rikrdo/mercadodevida
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
cf1c69fc8ba3051fa48430458a43ec687f90f118
mercadodevida/work/current.md
rikrdo 546971280f feat(F-006): users profile, addresses and RBAC 
- users module: profile + address CRUD behind use cases (users_profiles,
  users_addresses)
- roles customer/admin on identity_users; role resolved from DB per request
- shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin)
  injected from composition root; users never imports identity
- authorization runs before existence checks; address SQL scoped by user_id
- @fastify/cookie registered once at app root (cross-module)
- migrations 003_identity_roles + 004_users (reversible)
- no new npm dependencies; tests: unit 52, integration 22

Gates: reviewer/security/qa APPROVED; verify.sh green
2026-08-15 09:28:15 +02:00

1.1 KiB
Raw Blame History

Current work

  • Active feature: none (idle)
  • Last closed: F-006 — Users: profile, addresses, RBAC
  • Next suggested: F-007 — check backlog/features.json for the first pending ticket whose dependencies are satisfied
  • Runtime status: reset via scripts/agent_status.py
  • verify.sh: green at close

F-006 closure notes

  • Users module hexagonal: profile + address CRUD behind use cases; tables users_profiles, users_addresses
  • Roles customer/admin on identity_users (migration 003); role resolved from DB on every request
  • Shared auth contract (src/shared/auth.ts): Authenticate, requireRole, requireOwnerOrAdmin — users never imports identity; composition root injects the authenticator
  • Authorization runs before existence checks (403 first, no enumeration); address SQL scoped by user_id
  • @fastify/cookie registered once at app root (cross-module infrastructure)
  • No new npm dependencies; README documents endpoint table, access rules, and new auth codes (UNAUTHORIZED/FORBIDDEN)
  • Gates: reviewer/security/qa APPROVED. Tests: unit 52, integration 22 (PostgreSQL 16)