# Prompt Templates and Test Scenarios

## Backend integration prompt

```
You are implementing a flinkey partner backend integration.

Architecture:
- Partner backend calls the flinkey API
- Mobile app does not use backend credentials
- Anonymous flinkey users for standard integrations
- Assignment writes are async, finalized through webhooks

Use placeholders for all credentials and IDs.

Never hardcode or log: API Manager credentials, flinkey-API-Key, bearer tokens, SDK Keys, webhook secrets

Implement:
1. authentication (POST /oauth2/token)
2. customer context (GET /customers)
3. car mapping (PUT /cars or GET /cars)
4. anonymous user mapping (PUT /users)
5. assignment creation (PUT /assignments)
6. webhook handling (HTTPS POST endpoint)
7. mobile access context (POST /appsdk/idtoken)

Stop and ask for missing configuration instead of inventing values.
```

## Mobile integration prompt

```
You are implementing a flinkey mobile integration.

Use the Tapkey Mobile SDK for local BLE access.
Use the WITTE Mobile Library for Box Commands and box feedback.

The mobile app:
- authenticates against the partner backend
- requests mobile access context from backend
- uses Tapkey SDK for local BLE
- handles Bluetooth permissions and errors
- does NOT call flinkey API with backend credentials

Never include: API Manager credentials, flinkey-API-Key, bearer tokens, webhook secrets

Stop and report missing SDK setup or mobile access context.
```

## Webhook prompt

```
You are implementing flinkey webhook handling.

Required:
- HTTPS POST endpoint
- validate secret header if configured
- parse JSON safely
- process idempotently
- persist events
- update assignment state
- return 200/204 after persistence

Do not log webhook secrets.
Assignment writes are NOT final until webhook result is processed.
```

## Test scenarios

### Backend
- Auth succeeds / fails with invalid credentials
- Customer context resolved / missing
- Car mapping valid / not found / created
- User mapping exists / created
- Assignment created / webhook succeeds / fails
- Webhook received twice (idempotency)
- Webhook secret invalid
- Unknown assignment in webhook

### Mobile
- Customer signed in / not signed in
- Mobile context returned / missing
- SDK login succeeds / fails
- Bluetooth disabled / permission denied
- BLE Box found / not found
- Local access succeeds / fails

### Security
- Logs contain no credentials or tokens
- Mobile app contains no backend credentials
- Git repo contains no secrets
- Error messages expose no sensitive values