Phase 3.3: topic sensitivity + Phase 3.4: auth foundation

Phase 3.3 — Session Topic Sensitivity (complete):
- Backend: topic_sensitivity column + session_sensitivity_log, sensitivity service
  (flip with one-way-latch + audit), PATCH /api/shared/chat/sessions/:id/topic,
  topic carried in pairing + extension WS payloads, CC filter + sensitive stats
  + per-mitra sensitive columns on activity page
- client_app: TopicSelectionBottomSheet before pricing, topic flows through
  pairing request, silent WS handler for session_topic_updated
- mitra_app: SensitivityBadge + SensitivityTheme + sensitivityConfigProvider,
  overlay badge + yellow accent, chat screen app-bar toggle with configurable
  confirmation + latch, extension card shows current flag, history + transcript
  yellow theme
- control_center: Sensitivitas Topik settings section, topic filter + column
  with inline audit log, sensitive stats dashboard card, mitra activity
  sensitive columns with QC flag

Phase 3.4 — Self-Managed Auth (foundation only):
- Migration: auth_sessions + otp_requests tables, social identity columns on
  customers, password_hash + lockout on control_center_users, OTP + CC lockout
  app_config keys
- New services: password (bcrypt + complexity), token (JWT HS256 + refresh
  rotation, session_id claim pre-wires future Valkey revocation),
  social-identity (Google + Apple JWKS), OTP (Fazpass stub — real API TBD)
- Constants: AuthProvider + OtpChannel
- Middleware, auth route rewrites, WS auth update, Firebase → FCM isolation
  still pending (next chunk); Fazpass docs + Apple Developer setup still
  required before E2E testing

Docs:
- requirement/phase3.3.md, phase3.3-plan.md, phase3.3-testing.md
- requirement/phase3.4.md, phase3.4-plan.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/routes/internal/config.routes.js

@@ -7,6 +7,7 @@ import {
   getExtensionTimeoutConfig, setExtensionTimeoutConfig,
   getEarlyEndConfig, setEarlyEndConfig,
   getMitraPingConfig, setMitraPingConfig,
+  getSensitivityConfig, setSensitivityConfig,
 } from '../../services/config.service.js'
 
 const attachCcUser = async (request, reply) => {
@@ -125,6 +126,28 @@ export const internalConfigRoutes = async (app) => {
     return reply.send({ success: true, data: config })
   })
 
+  // --- Phase 3.3: Topic Sensitivity ---
+  app.get('/sensitivity', {
+    preHandler: [authenticate, attachCcUser, requirePermission('config', 'read')],
+  }, async (request, reply) => {
+    const config = await getSensitivityConfig()
+    return reply.send({ success: true, data: config })
+  })
+
+  app.patch('/sensitivity', {
+    preHandler: [authenticate, attachCcUser, requirePermission('config', 'update')],
+  }, async (request, reply) => {
+    const { flip_confirmation_enabled, one_way_latch } = request.body ?? {}
+    if (flip_confirmation_enabled !== undefined && typeof flip_confirmation_enabled !== 'boolean') {
+      return reply.code(422).send({ success: false, error: { code: 'VALIDATION_ERROR', message: 'flip_confirmation_enabled must be a boolean' } })
+    }
+    if (one_way_latch !== undefined && typeof one_way_latch !== 'boolean') {
+      return reply.code(422).send({ success: false, error: { code: 'VALIDATION_ERROR', message: 'one_way_latch must be a boolean' } })
+    }
+    const config = await setSensitivityConfig({ flip_confirmation_enabled, one_way_latch })
+    return reply.send({ success: true, data: config })
+  })
+
   // --- Price Tiers ---
   app.get('/price-tiers', {
     preHandler: [authenticate, attachCcUser, requirePermission('config', 'read')],

backend/src/routes/internal/session.routes.js

@@ -1,6 +1,7 @@
 import { authenticate, requirePermission } from '../../plugins/auth.js'
 import { getCcUserByFirebaseUid } from '../../services/cc-user.service.js'
 import { listSessions, getSessionById, rerouteSession } from '../../services/session.service.js'
+import { getSessionSensitivityLog } from '../../services/sensitivity.service.js'
 import { getDashboardStats } from '../../services/dashboard.service.js'
 
 const attachCcUser = async (request, reply) => {
@@ -20,8 +21,13 @@ export const sessionManagementRoutes = async (app) => {
   app.get('/', {
     preHandler: [authenticate, attachCcUser, requirePermission('config', 'read')],
   }, async (request, reply) => {
-    const { page = 1, limit = 20, status } = request.query
-    const result = await listSessions({ page: Number(page), limit: Number(limit), status })
+    const { page = 1, limit = 20, status, topic_sensitivity } = request.query
+    const result = await listSessions({
+      page: Number(page),
+      limit: Number(limit),
+      status,
+      topic_sensitivity: topic_sensitivity && topic_sensitivity !== 'all' ? topic_sensitivity : undefined,
+    })
     return reply.send({ success: true, data: result })
   })
 
