rikrdo/mercadodevida
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
3ccbf9f4503b2cad15d85bbeb4c184300e1df9ba
mercadodevida/work/artifacts/F-006/documenter.md
rikrdo 546971280f feat(F-006): users profile, addresses and RBAC 
- users module: profile + address CRUD behind use cases (users_profiles,
  users_addresses)
- roles customer/admin on identity_users; role resolved from DB per request
- shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin)
  injected from composition root; users never imports identity
- authorization runs before existence checks; address SQL scoped by user_id
- @fastify/cookie registered once at app root (cross-module)
- migrations 003_identity_roles + 004_users (reversible)
- no new npm dependencies; tests: unit 52, integration 22

Gates: reviewer/security/qa APPROVED; verify.sh green
2026-08-15 09:28:15 +02:00

1.0 KiB
Raw Blame History

done -> work/artifacts/F-006/documenter.md

F-006 — Documentation

Agent: documenter Stage: document Feature: F-006

Updated

  • project/README.md:
    • Authentication table: register/login responses now include role.
    • New section "Users and RBAC (users module)": endpoint table with access rules, 401/403/404 semantics, anti-enumeration note, SQL scoping note, GET /users listing semantics, and the injected-Authenticate boundary contract.
    • Layout: users/ module added to the tree.
    • HTTP contract: auth codes now include UNAUTHORIZED (401) and FORBIDDEN (403).
  • Specs specs/F-006-users-rbac/ (SPEC/DESIGN/TASKS/TESTS) were authored in the design stage and match the delivered implementation, except the documented deviation noted in work/artifacts/F-006/implementer.md (ownership unit tests merged into shared/tests/auth.test.ts).

Not needed

  • spec/tech.md: no new dependencies this ticket.
  • spec/roadmap.md: F-006 already listed in Wave 1; no status field tracked there.