546971280f
- users module: profile + address CRUD behind use cases (users_profiles, users_addresses) - roles customer/admin on identity_users; role resolved from DB per request - shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin) injected from composition root; users never imports identity - authorization runs before existence checks; address SQL scoped by user_id - @fastify/cookie registered once at app root (cross-module) - migrations 003_identity_roles + 004_users (reversible) - no new npm dependencies; tests: unit 52, integration 22 Gates: reviewer/security/qa APPROVED; verify.sh green
969 B
969 B
TASKS — F-006 Users: profile, addresses, RBAC
- TASK-001 migrations: 003_identity_roles.js (role column) + 004_users.js (profiles + addresses), reversible
- TASK-002 shared/auth.ts: Role, CurrentUser, Authenticate, requireRole
- TASK-003 identity: session-authenticator (cookie -> CurrentUser) + export from index + role in login response
- TASK-004 users domain: profile.ts, address.ts, errors.ts, ports.ts
- TASK-005 users application: profile get/update/list + address list/create/update/delete (owner-or-admin checks)
- TASK-006 users infrastructure: pg repos (parameterized)
- TASK-007 users api: users.routes.ts (parseJson, error mapping)
- TASK-008 users index.ts public API
- TASK-009 build-app wiring: authenticate injection
- TASK-010 unit tests (module-scoped)
- TASK-011 integration tests (app-scoped itest, AC1-AC4)
- TASK-012 lint + boundaries + typecheck + build + test + test:integration + verify.sh