v0.7.0 Shopper catalog, categories, and analytics

Release v0.7.0

This cut adds categories, product activate/deactivate, HTTP role assignment, addresses on user detail, read-only admin analytics, shopper catalog GETs, and OpenAPI tooling that matches the handlers.

Shopper catalog list and detail no longer require view_all_products. Anonymous and CUSTOMER callers see active products and categories only. Checkout still uses the mock payment adapter. The public URI remains /v1.

Scope

In this release	Not in this release
Categories, product activate/deactivate, assign role, user addresses on GET user	Live payment provider (mock adapter only)
Shopper catalog reads (active-only; operators with view_all_products keep the full catalog)	Email delivery, abandoned-cart jobs, outbound webhooks
Admin analytics query module; OpenAPI generate/audit tooling aligned with runtime handlers	Multi-instance (outbox, distributed job locks)
Forced password rotation, npm run setup, observability compose split	Hosted staging

Catalog

• Category aggregate, Postgres persistence, seed data, and REST under /v1/categories.
• Product create/update validates categoryId. List responses include categoryName.
• GET /v1/products, GET /v1/products/:id, and the matching category reads use optional authentication.
• CatalogVisibilityPolicy forces isActive=true for callers without view_all_products. Inactive detail is HTTP 404 for shoppers. Operators with that permission keep list filters and can load inactive records.
• Product and category mutations still require manage_products.
• Covered by test/e2e/products/catalog-read-path.e2e-spec.ts.

Operator HTTP

• POST /v1/products/:id/activate and POST /v1/products/:id/deactivate.
• Assign/replace a user's role over HTTP.
• GET /v1/users/:id returns addresses[] (no extra collection route).
• access_admin permission so operator clients can gate their chrome.
• Orders list query: date and amount filters plus documented sort options.
• Inventory, products, orders, payments, and users: response DTOs and pagination match what the handlers return.

Analytics

Read-only AnalyticsModule at /v1/admin/analytics/*. SQL projections across orders, payments, inventory, and order items. No write aggregates and no ACL fan-out for KPIs.

Decision record: docs/architecture/adr/ADR-0007-admin-analytics-query-composition.md.

Demo seed now links payments and inventory to demo orders so analytics numbers are coherent locally.

Auth and throttling

• Seeded/bootstrap credentials set mustChangePassword. Login and refresh return the flag. POST /v1/authentication/change-password clears it, revokes other sessions, and reissues tokens.
• MustChangePasswordGuard returns HTTP 403 (MUST_CHANGE_PASSWORD) on other authenticated routes until rotation. E2E: test/e2e/auth/must-change-password.e2e-spec.ts.
• One global throttle profile for all routes. Auth credential routes tighten that profile with @Throttle. A second named profile is not registered, so a "strict" limit is not applied everywhere.

Contracts and local ops

• npm run generate:openapi and npm run audit:openapi so Swagger types, nullability, and copy stay aligned with handlers.
• npm run setup writes env files, starts Postgres and Redis, runs migrations, and seeds fixtures.
• env:init keeps host ports from .env.example instead of remapping them. CORS_ALLOWED_ORIGINS is generated for local clients.
• Observability stack (Grafana, Loki, Tempo, Prometheus) is a separate Compose profile, not required to run the API.

Stats

Metric	Value
Since	v0.6.0
Files changed	423
Insertions / deletions	+15,290 / -2,914
Commits	180 (160 excluding merges)
HTTP e2e suites	9
New ADR	ADR-0007

Pull requests

PR	Title
#205	Category domain, REST, and catalog integration
#202	Host-native environment bootstrap
#201	User address book on GET user detail
#200	Product activation and admin role endpoints
#199	Orders list date and amount filters
#198	Published OpenAPI spec aligned with runtime handlers
#195	Analytics endpoints and demo payment seeds
#194	Users OpenAPI aligned with CQRS reads
#193	Orders and payments OpenAPI response contracts
#192	Stop applying a strict throttler profile on every route
#191	Inventory OpenAPI list and adjust responses
#190	Permission to access the operator admin dashboard
#189	Product OpenAPI contract and list pagination
#187 / #188	env-init ports and CORS origins
#186	Forced credential rotation
#183	Observability Compose split
#181	README and architecture docs cleanup

Shopper catalog visibility (CatalogVisibilityPolicy and the catalog e2e) landed on release-v0-7-0 after #205.

Full changelog: v0.6.0...v0.7.0