feat(F-149): completed feature

work/artifacts/F-149/documenter.md

@@ -0,0 +1,4 @@
+# F-149 — Documenter evidence
+
+## Scope of documentation change
+F-149 implementa el endpoint `GET /reporting/products` descrito en `docs/reporting/REPORTING_ARCHITECTURE.md` §8 (Frontend Admin: `ReportingTable`). La arquitectura doc ya describe el diseño; no se requiere update adicional. Scope cero para documenter.

work/artifacts/F-149/implementer.md

@@ -0,0 +1,27 @@
+# F-149 — Implementer evidence
+
+## What
+F-149 build evidence: `ReportingService.products()` con CTE que une orders_items + catalog_products + categories + brands; ruta `GET /reporting/products` con permisos REPORTING_PRODUCTS; página admin Products con ranking de productos. Backend tsc 0, boundaries 0, verify.sh verde.
+
+## Files
+- `src/modules/reporting/application/reporting-service.ts` (updated) — método `products()` con CTE SQL
+- `src/modules/reporting/api/reporting.routes.ts` (updated) — ruta `GET /reporting/products`
+- `apps/admin/src/lib/reporting-client.ts` (updated) — `fetchProducts()`
+- `apps/admin/src/app/(dashboard)/reporting/products/page.tsx` (created) — ranking de productos
+- `apps/admin/src/lib/permissions.ts` (updated) — sub-nav de reporting (dashboard/sales/products)
+
+## Verification
+- `npm run build` → 0 TypeScript errors.
+- `check-module-boundaries.mjs src` → 0 NEW violations.
+- `./scripts/verify.sh` → green (F-149 in_progress, runtime-consistent).
+
+## AC traceability
+| AC | Estado | Evidencia |
+|----|--------|-----------|
+| AC1 product rankings | ✅ | ReportingService.products() CTE JOIN orders_items + catalog_products + categories + brands |
+| AC2 units/revenue sort | ✅ | sortBy = 'units_sold' (default) or 'gross_sales_cents' (sort=revenue) |
+| AC3 category/brand | ✅ | LEFT JOIN catalog_product_categories + categories_categories + brands_brands |
+| AC4 pagination | ✅ | LIMIT $7 OFFSET $8 + total_count subquery |
+| AC5 filters | ✅ | channel/storeId/terminalId from ReportingFilters |
+| AC6 admin page | ✅ | products page with table, filters, pagination |
+| AC7 tsc/verify | ✅ | tsc 0, boundaries 0, verify verde |

work/artifacts/F-149/leader-close.json

@@ -0,0 +1,12 @@
+{
+  "feature_id": "F-149",
+  "agent": "leader",
+  "stage": "close",
+  "verdict": "APPROVED",
+  "summary": "F-149 completed: ReportingService.products() with CTE rankings + GET /reporting/products + admin products page. tsc 0, boundaries 0, verify.sh green.",
+  "checks": [
+    {"item": "Gates approved", "ok": true, "evidence": "reviewer.json, security.json, qa.json -> APPROVED"},
+    {"item": "verify.sh", "ok": true, "evidence": "exit 0"}
+  ],
+  "issues": []
+}

work/artifacts/F-149/qa.json

@@ -0,0 +1,12 @@
+{
+  "feature_id": "F-149",
+  "agent": "qa",
+  "stage": "qa_gate",
+  "verdict": "APPROVED",
+  "summary": "tsc 0 (backend); verify.sh green. No regressions.",
+  "checks": [
+    {"item": "tsc 0", "ok": true, "evidence": "npm run build 0 errors"},
+    {"item": "verify.sh", "ok": true, "evidence": "exit 0"}
+  ],
+  "issues": []
+}

work/artifacts/F-149/reviewer.json

@@ -0,0 +1,17 @@
+{
+  "feature_id": "F-149",
+  "agent": "reviewer",
+  "stage": "review_gate",
+  "verdict": "APPROVED",
+  "summary": "ReportingService.products() implements product rankings via CTE joining orders_items+catalog_products+categories+brands. GET /reporting/products endpoint with REPORTING_PRODUCTS RBAC. Admin products page with table, filters, pagination. tsc 0, boundaries 0.",
+  "checks": [
+    {"item": "AC1 product rankings CTE", "ok": true, "evidence": "SQL CTE: filtered_orders + filtered_items + product_rank JOIN with catalog_products/categories/brands"},
+    {"item": "AC2 units/revenue sort", "ok": true, "evidence": "sortBy: 'units_sold' (default) or 'gross_sales_cents' (sort=revenue param)"},
+    {"item": "AC3 category/brand LEFT JOIN", "ok": true, "evidence": "LEFT JOIN catalog_product_categories + categories_categories + brands_brands; NULL for products without category/brand"},
+    {"item": "AC4 pagination", "ok": true, "evidence": "LIMIT $7 OFFSET $8 + total_count subquery"},
+    {"item": "AC5 filters", "ok": true, "evidence": "filters: from/to/channel/storeId/terminalId applied in CTE"},
+    {"item": "AC6 admin page", "ok": true, "evidence": "reporting/products/page.tsx with sortable table, filters, pagination"},
+    {"item": "tsc/verify", "ok": true, "evidence": "npm run build 0 errors; boundaries 0 new; verify.sh green"}
+  ],
+  "issues": []
+}

work/artifacts/F-149/security.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "F-149",
+  "agent": "security",
+  "stage": "security_gate",
+  "verdict": "APPROVED",
+  "summary": "Fully parameterized SQL CTE. All user input (dates, UUIDs, channel) via $1..$8 placeholders. RBAC enforced via requireReportingPermission('REPORTING_PRODUCTS'). No new secrets.",
+  "checks": [
+    {"item": "SQL injection prevention", "ok": true, "evidence": "All user values: $1..$8 parameterized; sortBy is validated ('units_sold'|'gross_sales_cents'), not interpolated as user string"},
+    {"item": "Authentication", "ok": true, "evidence": "requireReportingPermission('REPORTING_PRODUCTS') on GET /reporting/products"},
+    {"item": "No new secrets", "ok": true, "evidence": "No env vars or credentials added"}
+  ],
+  "issues": []
+}