feat: three nuxt frontends, demo seed, rounding + money-exponent + rate-cast fixes, archived specs

2026-09-17 13:34:38 +08:00
parent dc9fd31c5e
commit 653f13161a
85 changed files with 4327 additions and 106 deletions
@@ -0,0 +1,19 @@
+# Proposal: foundation-auth
+
+## Why
+VMall needs a working backend skeleton and an identity layer before any commerce feature: users, roles (platform_admin / shop_owner / shop_staff / customer), and JWT-based auth that gates every protected endpoint.
+
+## What changes
+- Rust axum API skeleton: config, structured errors, health/readiness endpoints, sqlx migrations on boot, Redis connection manager.
+- Users table with argon2 password hashes; shops table (needed for role scoping).
+- Auth endpoints: register (customer), login, me.
+- JWT issuance/validation middleware; role-guard helpers (`require_role`, shop-scoping for shop roles).
+- Seed: one platform admin account.
+
+## Non-goals
+- OAuth / social login, refresh tokens, password reset flows.
+- Fine-grained permission tables beyond the four roles.
+
+## Capabilities
+- `auth`: registration, login, token issuance, current-user lookup.
+- `rbac`: role model and enforcement on protected routes.
@@ -0,0 +1,32 @@
+# Spec delta: auth
+
+## ADDED Requirements
+
+### Requirement: Customer registration
+The API SHALL provide `POST /api/auth/register` accepting email, password, display_name. New users are created with role `customer`. Duplicate emails MUST be rejected with 409.
+
+#### Scenario: successful registration
+- **WHEN** a client posts a unique email with password ≥ 8 chars
+- **THEN** the API returns 201 with `{ token, user }` and the user can call `/api/auth/me` with the token
+
+#### Scenario: duplicate email
+- **WHEN** the email already exists
+- **THEN** the API returns 409 with code `CONFLICT`
+
+### Requirement: Login
+The API SHALL provide `POST /api/auth/login` issuing a signed JWT (24h TTL) containing user id and role.
+
+#### Scenario: valid credentials
+- **WHEN** email + correct password are posted
+- **THEN** the API returns `{ token, user }`
+
+#### Scenario: invalid credentials
+- **WHEN** the password is wrong or email unknown
+- **THEN** the API returns 401 with code `UNAUTHORIZED` and no token
+
+### Requirement: Current user
+`GET /api/auth/me` SHALL return the authenticated user profile.
+
+#### Scenario: missing token
+- **WHEN** no Bearer token is supplied
+- **THEN** the API returns 401
@@ -0,0 +1,21 @@
+# Spec delta: rbac
+
+## ADDED Requirements
+
+### Requirement: Role model
+The system SHALL support roles `platform_admin`, `shop_owner`, `shop_staff`, `customer`. Shop roles MUST carry a `shop_id` scope.
+
+#### Scenario: seeded platform admin
+- **WHEN** migrations run on a fresh database
+- **THEN** a `platform_admin` account exists and can log in
+
+### Requirement: Role enforcement
+Protected routes SHALL declare required roles; the API MUST reject requests with insufficient role using 403.
+
+#### Scenario: customer hits admin route
+- **WHEN** a `customer` token calls an `/api/admin/*` route
+- **THEN** the API returns 403 with code `FORBIDDEN`
+
+#### Scenario: shop scope isolation
+- **WHEN** a `shop_owner` of shop A accesses `/api/shop/*` resources of shop B
+- **THEN** the API returns 403 or 404, never the data
@@ -0,0 +1,20 @@
+# Tasks: foundation-auth
+
+## 1. Backend skeleton
+- [x] Cargo workspace, vmall-api crate (axum, sqlx, redis, tower-http)
+- [x] Config from env (DATABASE_URL, REDIS_URL, JWT_SECRET, PORT)
+- [x] Health + readiness endpoints (db/redis checked)
+- [x] sqlx migrate on boot; 0001_init migration
+
+## 2. Identity schema
+- [x] Migration: users, shops tables; role enum
+- [x] Seed platform admin (admin@vmall.local / admin1234)
+
+## 3. Auth API
+- [x] POST /api/auth/register (customer role)
+- [x] POST /api/auth/login → JWT + user
+- [x] GET /api/auth/me (Bearer)
+- [x] Auth extractor + require_role guard
+
+## 4. Tests
+- [x] cargo test: register/login/me happy path, wrong password, role guard denies customer on admin route