Skip to main content

WP-01 exchange

OTP sketch until a later ADR replaces it. Envelope: envelope.md.

Workflow​

  1. The client POSTs a phone to request OTP.
  2. The API stores a challenge. It returns no token.
  3. The client POSTs phone and code to verify.
  4. The API returns a Session. The client keeps the token.
  5. Later calls send that token. GET /api/v1/afia/me returns Account.
  6. Deletion sends phone or email. The same Account row is removed. Consent is a separate write with purpose.

Wire​

POST /api/v1/afia/auth/otp/request

req { "phone": "..." }
res { data: null, status, message, errors }

POST /api/v1/afia/auth/otp/verify

req { "phone": "...", "code": "..." }
res { data: { "token": "..." }, status, message, errors }

GET /api/v1/afia/me

res { data: { "id", "phone", "email", "roles": ["PATIENT", ...] }, ... }

Deletion on the /me prefix. Body is { "phone" } or { "email" }. Matches afia-web/delete-account.html.

Errors: unknown phone, bad code, missing session, last-admin delete policy later.

Ownership​

WP-01 writes health.afia.app.identity and lib/domain/identity, lib/data/identity, lib/presentation/identity. Shared language is Account, Role, Session, Consent.

Does not do​

Java or Dart class internals. Invented login screens. A second user table.