sboulahtit/orion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: migrate vendor APIs to token-based context and consolidate architecture

Browse Source 
## Vendor-in-Token Architecture (Complete Migration)
- Migrate all vendor API endpoints from require_vendor_context() to token_vendor_id
- Update permission dependencies to extract vendor from JWT token
- Add vendor exceptions: VendorAccessDeniedException, VendorOwnerOnlyException,
  InsufficientVendorPermissionsException
- Shop endpoints retain require_vendor_context() for URL-based detection
- Add AUTH-004 architecture rule enforcing vendor context patterns
- Fix marketplace router missing /marketplace prefix

## Exception Pattern Fixes (API-003/API-004)
- Services raise domain exceptions, endpoints let them bubble up
- Add code_quality and content_page exception modules
- Move business logic from endpoints to services (admin, auth, content_page)
- Fix exception handling in admin, shop, and vendor endpoints

## Tailwind CSS Consolidation
- Consolidate CSS to per-area files (admin, vendor, shop, platform)
- Remove shared/cdn-fallback.html and shared/css/tailwind.min.css
- Update all templates to use area-specific Tailwind output files
- Remove Node.js config (package.json, postcss.config.js, tailwind.config.js)

## Documentation & Cleanup
- Update vendor-in-token-architecture.md with completed migration status
- Update architecture-rules.md with new rules
- Move migration docs to docs/development/migration/
- Remove duplicate/obsolete documentation files
- Merge pytest.ini settings into pyproject.toml

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Samir Boulahtit
2025-12-04 22:24:45 +01:00
parent 76f8a59954
commit 8a367077e1
85 changed files with 21787 additions and 134978 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
docs/backend/vendor-in-token-architecture.md
View File

@@ -355,18 +355,40 @@ def update_product(
return ProductResponse.model_validate(product)
```
## Files to Migrate
## Migration Status
Current files still using `require_vendor_context()`:
- `app/api/v1/vendor/customers.py`
- `app/api/v1/vendor/notifications.py`
- `app/api/v1/vendor/media.py`
- `app/api/v1/vendor/marketplace.py`
- `app/api/v1/vendor/inventory.py`
- `app/api/v1/vendor/settings.py`
- `app/api/v1/vendor/analytics.py`
- `app/api/v1/vendor/payments.py`
- `app/api/v1/vendor/profile.py`
**COMPLETED** - All vendor API endpoints have been migrated to use the token-based vendor context pattern.
### Migrated Files
All vendor API files now use `current_user.token_vendor_id`:
- `app/api/v1/vendor/customers.py` ✅
- `app/api/v1/vendor/notifications.py` ✅
- `app/api/v1/vendor/media.py` ✅
- `app/api/v1/vendor/marketplace.py` ✅
- `app/api/v1/vendor/inventory.py` ✅
- `app/api/v1/vendor/settings.py` ✅
- `app/api/v1/vendor/analytics.py` ✅
- `app/api/v1/vendor/payments.py` ✅
- `app/api/v1/vendor/profile.py` ✅
- `app/api/v1/vendor/dashboard.py` ✅
- `app/api/v1/vendor/products.py` ✅
- `app/api/v1/vendor/orders.py` ✅
- `app/api/v1/vendor/team.py` ✅ (uses permission dependencies)
### Permission Dependencies Updated
The following permission dependencies now use token-based vendor context:
- `require_vendor_permission()` - Gets vendor from token, sets `request.state.vendor`
- `require_vendor_owner` - Gets vendor from token, sets `request.state.vendor`
- `require_any_vendor_permission()` - Gets vendor from token, sets `request.state.vendor`
- `require_all_vendor_permissions()` - Gets vendor from token, sets `request.state.vendor`
- `get_user_permissions` - Gets vendor from token, sets `request.state.vendor`
### Shop Endpoints
Shop endpoints (public, no authentication) still use `require_vendor_context()`:
- `app/api/v1/shop/products.py` - Uses URL/subdomain/domain detection
- `app/api/v1/shop/cart.py` - Uses URL/subdomain/domain detection
This is correct behavior - shop endpoints need to detect vendor from the request URL, not from JWT token.
## Benefits of Vendor-in-Token
@@ -483,9 +505,9 @@ See `docs/architecture/rules/API-VND-001.md` for the formal architecture rule en
## Related Documentation
- [Vendor RBAC System](./vendor-rbac.md) - Role-based access control for vendors
- [Vendor Authentication](./vendor-authentication.md) - Complete authentication guide
- [Architecture Rules](../architecture/rules/) - All architecture rules
- [API Design Guidelines](../architecture/api-design.md) - RESTful API patterns
- [Authentication & RBAC](../architecture/auth-rbac.md) - Complete authentication guide
- [Architecture Patterns](../architecture/architecture-patterns.md) - All architecture patterns
- [Middleware Reference](./middleware-reference.md) - Middleware patterns
## Summary