546971280f
- users module: profile + address CRUD behind use cases (users_profiles, users_addresses) - roles customer/admin on identity_users; role resolved from DB per request - shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin) injected from composition root; users never imports identity - authorization runs before existence checks; address SQL scoped by user_id - @fastify/cookie registered once at app root (cross-module) - migrations 003_identity_roles + 004_users (reversible) - no new npm dependencies; tests: unit 52, integration 22 Gates: reviewer/security/qa APPROVED; verify.sh green
17 lines
1.1 KiB
Markdown
17 lines
1.1 KiB
Markdown
# Current work
|
|
|
|
- Active feature: none (idle)
|
|
- Last closed: F-006 — Users: profile, addresses, RBAC
|
|
- Next suggested: F-007 — check `backlog/features.json` for the first `pending` ticket whose dependencies are satisfied
|
|
- Runtime status: reset via scripts/agent_status.py
|
|
- verify.sh: green at close
|
|
|
|
## F-006 closure notes
|
|
- Users module hexagonal: profile + address CRUD behind use cases; tables `users_profiles`, `users_addresses`
|
|
- Roles customer/admin on `identity_users` (migration 003); role resolved from DB on every request
|
|
- Shared auth contract (`src/shared/auth.ts`): `Authenticate`, `requireRole`, `requireOwnerOrAdmin` — users never imports identity; composition root injects the authenticator
|
|
- Authorization runs before existence checks (403 first, no enumeration); address SQL scoped by user_id
|
|
- `@fastify/cookie` registered once at app root (cross-module infrastructure)
|
|
- No new npm dependencies; README documents endpoint table, access rules, and new auth codes (UNAUTHORIZED/FORBIDDEN)
|
|
- Gates: reviewer/security/qa APPROVED. Tests: unit 52, integration 22 (PostgreSQL 16)
|