Commit Graph

22 Commits

Author SHA1 Message Date
Ho Ngoc Hai
966f5412bd feat(k8s): add full K8s staging deployment for all 25 services
- Add 17 new K8s manifests (15 services + RabbitMQ + MinIO)
- Update secrets.yaml with 24 DB URLs for remote PostgreSQL
- Update configmap.yaml with 25 service discovery URLs
- Update ingress.yaml with routes for all services (Nginx + letsencrypt-prod)
- Update network-policy.yaml with all services + RabbitMQ/MinIO policies
- Update deploy-staging.yml CI/CD for all 25 services via Harbor registry
- Fix mkt-* Dockerfiles (add curl, JwtBearer NuGet package)
- Fix membership/ads-billing PendingModelChangesWarning
- Switch DB connections to remote PostgreSQL (212.28.186.239:30992)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-10 19:53:09 +07:00
Ho Ngoc Hai
36a0a9c256 feat: Add functional tests for MktZaloService, new contract and load tests, and audit documentation, while removing a legacy infrastructure project and updating service configurations. 2026-03-25 15:00:05 +07:00
Ho Ngoc Hai
6d0ca5bee5 fix: resolve 4 P0 DevOps blockers — image tags, alertmanager, port conflicts
DEVOPS-C-01: Replace hardcoded :latest with IMAGE_TAG placeholder in all 8
production K8s manifests. Update deploy-production.yml to sed-replace
IMAGE_TAG with commit SHA before kubectl apply (remove now-redundant
kubectl set image step).

DEVOPS-C-02: Configure Alertmanager — create alertmanager.yml with Slack +
email receivers (critical/warning/infra routes, inhibition rules). Add
alertmanager:v0.27.0 service to both docker-compose.observability.yml and
deployments/local/docker-compose.yml. Enable prometheus.yml target
(alertmanager:9093).

DEVOPS-C-03: Remove :latest from docker-build.yml main branch push. Now
only SHA tag is pushed for main; :staging+SHA for develop.

DEVOPS-C-04: Add 4 mkt-* services to deployments/local/docker-compose.yml
with unique host ports (facebook:5021, whatsapp:5022, x:5023, zalo:5024)
to eliminate port 5000 conflicts. Add corresponding Traefik routers and
load-balancer entries in infra/traefik/dynamic/routes.yml
(/api/v1/mkt/{facebook,whatsapp,x,zalo}).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-03-23 09:46:32 +07:00
Ho Ngoc Hai
76b5e6afd0 feat: Phase 2 close-out — multi-branch management, production K8s, revenue dashboard UI, responsive POS
Backend:
- Multi-branch shop management: SetDefaultShop, TransferShop commands, GetMerchantShops paginated query
- Shop aggregate: IsDefault field, SetAsDefault/ClearDefault/TransferOwnership behavior methods
- 2 new domain events: ShopSetAsDefaultDomainEvent, ShopTransferredDomainEvent

Frontend:
- Revenue Dashboard (MudChart line/donut/bar, 4 KPI cards, top products table)
- Staff Performance (sortable table, color-coded completion rates, CSV export)
- Customer QR Menu page (/menu/{ShopId}, mobile-first, Vietnamese labels)
- QR Code Generator admin page (batch generate, print-all, per-table QR)
- Responsive POS layout (collapsible sidebar, slide-out order drawer, touch-friendly CSS)
- ResponsiveOrderPanel component (desktop inline / tablet drawer / mobile overlay)

Infrastructure:
- Production K8s manifests: 8 services (3 replicas, 512Mi-1Gi, HPA min3/max10), Redis with persistence
- Production ingress: api.goodgo.vn, cert-manager TLS, rate-limit middleware
- Deploy script: pre-flight checks, dry-run, single-service deploy, rollback support
- CI/CD: deploy-production.yml with environment approval, commit SHA tags
- Prometheus full scrape config (11 targets), docker-compose observability stack
- Production deployment checklist (80+ items)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 19:58:40 +07:00
Ho Ngoc Hai
dc1ea7c0d2 feat: Phase 2 W7-8 production readiness — QR menu, analytics, E2E tests, observability
- Public QR menu: BFF proxy endpoints (no auth), PosDataService public methods
- Revenue analytics + staff performance: Dapper queries, validators, BFF proxy
- Playwright E2E tests: 8 spec files covering auth, admin, 5 POS verticals, reports
- Observability: Grafana dashboard (HTTP metrics, infra, business), Prometheus alert rules
- Fixes: validator frozen-date bug (Must vs LessThanOrEqualTo), PublicMenuController logging + CancellationToken

