546971280f
- users module: profile + address CRUD behind use cases (users_profiles, users_addresses) - roles customer/admin on identity_users; role resolved from DB per request - shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin) injected from composition root; users never imports identity - authorization runs before existence checks; address SQL scoped by user_id - @fastify/cookie registered once at app root (cross-module) - migrations 003_identity_roles + 004_users (reversible) - no new npm dependencies; tests: unit 52, integration 22 Gates: reviewer/security/qa APPROVED; verify.sh green
42 lines
3.5 KiB
Markdown
42 lines
3.5 KiB
Markdown
# Historial (append-only)
|
|
|
|
> Añadir entradas al final. No reescribir historial previo.
|
|
|
|
## 2026-08-14 — F-001 Scaffold modular monolith skeleton — DONE
|
|
- Gates: reviewer APPROVED, security APPROVED, qa APPROVED, verify.sh exit 0
|
|
- Entregable: skeleton TypeScript + Fastify en project/ con boundary checker testeado; specs/F-001-scaffold completos; spec/tech.md con justificación de dependencias
|
|
- Artefactos: work/artifacts/F-001/ (architect.md, implementer.md, reviewer.json, security.json, qa.json, documenter.md, leader-close.json)
|
|
- Nota: el boundary checker detectó una violación real durante build (test escapando del módulo) y se corrigió moviendo los tests de composición a src/app
|
|
|
|
## 2026-08-14 — F-002 Database foundation with module-owned schemas — DONE
|
|
- Gates: reviewer APPROVED, security APPROVED (con ronda de hardening), qa APPROVED, verify.sh exit 0
|
|
- Entregable: migraciones node-pg-migrate (up/down/no-op probados contra PostgreSQL 16 real), pool fail-fast, docker-compose (Postgres + Redis), convención <module>_<table> documentada
|
|
- Nota: security devolvió un hallazgo bajo (interpolación de identificador en DDL de tests); se mitigó con validación estricta + tests de regresión
|
|
- Artefactos: work/artifacts/F-002/
|
|
|
|
## 2026-08-14 — F-003 HTTP foundation and request context — DONE
|
|
- Gates: reviewer APPROVED, security APPROVED, qa APPROVED, verify.sh exit 0
|
|
- Entregable: request_id (generado o propagado-sanitizado), logs JSON correlacionados, error envelope v2 con requestId, hook de validación parseJson (zod), server con logging inyectable
|
|
- Nota: doc stage rebotó a build para escribir README (project/ está gateado a build/implementer/running); comportamiento correcto del guardrail
|
|
- Artefactos: work/artifacts/F-003/
|
|
|
|
## 2026-08-14 — F-004 Typed config and feature flags — DONE
|
|
- Gates: reviewer APPROVED, security APPROVED, qa APPROVED, verify.sh exit 0
|
|
- Entregable: loadConfig fail-fast (DATABASE_URL requerido, errores solo con nombres de variables), módulo flags tras FeatureFlagProvider (default OFF, flip en runtime sin redeploy), app.flags decorado
|
|
- Nota: los tests detectaron un bug real en build (case-normalization del store); corregido antes de gates con test de regresión
|
|
- Cero dependencias nuevas
|
|
- Artefactos: work/artifacts/F-004/
|
|
|
|
## 2026-08-14 — F-005 Identity: register, login, sessions — DONE
|
|
- Gates: reviewer APPROVED, security APPROVED, qa APPROVED, verify.sh exit 0
|
|
- Entregable: módulo identity hexagonal (domain/application/infrastructure/api), migración 002 reversible, argon2id OWASP tras puerto PasswordHasher, sesiones opacas (solo SHA-256 del token en DB), cookie HttpOnly+Secure+SameSite=Lax, rate limit 10 fallos -> 429 + Retry-After tras interfaz, 401 idéntico anti-enumeración con timing igualado
|
|
- Nota: review detectó falta de tests para COOKIE_SECURE; fix aplicado antes de aprobar el gate. Suite de migraciones F-002 actualizada a rollback completo (count:0) por tener ahora 2 migraciones
|
|
- Deps nuevas: argon2, @fastify/cookie (justificadas en spec/tech.md)
|
|
- Artefactos: work/artifacts/F-005/
|
|
|
|
## F-006 — Users: profile, addresses, RBAC (closed)
|
|
- Users module: profile + address CRUD (users_profiles, users_addresses, migration 004); roles on identity_users (migration 003)
|
|
- RBAC: owner-or-admin via shared/auth.ts injected from composition root; authz before existence checks; SQL scoped by user_id
|
|
- Identity: session-authenticator export + role in model/responses; @fastify/cookie moved to app root
|
|
- Zero new dependencies; tests: unit 52 + integration 22; live smoke covered 401/403/200 paths; gates APPROVED
|