History of procedures/backoffice-first-access-token-handling.md

@@ -0,0 +1,10 @@+# Handle backoffice first-access tokens safely++1. Generate a cryptographically random 32-byte token and encode it for transport.+2. Compute the SHA-256 hash immediately; use the hash for database lookup and persistence.+3. Create the partner and token in the same transaction, passing the transaction context to both repository operations.+4. Send the raw token only through the `backoffice-first-access` notification.+5. Return only the partner ID from the creation use case and HTTP endpoint.+6. During password setup, validate the one-time PIN, hash the new password, clear the PIN, and invalidate pending first-access tokens in the same transaction.+7. Test response shape, email delivery, stored hash, expiry, transaction context, invalid credentials, and post-setup invalidation.+8. Run focused unit tests, the partner-management suite, type checking, formatting, and the relevant end-to-end tests.