546971280f
- users module: profile + address CRUD behind use cases (users_profiles, users_addresses) - roles customer/admin on identity_users; role resolved from DB per request - shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin) injected from composition root; users never imports identity - authorization runs before existence checks; address SQL scoped by user_id - @fastify/cookie registered once at app root (cross-module) - migrations 003_identity_roles + 004_users (reversible) - no new npm dependencies; tests: unit 52, integration 22 Gates: reviewer/security/qa APPROVED; verify.sh green
30 lines
1.0 KiB
Markdown
30 lines
1.0 KiB
Markdown
done -> work/artifacts/F-006/documenter.md
|
|
|
|
# F-006 — Documentation
|
|
|
|
Agent: documenter
|
|
Stage: document
|
|
Feature: F-006
|
|
|
|
## Updated
|
|
|
|
- `project/README.md`:
|
|
- Authentication table: register/login responses now include `role`.
|
|
- New section "Users and RBAC (users module)": endpoint table with access
|
|
rules, 401/403/404 semantics, anti-enumeration note, SQL scoping note,
|
|
`GET /users` listing semantics, and the injected-`Authenticate` boundary
|
|
contract.
|
|
- Layout: `users/` module added to the tree.
|
|
- HTTP contract: auth codes now include `UNAUTHORIZED` (401) and
|
|
`FORBIDDEN` (403).
|
|
- Specs `specs/F-006-users-rbac/` (SPEC/DESIGN/TASKS/TESTS) were authored in
|
|
the design stage and match the delivered implementation, except the
|
|
documented deviation noted in `work/artifacts/F-006/implementer.md`
|
|
(ownership unit tests merged into `shared/tests/auth.test.ts`).
|
|
|
|
## Not needed
|
|
|
|
- `spec/tech.md`: no new dependencies this ticket.
|
|
- `spec/roadmap.md`: F-006 already listed in Wave 1; no status field tracked
|
|
there.
|