# Backend integration

The bundled Demashi JSON remains the default so the reusable template can start without backend credentials. Deployments can switch all 29 pages to the independent backend without changing page components by injecting configuration before the Angular bundles load:

```html
<script>
  window.__SAAS_VOC_CONFIG__ = {
    apiAuthMode: 'parse',
    domesticDatasetMode: 'api',
    domesticVocPath: '/api/domestic-voc',
    saasPath: '/api/saas',
    domesticWorkspaceId: 'demashi'
  };
</script>
```

Local development keeps `apiAuthMode: 'disabled'`. Production must use `parse`; protected routes then require a valid Parse user and an active workspace membership returned by `/api/saas/context`.

The frontend uses standard Parse username/password login. It no longer depends on the cross-border `user_login` Cloud Function or its RSA key. Parse session tokens are attached only to `/api/domestic-voc` and `/api/saas`; they are never attached to `/api/voc-e-commerce`.

Primary API requests:

```text
GET /api/domestic-voc/snapshot?workspaceId=demashi&platform=jd
GET /api/saas/context
GET /api/saas/workspaces/demashi/actions
GET /api/saas/workspaces/demashi/alerts
```

Local `ng serve` forwards `/api/domestic-voc`, `/api/saas`, and `/parse` to `http://127.0.0.1:4400`. Fmode, Parse privileged keys, and database credentials remain server-side.

The API response must keep the `DomesticDataset` contract in `src/app/core/models/domestic.models.ts`. Missing reviews remain an empty array and must not be replaced by inferred VOC output.

## Runtime and dependency boundary

Frontend and backend use Node.js 22.13 or newer within the Node 22 release line. The frontend Parse SDK is updated within major version 8, `ws` is overridden to 8.21.0, and the vulnerable XML parser chain removed by the normal audit fix. Remaining Angular 17, ECharts 5, and `xlsx` advisories require planned framework/library migration; do not use `npm audit fix --force` for the deployable template.