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 19:51:37 +07:00
Ho Ngoc Hai
870f1218f8 feat: Phase 2 frontend — Spa, Retail, Cafe Blazor UI pages and BFF proxies
Spa/Beauty UI (booking-service integration):
- TherapistManagement.razor: CRUD table, specialty multi-select, working hours
- AppointmentCalendar.razor: daily calendar grouped by therapist, color-coded statuses
- ShopTherapists embedded component for ShopPage, sidebar menu for spa/beauty
- BookingController BFF: therapist CRUD + appointment proxy endpoints
- Localization: vi-VN + en-US for "Nhân viên trị liệu"

Retail POS UI (catalog + inventory + order integration):
- RetailDesktop.razor: barcode input, API lookup, stock badges, cart warnings
- ReturnDialog.razor: order lookup, return/exchange mode toggle, refund summary
- StockOverview.razor: admin stock table, search/filter, threshold edit dialog
- PosDataService: barcode lookup, bulk stock, return/exchange API methods

Cafe UI (membership + fnb-engine integration):
- StampCard.razor: visual stamp grid, animated fill, celebration UI, claim/reset
- BaristaQueue.razor: 3-column Kanban, stats bar, auto-refresh 10s, pulse animation
- CafeController BFF: stamp cards + barista queue proxy endpoints

Infrastructure:
- Traefik: added /api/v1/therapists + /api/v1/appointments to booking-service
- ROADMAP: Phase 2 vertical tasks DONE, UI refinement IN-PROGRESS

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 17:03:55 +07:00
Ho Ngoc Hai
a7a753bf38 feat: EOD reports, security audit (rate limiting + 44 validators), and 30 critical path tests
EOD Reports & Daily Close (order-service + Blazor UI):
- GetEodReportQuery: Dapper query for revenue, orders, payment breakdown, top items, hourly chart
- CloseDayCommand: check pending orders, generate final report
- EodReport.razor: 6 KPI cards, donut/bar charts, top 10 table, close-day dialog
- FluentValidation for both query and command
- BFF proxy endpoints for reports

Security Audit — Rate Limiting:
- Tighten auth-ratelimit from 100 to 10 req/min (brute force protection)
- Add payment-ratelimit (30/min), api-ratelimit (100/min), hub-ratelimit (500/min)
- Apply rate limits to ALL Traefik routers (previously many had none)

Security Audit — Input Sanitization (44 missing validators created):
- iam-service: 14 validators (auth, user, role commands)
- merchant-service: 11 validators (admin, attendance commands)
- wallet-service: 7 validators (wallet, points commands)
- fnb-engine: 7 validators (session, table, ticket, reservation)
- catalog-service: 6 validators (product, category CRUD)
- storage-service: 6 validators (upload, share, quota)
- order-service: 2 validators (complete order/payment)

Critical Path Unit Tests (30 new tests):
- inventory-service: 12 tests (deduction, partial stock, idempotency)
- wallet-service: 14 tests (create payment, process callback, domain events)
- fnb-engine: 8 tests (kitchen-served event handler, inventory client integration)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 16:33:39 +07:00
Ho Ngoc Hai
653322b26c fix: resolve 12 critical/high issues from code review across backend, frontend, and infra
Backend (7 fixes):
- wallet-service: remove conflicting EF Ignore() calls for mapped backing fields
- fnb-engine: remove KitchenTicket short constructor that set productId=orderItemId
- fnb-engine: replace fire-and-forget Task.Run with direct await for inventory deduction
- TenantMiddleware: implement PostgreSQL RLS SET LOCAL in 4 services (wallet, fnb, inventory, catalog)
- order-service: fix SQL injection pattern in TenantMiddleware with Guid.ToString("D")
- order-service: add ValidateShopAccess() authorization check in SignalR PosHub
- 4 services: register IDbConnection (NpgsqlConnection) in DI for RLS middleware

Frontend (3 fixes):
- PosDataService: return Success=false (not true) when PayOrder response parsing fails
- QrPayment: add _disposed guard to prevent timer race condition after component disposal
- BFF OrderController: add [Authorize] attribute to require JWT for all endpoints

Infrastructure (3 fixes):
- docker-compose: upgrade PostgreSQL 15-alpine to 16-alpine per project spec
- init-databases.sh: add 4 missing marketing service databases (mkt_*)
- Traefik routes: add wallet, catalog, booking routers and /api/v1/stock path

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 16:22:08 +07:00
Ho Ngoc Hai
8af86e9e89 feat: implement Phase 1 payment gateway, real-time SignalR, kitchen-inventory deduction, and order payment flow
- wallet-service: IPaymentGateway abstraction + VN Pay implementation (HMAC-SHA512, sandbox), Payment aggregate root, PaymentsController with create/callback/query endpoints
- order-service: PosHub SignalR hub with Redis backplane + MessagePack, strongly-typed clients, 3 group types (shop/kds/pos), integrated into Create/Pay/Complete/Cancel order handlers
- fnb-engine + inventory-service: Kitchen→Inventory auto-deduction via domain events, HTTP with Polly retry + circuit breaker, idempotency check, graceful degradation on insufficient stock
- order-service: Enhanced PayOrderCommand with 3 flows (cash/card/online), PaymentPending status, WalletServiceClient, CompleteOrderPaymentCommand for gateway callbacks
- POS frontend: Cash/Card/QR payment components wired to real backend, BFF proxy updated
- infra: Traefik routes for fnb-engine, inventory-service, and SignalR WebSocket hub
- ROADMAP.md: Updated with Phase 1 progress tracking

