Repository navigation
feat: platform foundation, catalogue & inventory on Laravel 12 / Next.js 15 - #22
Merged
Merged
Conversation
Laravel 10 -> 12 in one step (Laravel 11 is itself out of support), Sanctum 3 -> 4, PHPUnit 10 -> 11, spatie/laravel-multitenancy 3 -> 4 with the v4 single-database config migration. Next.js 14 -> 15.5 with React 19, Jest 30, and Testing Library 16. Removes the stray check_config.php and flowos artifacts. Verified at this state: API suite 89 passed, 1 skipped (282 assertions). Refs docs/adr/0031-framework-version-upgrade.md
…it and idempotency
Invitations are bearer-secret workflows with hashed, expiring tokens
whose acceptance transactionally creates an active membership (ADR 0029).
Authorization moves from temporary active-member rules to
organization-scoped roles attached to memberships, with a canonical
platform permission catalogue and dynamic Owner semantics (ADR 0030).
Authenticator-app TOTP MFA with recovery codes gates session and token
issuance, and write routes require verified email (ADR 0032). Device
registration and revocation, an append-only audit event log, idempotency
keys for safe mutation retries, and rate-limit/error-envelope contract
hardening round out the platform slice.
Refs docs/engineering/{membership-lifecycle,authorization-rbac}.md
First business domain slice (Sprint 2). Products with categories, units of measure, and archive/restore semantics; inventory locations; movement-based stock with receipts, issues, transfers, and counts as idempotent operations. Quantities and prices use exact scaled-decimal value objects rather than floating point (ADR 0033). Includes the API routes for the platform and inventory features and the tests covering domain rules and HTTP behavior.
…acts and agent skills Adds ADRs 0029-0033 (membership/invitation lifecycle, organization- scoped RBAC, framework upgrade, TOTP MFA, catalogue and inventory foundation), engineering guides for membership lifecycle and RBAC, and refreshes architecture, development, and security docs for Laravel 12 / Next.js 15 and the new platform features. Grows the OpenAPI v1 contract with the new endpoints plus a route-diff script. Tracks the installed agent skill packs under .agents/ with skills-lock.json and ignores local agent state (.claude/). Also corrects the stale debt-register remote status and README implementation status lines.
The lockfile was resolved with npm 11 semantics; npm ci on CI's Node 20 / npm 10 rejected it as out of sync with package.json (missing @emnapi entries), failing the Web job and the CodeQL javascript autobuild, which also runs npm ci. Regenerated with npm 10 and verified with a full npm@10 ci install followed by typecheck locally.
The function cast bigint expressions to bytea, which PostgreSQL 16 does not support, so it failed at first call and the Infrastructure CI job has been red since it was added. The bytea-to-uuid return cast was invalid as well. Build the timestamp half with substring(int8send(ts) from 3 for 6) (low 48 bits, big-endian) and return via encode(..., 'hex')::uuid. Verified against the local PostgreSQL 16 container: version nibble 7, RFC 4122 variant, 5000/5000 unique ids, ms-epoch timestamp prefix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Lands the accumulated platform and domain work in four ordered commits:
Verification
Notes for review