stripe webhook forwarding, admin promotion), Make command reference, payment checkout flow, API quick reference, project directory layout, and environment variable table. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaced JWT_PRIVATE_KEY / JWT_PUBLIC_KEY (leftover RSA design) with JWT_SECRET and JWT_REFRESH_SECRET, which is what the services actually read. Updated the comment to reflect the HS256 shared-secret approach. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Move API_DOCS.md, API_CURL_TESTS.md, Auron.postman_collection.json, and ecommerce-technical-plan.md into docs/ folder - Delete orphaned db/*.sql migration files across order-service, payment-service, and product-service (GORM AutoMigrate handles schema) - Delete stale IMPLEMENTATION_PLAN.md files from all services and FULLTEXT_SEARCH.md from product-service - Remove unused shared/ Go module (packages were defined but never imported by any service) - Update README Project Structure to reflect the new docs/ layout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GET /payments/order/:order_idendpoint that returnsclient_secretso the frontend can confirm Stripe payments via Stripe.jsGET /inventory/:product_idpublic (no auth required) so product pages can display stock without login{ success, data }envelopeIgnoreAPIVersionMismatch: true) and PaymentIntentreturn_urlrequirement (AllowRedirects: "never")type:decimal(12,2)tag causing malformed ALTER SQL — changed totype:numeric(12,2)across all services; addedHasTableguard to skip AutoMigrate on restartsearch_vectorfrom GORM model management (gorm:"-") to prevent tsvector tag conflicts.env.example(JWT_PRIVATE_KEY/JWT_PUBLIC_KEY→JWT_SECRET/JWT_REFRESH_SECRET)README.md,docs/API_DOCS.md,docs/API_CURL_TESTS.md, anddocs/Auron.postman_collection.jsondb/*.sqlmigration files, staleIMPLEMENTATION_PLAN.mddocs, unusedshared/Go module, and default Next.js SVG assetsTest plan
POST /api/orders→ thenGET /api/payments/order/:order_idreturnsclient_secretin responseGET /api/inventory/:product_idreturns stock withoutAuthorizationheaderPOST /api/auth/registerandGET /api/users/mereturn{ "success": true, "data": { ... } }envelopePOST /api/payments/webhook/stripe) processespayment_intent.succeededand updates payment status tocompleteddocker compose upstarts cleanly — product-service does not crash on AutoMigratecp .env.example .envproduces a working template with correct JWT variable names🤖 Generated with Claude Code