# Milestone 1.7 — Session Initialization Learning Guide

This directory documents the implementation of **Milestone 1, Step 1.7: Session Initialization Endpoint**.

---

## Documents in this folder

- **[01-session-initialization.md](file:///c:/Users/alokc/chatbot/backend/docs/learning/m1-7-session-init/01-session-initialization.md)** — Explains session concepts, `POST /api/v1/session/init` flow, server-side HTTP `Origin` header security, MongoDB `sessions` persistence, and `siteId` vs. `sessionId`.
- **[02-m1-7-revision.md](file:///c:/Users/alokc/chatbot/backend/docs/learning/m1-7-session-init/02-m1-7-revision.md)** — Short revision summary and top 5 interview Q&As.

---

## How to Verify Milestone 1.7

1. **Run Backend & Pytest Suite:**
   ```bash
   cd backend
   .\venv\Scripts\python.exe -m pytest
   ```
   *Verifies 10 passing unit tests including session init success, unknown siteId 404, unauthorized origin 403, and validation 422 errors.*

2. **Run Backend Server:**
   ```bash
   uvicorn app.main:app --reload --port 8000
   ```

3. **Verify in Widget Demo:**
   Open `widget/demo.html` in browser and check console:
   `Widget session initialized: sess_...`
   Panel header displays: `Site: site_demo_123 | Session: sess_...`.

---

## What You Should Understand Before Moving to M1.8

- In **Milestone 1.8**, we will persist this `sessionId` into browser `localStorage` so that refreshing the webpage reuses the existing active session rather than creating a new `sessionId` every time.