6 Commits

Author	SHA1	Message	Date
chattie	5177a851aa	feat(F-099): completed feature	2026-08-21 07:29:07 +02:00
chattie	22ad15325f	feat(F-083): completed feature	2026-08-20 06:08:32 +02:00
chattie	835ab66eda	feat(F-048): completed feature	2026-08-19 07:17:14 +02:00
chattie	d595b4871f	feat(ADM-018): completed feature	2026-08-17 22:23:10 +02:00
rikrdo	546971280f	feat(F-006): users profile, addresses and RBAC ... - users module: profile + address CRUD behind use cases (users_profiles, users_addresses) - roles customer/admin on identity_users; role resolved from DB per request - shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin) injected from composition root; users never imports identity - authorization runs before existence checks; address SQL scoped by user_id - @fastify/cookie registered once at app root (cross-module) - migrations 003_identity_roles + 004_users (reversible) - no new npm dependencies; tests: unit 52, integration 22 Gates: reviewer/security/qa APPROVED; verify.sh green	2026-08-15 09:28:15 +02:00
rikrdo	75293f39bc	feat(identity): F-005 register/login/logout with argon2 sessions and rate limiting ... - Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos - Migration 002_identity: identity_users + identity_sessions (token hash only) - Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL - Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax - LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown - Anti-enumeration: identical generic 401 + dummy-hash timing equalization - buildApp gains optional pool/cookieSecure; foundation-only app preserved - 47 unit + 14 integration tests; live smoke covers all acceptance criteria	2026-08-14 22:58:32 +02:00