@@ -32,7 +38,8 @@ export const sessionManagementRoutes = async (app) => {
     if (!session) {
       return reply.code(404).send({ success: false, error: { code: 'NOT_FOUND', message: 'Session not found' } })
     }
-    return reply.send({ success: true, data: session })
+    const sensitivity_log = await getSessionSensitivityLog(request.params.sessionId)
+    return reply.send({ success: true, data: { ...session, sensitivity_log } })
   })
 
   app.post('/:sessionId/reroute', {

backend/src/routes/public/client.chat.routes.js

@@ -4,7 +4,7 @@ import { createPairingRequest, cancelPairingRequest } from '../../services/pairi
 import { getActiveSessionByCustomer, getActiveSessionByCustomerWithUnread, endSession, getCustomerHistory } from '../../services/session.service.js'
 import { getPricingForCustomer, isValidTier, isCustomerEligibleForFreeTrial, getFreeTrial } from '../../services/pricing.service.js'
 import { requestExtension } from '../../services/extension.service.js'
-import { EndedBy } from '../../constants.js'
+import { EndedBy, TopicSensitivity } from '../../constants.js'
 
 const resolveCustomer = async (request, reply) => {
   const customer = await getCustomerByFirebaseUid(request.firebaseUser.uid)
@@ -25,7 +25,14 @@ export const clientChatRoutes = async (app) => {
   })
 
   app.post('/request', { preHandler: [authenticate, resolveCustomer] }, async (request, reply) => {
-    const { duration_minutes, price, is_free_trial } = request.body || {}
+    const { duration_minutes, price, is_free_trial, topic_sensitivity } = request.body || {}
+
+    if (topic_sensitivity !== TopicSensitivity.REGULAR && topic_sensitivity !== TopicSensitivity.SENSITIVE) {
+      return reply.code(400).send({
+        success: false,
+        error: { code: 'BAD_REQUEST', message: 'topic_sensitivity must be regular or sensitive' },
+      })
+    }
 
     // Validate selection
     if (is_free_trial) {
@@ -41,6 +48,7 @@ export const clientChatRoutes = async (app) => {
         duration_minutes: freeTrial.duration_minutes,
         price: 0,
         is_free_trial: true,
+        topic_sensitivity,
       })
       return reply.code(201).send({ success: true, data: session })
     }
@@ -59,7 +67,7 @@ export const clientChatRoutes = async (app) => {
       })
     }
 
-    const session = await createPairingRequest(request.customer.id, { duration_minutes, price, is_free_trial: false })
+    const session = await createPairingRequest(request.customer.id, { duration_minutes, price, is_free_trial: false, topic_sensitivity })
     return reply.code(201).send({ success: true, data: session })
   })
 

backend/src/routes/public/shared.chat.routes.js

@@ -4,8 +4,9 @@ import { getMitraByFirebaseUid } from '../../services/mitra.service.js'
 import { getMessages } from '../../services/chat.service.js'
 import { getSessionClosures } from '../../services/closure.service.js'
 import { registerDeviceToken } from '../../services/notification.service.js'
+import { flipSessionSensitivity } from '../../services/sensitivity.service.js'
 import { getDb } from '../../db/client.js'
-import { UserType } from '../../constants.js'
+import { TopicSensitivity, UserType } from '../../constants.js'
 
 const sql = getDb()
 
@@ -96,4 +97,35 @@ export const sharedChatRoutes = async (app) => {
     const closure = await submitClosureMessage(sessionId, request.userType, request.userId, message)
     return reply.send({ success: true, data: closure })
   })
+
+  // Mitra flips session topic sensitivity (regular <-> sensitive)
+  app.patch('/chat/sessions/:sessionId/topic', { preHandler: [authenticate, resolveUser] }, async (request, reply) => {
+    if (request.userType !== UserType.MITRA) {
+      return reply.code(403).send({
+        success: false,
+        error: { code: 'FORBIDDEN', message: 'Only mitra can change topic sensitivity' },
+      })
+    }
+    const { sessionId } = request.params
+    const { topic_sensitivity } = request.body || {}
+    if (topic_sensitivity !== TopicSensitivity.REGULAR && topic_sensitivity !== TopicSensitivity.SENSITIVE) {
+      return reply.code(400).send({
+        success: false,
+        error: { code: 'BAD_REQUEST', message: 'topic_sensitivity must be regular or sensitive' },
+      })
+    }
+    try {
+      const result = await flipSessionSensitivity({
+        sessionId,
+        mitraId: request.userId,
+        toValue: topic_sensitivity,
+      })
+      return reply.send({ success: true, data: result })
+    } catch (err) {
+      return reply.code(err.statusCode || 500).send({
+        success: false,
+        error: { code: err.code || 'INTERNAL', message: err.message },
+      })
+    }
+  })
 }

backend/src/routes/public/shared.config.routes.js

@@ -1,9 +1,14 @@
 import { authenticate } from '../../plugins/auth.js'
-import { getAnonymityConfig } from '../../services/config.service.js'
+import { getAnonymityConfig, getSensitivityConfig } from '../../services/config.service.js'
 
 export const sharedConfigRoutes = async (app) => {
   app.get('/anonymity', async (request, reply) => {
     const config = await getAnonymityConfig()
     return reply.send({ success: true, data: config })
   })
+
+  app.get('/sensitivity', { preHandler: [authenticate] }, async (request, reply) => {
+    const config = await getSensitivityConfig()
+    return reply.send({ success: true, data: config })
+  })
 }