4 Commits

Author	SHA1	Message	Date
rikrdo	75293f39bc	feat(identity): F-005 register/login/logout with argon2 sessions and rate limiting ... - Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos - Migration 002_identity: identity_users + identity_sessions (token hash only) - Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL - Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax - LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown - Anti-enumeration: identical generic 401 + dummy-hash timing equalization - buildApp gains optional pool/cookieSecure; foundation-only app preserved - 47 unit + 14 integration tests; live smoke covers all acceptance criteria	2026-08-14 22:58:32 +02:00
rikrdo	4851692031	feat(F-004): typed fail-fast config and feature flag module ... - loadConfig: pure over env object, accumulates all problems, names var names only - DATABASE_URL now required at startup; PORT/HOST/LOG_LEVEL/NODE_ENV/REDIS_URL defaulted - flags module behind FeatureFlagProvider; unknown flags OFF; runtime setEnabled (no redeploy) - buildApp decorates app.flags; server.ts fail-fast before app boot - tests caught and fixed flag-store case-normalization bug before gates - zero new dependencies; all gates approved; verify.sh green	2026-08-14 22:29:18 +02:00
rikrdo	41f144d7bd	feat(F-003): HTTP foundation with request context and error envelope ... - request_id generated or sanitized-propagated on every request (x-request-id) - structured JSON logging (pino), one correlated line per request, injectable logger - error envelope v2 { error: { statusCode, code, message, details? }, requestId } - 5xx messages always generic; stack traces stay in server logs only - explicit parseJson (zod) input validation hook at the API layer - README HTTP contract section; deps justified in spec/tech.md - all gates approved; verify.sh green	2026-08-14 22:13:28 +02:00
rikrdo	1d4eebca54	feat(F-001): scaffold modular monolith skeleton with boundary checker ... - TypeScript + Fastify skeleton under project/ (src/modules, shared, infrastructure, app) - scripts/check-module-boundaries.mjs enforcing module public-API rules (tested with fixtures) - GET /health endpoint, error envelope without stack leakage - specs/F-001-scaffold (SPEC/DESIGN/TASKS/TESTS), spec/tech.md dependency justification - 30-ticket MercadoDeVida roadmap in backlog/features.json, spec/roadmap.md - All gates approved: reviewer, security, qa; verify.sh green	2026-08-14 21:46:54 +02:00