meshkee-app/backend
1
0
Fork 0
mirror of https://git.meshkee.com/Meshkee/backend.git synced 2026-08-11 22:30:59 +04:30
Code Issues Packages Projects Releases Wiki Activity

Add passwordless OTP login and SMS password reset.

Browse Source 
Expose login-otp and reset-password so dashboards can finish forgot-password and one-time SMS sign-in, and sync website API docs.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Alireza Hassani
2026-08-05 15:10:06 +03:30
co-authored by Cursor
parent f4295e780c
commit 08f901306c
11 changed files with 314 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/PROJECT_CONTEXT.md
+10 -4
View File
@@ -1,7 +1,7 @@
# Meshkee CMS API — Project Context
> Living reference for developers and AI assistants working on this codebase.
> Last updated: August 4, 2026
> Last updated: August 5, 2026
## What This Project Is
@@ -238,9 +238,11 @@ All routes are prefixed with `/api/v1`.
|--------|------|-------------|
| POST | `/auth/register` | Customer registration by domain |
| POST | `/auth/login` | Cell + password |
| POST | `/auth/login-otp` | Passwordless login with SMS OTP |
| POST | `/auth/reset-password` | Reset password with SMS OTP |
| POST | `/auth/refresh` | Refresh token |
| POST | `/auth/send-otp` | Send OTP (Redis-backed) |
| POST | `/auth/verify-otp` | Verify OTP |
| POST | `/auth/verify-otp` | Verify OTP (marks cell verified; no tokens) |
| GET | `/tenants/:host` | Resolve business from domain |
| GET | `/tenants/:host/store-specials` | Active store specials |
| GET | `/tenants/:host/website/category-groups` | Homepage category rows |
@@ -361,6 +363,10 @@ Each resource typically has: `read`, `create`, `update`, `delete` (+ `publish` f
- Registration resolves tenant by `domain` → creates/links user → assigns `customer` role
- OTP stored in Redis (`otp:{cellNumber}`), 5-min TTL; disabled when `SMS_ENABLED=false`
- `POST /auth/send-otp` → SMS code; `POST /auth/verify-otp` marks `cellVerifiedAt` (no tokens)
- `POST /auth/login-otp` → passwordless login (consumes OTP, verifies cell, returns tokens)
- `POST /auth/reset-password` → forgot password (OTP + `newPassword`, verifies cell)
- Password login (`POST /auth/login`) rejects unverified cells when SMS is enabled
- JWT payload: `sub`, `cellNumber`, `roles`, `dashboard`, `type`
- SMS provider: Gama (`sms.igama.ir`) SendQuick via service shortcode (`SMS_GAMA_*`)
- Partner gateway (external sites like Balout): `POST /api/v1/public/sms/send` with `X-Api-Key` + body `{ domain, to, message }`; partners configured in `SMS_PARTNERS` (`domain:apiKey` pairs). Rate limits: 30/partner/min and 5/destination/min. Not part of storefront website-api docs.
@@ -552,7 +558,7 @@ See `.env.example` for the full list. Key groups:
### Implemented
- Multi-tenant auth (register, login, OTP, profile)
- Multi-tenant auth (register, login, passwordless OTP login, reset password via SMS, profile)
- Super admin: users, businesses, domains, system business categories
- Super admin: selective migrate-from-old + purge-data (portfolio categories + portfolios; oversized images resized to max 1280×1280; purge removes portfolios + images)
- Business team management
@@ -566,6 +572,7 @@ See `.env.example` for the full list. Key groups:
- Category variations & technical forms
- Tenant resolution by domain
- RBAC with granular permissions
- Auth SMS OTP via Gama SendQuick (`send-otp`, `verify-otp`, `login-otp`, `reset-password`)
- Partner SMS gateway (`POST /public/sms/send`) + Gama SendQuick integration
### Planned / partial
@@ -575,7 +582,6 @@ See `.env.example` for the full list. Key groups:
| Blogs | Yes | Yes | No | No model |
| Portfolios | Yes | Yes | Partial (migrate-from-old) | Yes |
| Customer dashboard | Partial | No | Register only | Yes |
| SMS provider | — | — | Stub | — |
| Store checkout (cart, orders) | Yes | Yes | Yes | Yes |
| Customer favorites | — | `favorites.*` seeded | No | No |