Saas-voc/BACKEND-INTEGRATION.md

Backend integration

The bundled Demashi JSON remains the default so the reusable template can start without backend credentials. Deployments can switch all 29 pages to the independent backend without changing page components by injecting configuration before the Angular bundles load:

<script>
  window.__SAAS_VOC_CONFIG__ = {
    apiAuthMode: 'parse',
    domesticDatasetMode: 'api',
    domesticVocPath: '/api/domestic-voc',
    saasPath: '/api/saas',
    domesticWorkspaceId: 'demashi'
  };
</script>

Local development keeps apiAuthMode: 'disabled'. Production must use parse; protected routes then require a valid Parse user and an active workspace membership returned by /api/saas/context.

The frontend uses standard Parse username/password login. It no longer depends on the cross-border user_login Cloud Function or its RSA key. Parse session tokens are attached only to /api/domestic-voc and /api/saas; they are never attached to /api/voc-e-commerce.

Primary API requests:

GET /api/domestic-voc/snapshot?workspaceId=demashi&platform=jd
GET /api/saas/context
GET /api/saas/workspaces/demashi/actions
GET /api/saas/workspaces/demashi/alerts

Local ng serve forwards /api/domestic-voc, /api/saas, and /parse to http://127.0.0.1:4400. Fmode, Parse privileged keys, and database credentials remain server-side.

The API response must keep the DomesticDataset contract in src/app/core/models/domestic.models.ts. Missing reviews remain an empty array and must not be replaced by inferred VOC output.

Runtime and dependency boundary

Frontend and backend use Node.js 22.13 or newer within the Node 22 release line. The frontend Parse SDK is updated within major version 8, ws is overridden to 8.21.0, and the vulnerable XML parser chain removed by the normal audit fix. Remaining Angular 17, ECharts 5, and xlsx advisories require planned framework/library migration; do not use npm audit fix --force for the deployable template.