546971280f
- users module: profile + address CRUD behind use cases (users_profiles, users_addresses) - roles customer/admin on identity_users; role resolved from DB per request - shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin) injected from composition root; users never imports identity - authorization runs before existence checks; address SQL scoped by user_id - @fastify/cookie registered once at app root (cross-module) - migrations 003_identity_roles + 004_users (reversible) - no new npm dependencies; tests: unit 52, integration 22 Gates: reviewer/security/qa APPROVED; verify.sh green
20 lines
601 B
JavaScript
20 lines
601 B
JavaScript
/**
|
|
* Identity schema evolution: roles for RBAC (introduced by F-006).
|
|
* Role is authorization truth and belongs with the account row.
|
|
* Shipped as its own migration to keep ownership explicit.
|
|
*/
|
|
|
|
/** @param {import('node-pg-migrate').MigrationBuilder} pgm */
|
|
export const up = (pgm) => {
|
|
pgm.sql(`
|
|
ALTER TABLE identity_users
|
|
ADD COLUMN role text NOT NULL DEFAULT 'customer'
|
|
CHECK (role IN ('customer', 'admin'))
|
|
`);
|
|
};
|
|
|
|
/** @param {import('node-pg-migrate').MigrationBuilder} pgm */
|
|
export const down = (pgm) => {
|
|
pgm.sql('ALTER TABLE identity_users DROP COLUMN role');
|
|
};
|