倪程伟 db3644dc8d refactor(webchat): centralise error codes + dedupe /sessions/page auth (epic #355 PR 6) ... Two cleanups promised in the plan, kept narrow to avoid cascading churn: 1. New WebChatErrors enum — single source of truth for the visitor-facing HTTP error codes + messages. All future R.fail() calls can reference WebChatErrors.INVALID_API_KEY etc. instead of bare literals. This PR doesn't migrate every existing call site (that's a noisy sweep better done in a follow-up); the enum just needs to exist so audit/OpenAPI work in PR 7/8 can quote canonical messages. 2. pageSessions now delegates auth to listSessions instead of duplicating the resolveChannel + verifyVisitorToken block. Same external behavior; -15 lines of duplication. The pagination/keyword logic stays where it is (it's specific to the /page variant and doesn't belong in listSessions). Visitor-token `required=true` migration from plan §6 was dropped: changing it would flip missing-token responses from 401 to 400, which violates the current error-code contract that visitors and tests rely on. The `required=false` + explicit-verify pattern stays. Regression: 7 webchat test classes, 42/42 green. Part of epic #355.		2026-06-18 06:33:17 +08:00
..
mate	refactor(webchat): centralise error codes + dedupe /sessions/page auth (epic #355 PR 6)	2026-06-18 06:33:17 +08:00