546971280f
- users module: profile + address CRUD behind use cases (users_profiles, users_addresses) - roles customer/admin on identity_users; role resolved from DB per request - shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin) injected from composition root; users never imports identity - authorization runs before existence checks; address SQL scoped by user_id - @fastify/cookie registered once at app root (cross-module) - migrations 003_identity_roles + 004_users (reversible) - no new npm dependencies; tests: unit 52, integration 22 Gates: reviewer/security/qa APPROVED; verify.sh green
47 lines
2.1 KiB
JSON
47 lines
2.1 KiB
JSON
{
|
|
"feature_id": "F-006",
|
|
"agent": "qa",
|
|
"verdict": "APPROVED",
|
|
"acceptance_criteria": [
|
|
{
|
|
"criterion": "Given user A When A requests user B profile Then HTTP 403",
|
|
"status": "PASS",
|
|
"evidence": "users.itest.ts 'user A requesting user B profile gets 403'; live smoke: A GET B profile -> 403 FORBIDDEN envelope"
|
|
},
|
|
{
|
|
"criterion": "Given customer role When admin-only endpoint called Then HTTP 403",
|
|
"status": "PASS",
|
|
"evidence": "users.itest.ts 'GET /users is admin-only: customer 403'; live smoke confirmed before promotion"
|
|
},
|
|
{
|
|
"criterion": "Given admin role When admin-only endpoint called Then HTTP 200",
|
|
"status": "PASS",
|
|
"evidence": "Same itest after DB promotion returns 200 with items array; live smoke: A(admin) GET /users -> 200"
|
|
},
|
|
{
|
|
"criterion": "Address CRUD works end to end for own addresses",
|
|
"status": "PASS",
|
|
"evidence": "users.itest.ts address CRUD test: POST 201, GET list, PATCH 200, DELETE 204, empty list after; validation 400 on missing fields; cross-user mutation 403; unknown address 404; malformed uuid 400"
|
|
},
|
|
{
|
|
"criterion": "verify.sh green",
|
|
"status": "PASS",
|
|
"evidence": "./scripts/verify.sh: Orquestra verificado"
|
|
}
|
|
],
|
|
"regression": [
|
|
"F-005 identity flows: register/login/logout still green, including logout-kills-access regression in users.itest.ts",
|
|
"F-002 migrations: full up creates baseline+identity+users schemas; full down drops all; node-pg-migrate status consistent",
|
|
"Foundation-only app (no pool) build still works; health endpoint unaffected"
|
|
],
|
|
"suite": {
|
|
"unit": "52 passed, 22 skipped (no TEST_DATABASE_URL path in npm test default run)",
|
|
"integration": "22 passed against real PostgreSQL 16",
|
|
"lint_boundaries_typecheck_build": "all clean"
|
|
},
|
|
"known_limitations": [
|
|
"GET /users lists only users with an existing profile row (documented in reviewer artifact as non-blocking)",
|
|
"Role promotion/demotion is an out-of-band DB operation in this slice; no admin API for it (scope_out: no admin UI)"
|
|
]
|
|
}
|