Refactor using AWS Ai Development software lifecycle

Release Notes: AI-DLC Refactoring v2.0

This release documents the completion of the AI-Driven Development Lifecycle (AI-DLC) refactoring on the project.

---

📋 AI-DLC Execution Summary

Phase	Status
Inception	✅ Complete
Construction (Units 1–4)	✅ Complete
Operations	✅ Closed

Inception Phase

• Workspace Detection
• Reverse Engineering
• Requirements Analysis
• Workflow Planning
• Units Generation

Construction Phase

Unit	Scope	Status
Unit 1	Core & Models	✅ Done
Unit 2	Middlewares	✅ Done
Unit 3	Controllers	✅ Done
Unit 4	Routes	✅ Done

---

🛠️ What's Changed

Unit 4: Routes (Primary Deliverable)

• Renamed ressources.ts → resources.ts and corrected all paths from /ressources to /resources
• Deleted 4 legacy .js route files (auth.js, helpers.js, index.js, ressources.js)
• Fixed auth.ts register schema: corrected username property to email
• Added JSON Schema response validation for /resources/* endpoints
• Added querystring + response schemas for /helpers/pkce and /helpers/callback
• Updated tests to use /resources instead of deprecated /ressources

TypeScript Migration

• Rewrote tsconfig.json with proper skipLibCheck, bun-types, allowImportingTsExtensions, and noEmit
• Removed 3 stale .js files in src/core/ (env.js, types.js, utils.js)
• Fixed server.ts error handler typing for strict TypeScript compliance
• Improved tests/utils/request.ts return types

Linting Overhaul

• Migrated from .eslintrc (legacy) to eslint.config.js (flat config)
• Adopted @poool/eslint-config as the shared lint standard
• Removed old dependencies: eslint-config-airbnb-base, @typescript-eslint/* v7
• Added @eslint/js as an explicit peer dependency for CI stability
• Resolved ESLint 9.x / @poool/eslint-config / typescript-eslint version matrix incompatibilities
• Generated bun.lock for reproducible dependency installs

CI/CD Modernization

• Migrated CI from Node.js/Yarn to Bun (oven-sh/setup-bun@v2)
• Replaced matrix Node builds with a single Bun runner
• Fixed dynamic port allocation (port: 0) in tests to avoid hardcoded 3000 conflicts
• Fixed test request helper so GET no longer sends a body
• Fixed package.json formatting (removed trailing comma that caused mongodb-memory-server JSON parse crash)

Security Hardening

• Authorization middleware now explicitly validates the Bearer scheme instead of accepting any scheme (e.g. Basic)
• generateAccessToken now reads PRIVATE_KEY dynamically from process.env at call time instead of caching it at module load — prevents silent failures when .env is missing

---

🧪 Test Results

bun test v1.2.0

✓ /helpers > PKCE generation
✓ /auth > authenticate (password grant)
✓ /auth > authenticate (password grant) > unknown user
✓ /auth > authenticate (password grant) > invalid grant
✓ /auth > authenticate (refresh_token grant)
✓ /auth > authenticate (client_credentials grant)
✓ /resources > GET unrestricted
✓ /resources > GET restricted

8 pass · 0 fail · 19 assertions

---

⚠️ Breaking Changes

• CI now requires Bun instead of Node.js + Yarn.

v2.0.0

🥊 Refactor:

• This is now a fastify API using typescript.

✨ New features:

• A postman library available in the README to test api endpoints
• A fancy (😂) new name
• An adaptation to new OAuth 2.1 standards such as:
  1 - authorization_code grant type using a third party provider (github & google)
  2 - client_credentials grant type to authenticate registered clients (like front-end applications)
  3 - PKCE process for google authorization code flow