Aller au contenu principal

WP-01 Identity session and account

Load AGENTS.md, contracts.md, and this file. Tech specs: api/identity.md, app/identity.md, exchange/identity.md. Implement only when the user asks and WP-00 has landed.

Group G1. May run beside WP-02, WP-03, and WP-04.

Owns​

  • afia-api/src/main/java/health/afia/app/identity/
  • afia-api/src/test/java/health/afia/app/identity/
  • afia-app/lib/presentation/identity/
  • afia-app/lib/data/identity/
  • afia-app/lib/domain/identity/

Features: F-15 account session, F-16 delete account, F-17 consent.

Reserved paths: /api/v1/afia/auth, /api/v1/afia/me.

Must not write​

  • EndpointUri.java, api_config.dart, docs/api-map.md
  • Patient, clinician, diagnostics, or admin packages
  • A second user table for admin

Depends on​

WP-00.

Done when​

  1. Account, Role, Session, and Consent match contracts.md.
  2. Auth follows the OTP sketch in sketch.md unless a newer ADR replaces it. F-15 is still open. Record a new ADR if you pick another model.
  3. GET /api/v1/afia/me returns the current account after verify.
  4. Account deletion matches afia-web/delete-account.html. The caller can use the phone or the email on the account.
  5. Tests hit the HTTP paths. They do not invent a second identity store.
  6. cd afia-api && mvn test passes.
  7. cd afia-app && flutter test passes.

Do not invent screens​

Do not name login or OTP screens from Stitch. Ship the smallest Flutter auth shell that calls the reserved paths. Replace that shell after WP-10 maps real screens.