Release v0.5.0

Release v0.5.0 🚀

A monumental architectural release that transforms the identity & access security model, decouples IAM into three strictly isolated bounded contexts (Identity, Authentication, Authorization), eliminates cross-module database coupling, implements enterprise-grade IDOR protection, and introduces database seeding alongside automated CI/CD quality gates.

This release touches 511 files (~19,240 insertions / ~6,960 deletions) across the entire codebase.

---

🌟 Highlights

🏛️ IAM Architecture Restructure (DDD Bounded Context Split)

• 3-Way Decoupled IAM Engine: Replaced the legacy monolithic Auth and Access modules with three strictly isolated bounded contexts:
  • Identity (User, Address): Answers "Who is this user?"
  • Authentication (Credential, SessionToken): Answers "Can they prove their identity?"
  • Authorization (Role, Permission, UserRoleAssignment): Answers "What are they allowed to do?"
• Zero Cross-Module ORM Coupling: Removed all TypeORM entity relations (@ManyToOne, @OneToMany, @JoinColumn) across module boundaries. Cross-module entity references now strictly use plain primitive foreign keys (userId: number), making future microservice extraction a deployment configuration change rather than a code rewrite.
• Credential & Gateway Security Leak Elimination: Extracted sensitive Credential domain logic into Authentication. Stripped passwordHash and roleId from cross-module ACL Gateways, ensuring hashes and internal authorization structures never leak across boundaries.
• Explicit DI Boundary: Removed the @Global() decorator from AuthenticationModule to enforce strict Dependency Inversion and explicit module registration.

🛡️ IDOR (Insecure Direct Object Reference) Prevention & Resource Ownership

• Caller Context System: Built a thread-safe CallerContext propagation model throughout the application layer to convey caller identity and privileges without coupling use cases to HTTP.
• Resource Access Policies: Created OwnedResourceAccessPolicy in shared-kernel to enforce entity-level ownership validation for orders, carts, payments, and addresses.
• Guest & User Cart Session Validation: Implemented CartOwnershipValidator with JWT cart session tokens (header + HttpOnly cookie fallback) for guest cart protection and seamless login upgrades.
• IDOR E2E Regression Suite: Added automated full-app HTTP IDOR regression tests (test/security-idor.e2e-spec.ts) to verify unauthorized resource access attempts are rejected with 403 Forbidden.

🧬 Strict Type Safety & Hexagonal Architecture Guarding

• TypeORM Relation<T> Sweep: Refactored all entity schema associations across modules to use TypeORM's explicit Relation<T> wrapper, preventing circular reference type bugs.
• TypeScript Strictness: Enabled isolatedModules in tsconfig.json and introduced npm run typecheck into CI.
• ArchUnit Architectural Tests: Integrated ArchUnit test suites (npm run test:arch) to statically enforce DDD layer rules, mapper conventions, and gateway boundaries, preventing architectural decay automatically.

🌱 Database Seeding & Developer Experience

• CLI Seeding Suite: Built npm run db:seed powered by module-scoped seed use cases to generate realistic demo environments containing admin accounts, customer profiles, catalog categories, 15+ products, and stock reservations.
• Simplified Local Onboarding: Streamlined environment initializers and added a "5-Minute Project Review" guide to the README.

⚙️ CI/CD Pipeline Hardening

• Optimized GitHub Actions: Refactored .github/workflows/ with shared dependency caching (node_modules), parallelized matrix jobs (linting, typechecking, unit testing, building), and modern action versions.

---

📊 Release Stats

Metric	Value
Files Changed	511
Insertions	~19,244
Deletions	~6,963
Isolated Bounded Contexts	10 (Identity, Authentication, Authorization, Carts, Inventory, Orders, Payments, Products, Notifications, Health)
IDOR Protection Tests	100% End-to-End Covered
Module FK Coupling	0% (Primitive column refs only)

---

📝 Key Commits

Hash	Description
4c33cc4	test(arch): enforce cross-module isolation
a20080a	refactor(auth): refactor Authentication module seed use cases and tests
2de1cd7	refactor(iam): split Access module into Identity and Authorization modules
da71886	refactor(iam): enhance Identity and Authorization management
3d71886	feat(authorization): implement Authorization module with Role and Permission management
019f7f5	feat(authentication): introduce Credential management in Authentication module
da65869	refactor(user): standardize user management terminology and permissions across modules
b277ad4	feat(security): implement ownership-based access control for IDOR prevention
463d4c2	feat(carts): implement cart session token management
1350bcb	test(security): add IDOR regression tests for enhanced security validation
df1d896	ci: optimize workflow with shared node_modules cache
b868dcf	refactor(ts): enforce strict TypeScript and refactor TypeORM relations
907eb98	test(arch): enhance architecture testing with ArchUnit integration
55cd235	feat(db): add database seeding functionality and documentation

---

Full Changelog: v0.4.1...v0.5.0