Files

ramadhan sjamsani 2645bcd0e5 Phase 4 Stage 2: onboarding redesign (client_app + mitra_app)

Verif Choice Sheet on display_name_screen drives the user into either
the verified or anonymous onboarding sub-flow. ESP screen (12 chips,
multi-select, info-only) + USP screen are shared between both branches;
selections persist through to chat_sessions.topics on session start.

OTP-blocked popup (HaloPopup) listens for the four real OTP-rate-limit
error codes (OTP_RATE_LIMIT_PHONE, OTP_RATE_LIMIT_IP, OTP_COOLDOWN,
OTP_ATTEMPTS_EXCEEDED) and drops the user onto the anonymous path with
ESP/USP state preserved.

Auth-providers gating replaces the --dart-define=ENABLE_SOCIAL_AUTH
build flag with server-driven discovery. authProvidersProvider preloads
GET /api/shared/auth-providers at cold start; welcome/register/
force-register screens render Google/Apple buttons only when the
backend reports enabled:true. Falls back to phone-OTP-only when both
providers are off. social_auth_enabled.dart deleted; client_app/CLAUDE.md
updated to reflect the new gating contract.

Mitra app: chat screen renders an ESP chip strip above the first message
bubble when chat_sessions.topics is non-empty.

Backend session.service.js getSessionById SELECTs cs.topics so the mitra
side can read the customer's selected topics.

Maestro flows 02_onboarding_verified.yaml + 03_onboarding_anon.yaml.

Deviation from plan: plan referenced OTP error code 'otp_retry_exhausted';
real codes are OTP_RATE_LIMIT_*/OTP_COOLDOWN/OTP_ATTEMPTS_EXCEEDED -
popup listens for all four. Plan said 'has_paid_first_session'; live
endpoint returns 'has_consulted_before' - used the live field.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-10 16:23:57 +08:00

1.9 KiB

Raw Blame History

Halo Bestie — Client App

Flutter mobile application for end users (clients) seeking mental health support.

See root CLAUDE.md for full project context and architectural decisions.

Stack

Framework: Flutter (iOS + Android)
Auth: Self-managed (Phase 3.4). Anonymous-first + phone OTP + (Google / Apple when creds arrive).
- Access token in memory on AuthBridge; refresh token persisted via flutter_secure_storage.
- Google + Apple SDKs installed; buttons are gated server-side via GET /api/shared/auth-providers (cached on cold start in authProvidersProvider). Buttons render only when the corresponding env-driven flag returns enabled: true.
- firebase_auth removed; firebase_messaging kept for FCM push.
API: Calls public Fastify backend (/api/client/ and /api/shared/ routes). Refresh + logout live on shared.auth.
Payment: Xendit (paid sessions, optional trial)

Key Concepts

Users are clients — they seek mental health support ("curhat")
Core flow: server-issued anonymous → optional phone/Google/Apple identity upgrade (same customer row via anonymous_customer_id) → browse/match with mitra → book session → chat → pay
Anonymity toggle: if /api/shared/config/anonymity reports anonymity_enabled = false, the router shows ForceRegisterScreen until the user identifies

Conventions

Never call /api/mitra/ or /internal/ routes from this app
API calls go through ApiClient; it auto-attaches the JWT from AuthBridge and auto-refreshes on 401
WebSocket handshake (/api/shared/ws) reads the access token from AuthBridge in the first frame's {type:"auth", token, session_id?} message
Read authProvidersProvider (core/auth/auth_providers_provider.dart) to gate any Google/Apple UI — never call loginGoogle / loginApple from a path reachable when providers.google / providers.apple is false

1.9 KiB Raw Blame History

Halo Bestie — Client App

Stack

Key Concepts

Conventions

1.9 KiB

Raw Blame History