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 13:28:46 +07:00
Ho Ngoc Hai
2e1bb65bd3 feat: implement merchant subscription management and enhanced user account/security features with a new BFF layer. 2026-03-06 12:34:53 +07:00
Ho Ngoc Hai
462e1d0861 feat: Cấu hình các hằng số client OAuth2 và định tuyến Traefik cho các endpoint OIDC của IdentityServer. 2026-01-16 11:07:16 +07:00
Ho Ngoc Hai
8783588ec4 Thêm các bài kiểm tra chức năng và đơn vị cho quản lý vai trò trong dịch vụ IAM, đồng thời cập nhật cấu hình Docker, Traefik và các bài kiểm tra dịch vụ thành viên. 2026-01-15 18:50:50 +07:00
Ho Ngoc Hai
580e074145 feat: Thêm dịch vụ MerchantService mới và cập nhật các tệp điều khiển thành viên trong MembershipService. 2026-01-15 18:14:13 +07:00
Ho Ngoc Hai
56f08857db feat(traefik): Add Storage Service routing and update IAM service URL
- Introduced routing for the Storage Service with rules for file management endpoints.
- Updated IAM service base URL to "http://iam-service-net:8080" for consistency.
- Configured load balancer for the Storage Service to enhance file management capabilities.
2026-01-13 21:32:36 +07:00
Ho Ngoc Hai
5c8764f63a docs(architecture): Update documentation for direct upload architecture and API endpoints
- Enhanced the architecture documentation to recommend direct upload over legacy proxy upload for improved performance and scalability.
- Added detailed comparisons of upload patterns, including throughput, memory usage, and latency.
- Updated API endpoint documentation to reflect new direct upload methods and their benefits.
- Included examples for direct upload flow and bucket directory structure to aid developers in implementation.
2026-01-13 21:17:55 +07:00
Ho Ngoc Hai
96dc13c38a fix: Cấu hình thủ công Traefik và cập nhật phiên bản để khắc phục sự cố Docker provider cục bộ. 2026-01-04 14:52:30 +07:00
Ho Ngoc Hai
a383d8772e feat: Cấu hình lại ứng dụng IAM, cập nhật cấu trúc routes, tích hợp RBAC và thêm các bài kiểm tra tích hợp. 2026-01-04 14:27:41 +07:00
Ho Ngoc Hai
019c79b898 Refactor auth-service to iam-service and update related configurations
- Renamed auth-service to iam-service across various files for consistency.
- Updated deployment workflows, database migration scripts, and documentation to reflect the service name change.
- Enhanced bilingual documentation for clarity on the new service structure and usage.
- Removed outdated references to auth-service in scripts and configuration files to streamline the project structure.
2025-12-30 21:03:00 +07:00
Ho Ngoc Hai
b104fafa85 Refactor auth-service to iam-service and update related documentation
- Renamed auth-service to iam-service across various files for consistency.
- Updated Dockerfiles, deployment configurations, and documentation to reflect the service name change.
- Enhanced testing commands in documentation to point to the new iam-service.
- Removed outdated auth-service files and configurations to streamline the project structure.
- Improved bilingual documentation for clarity on the new service structure and usage.
2025-12-30 20:54:21 +07:00
Ho Ngoc Hai
d92cfb3bf3 Add Promtail service to Docker Compose and update Loki configuration
- Introduced a new Promtail service in `docker-compose.observability.yml` for log collection.
- Configured Promtail with necessary volumes and command for log processing.
- Updated `loki-config.yml` to include `allow_structured_metadata` setting for enhanced metadata handling.
2025-12-27 10:47:35 +07:00
Ho Ngoc Hai
29c40ea681 Update project documentation and scripts for improved setup and bilingual support
- Enhanced `README.md` with a quick start guide and detailed project structure.
- Updated `SETUP_GUIDE.md` by removing it as it was redundant.
- Improved `local-development.md` and `development.md` with clearer instructions for database migrations.
- Added bilingual comments in various scripts for better understanding and usability.
- Updated `.gitignore` to include specific build scripts while ignoring others.
- Enhanced `scripts` for database management, including backup and seeding functionalities with bilingual support.
2025-12-27 10:12:46 +07:00
Ho Ngoc Hai
4da46b5b8e Sure! Pl 2025-12-27 01:31:10 +07:00