# sessions

id: TXJxxGeJatKTpIJ0BD0otlIIfbnn6Xjl3Z41MpMO
ip_address: 216.73.216.119
user_agent:
  Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)

payload:
  YTozOntzOjY6Il90b2tlbiI7czo0MDoiR3QyTGFRRlhxcFhjZk0yOFpESU9XbTFqQkFIdkJnSjg3SDRad2haeSI7czo5OiJfcHJldmlvdXMiO2E6Mjp7czozOiJ1cmwiO3M6MzY6Imh0dHBzOi8vdGFza2x5cHJvLmFwcC9iYWNrZW5kL3B1YmxpYyI7czo1OiJyb3V0ZSI7Tjt9czo2OiJfZmxhc2giO2E6Mjp7czozOiJvbGQiO2E6MDp7fXM6MzoibmV3IjthOjA6e319fQ==


# sprints

id: 019c57fd-b101-7176-9f9b-dd76dc5267af
project_id: 019c57fd-af9e-7327-9b3f-6671d4336f11
name: Sprint 1: Foundation, Multi-Tenancy & Auth
start_date: 2026-02-13 00:00:00
end_date: 2026-02-27 00:00:00
status: planning
created_at: 2026-02-13 17:12:49
updated_at: 2026-02-13 17:12:49
goal:
  Establish the Laravel backend foundation with secure tenant-aware authentication and authorization as the base for all features.


id: 019c5808-21a8-7296-bfce-2381b3604639
project_id: 019c5808-204c-712d-88e8-706477d679bc
name: Sprint 1: Foundation, Multi-Tenancy & Auth
start_date: 2026-02-13 00:00:00
end_date: 2026-02-27 00:00:00
status: planning
created_at: 2026-02-13 17:24:13
updated_at: 2026-02-13 17:24:13
goal:
  Establish the Laravel API foundation with secure tenant isolation, authentication, and role-based access control.


id: 019c5808-3532-70fd-938d-411801846a18
project_id: 019c5808-204c-712d-88e8-706477d679bc
name: Sprint 3: Domain Data Model & Read APIs
start_date: 2026-03-13 00:00:00
end_date: 2026-03-27 00:00:00
status: planning
created_at: 2026-02-13 17:24:18
updated_at: 2026-02-13 17:24:18
goal:
  Implement tenant-scoped commerce entities and expose core read/update APIs for orders, products, and costs.


id: 019c5808-4046-7340-bb9b-8e1badae0119
project_id: 019c5808-204c-712d-88e8-706477d679bc
name: Sprint 4: Async Sync Engine & Incremental Imports
start_date: 2026-03-27 00:00:00
end_date: 2026-04-10 00:00:00
status: planning
created_at: 2026-02-13 17:24:21
updated_at: 2026-02-13 17:24:21
goal:
  Deliver robust queued synchronization for orders, products, and stock with incremental/full modes and idempotent upserts.


id: 019c5808-4a8c-70c2-9b67-5945bcde4143
project_id: 019c5808-204c-712d-88e8-706477d679bc
name: Sprint 5: Reporting, Observability & Owner Tools
start_date: 2026-04-10 00:00:00
end_date: 2026-04-24 00:00:00
status: planning
created_at: 2026-02-13 17:24:24
updated_at: 2026-02-13 17:24:24
goal:
  Provide operational profit reporting, sync visibility, retry tooling, and tenant owner user-management capabilities.


# tasks

id: 019c5808-22ea-73f7-9242-39833b55c799
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-21a8-7296-bfce-2381b3604639
title: Initialize Laravel API project and core architecture
status: done
priority: high
tags: ["backend","api","architecture"]
assigned_to: ai
created_at: 2026-02-13 17:24:14
updated_at: 2026-02-13 17:48:03
description:
  Set up Laravel project structure, environment configs, API versioning conventions, base exception handling, and shared response format for frontend consumption.

work_log:
  [2026-02-13T17:48:03+00:00] Completed: Completed Laravel 12 backend foundation in new backend/ app. Implemented API routing/versioning via routes/api.php + config/api.php (v1), standardized API response envelope (App\Support\ApiResponse), request ID middleware (AttachRequestId with validation + response propagation), centralized API exception rendering in bootstrap/app.php for api/* requests, and versioned health endpoint (/api/v1/health). Added/updated tests covering envelope behavior, request-id handling, and non-API default errors. Ran verification: composer test (pass, 6 tests) and php artisan optimize (pass). Added docs in backend/docs: README.md, api-foundation.md, development-commands.md, CHANGELOG.md.


id: 019c5808-2474-72f5-9e72-d269f45f9b85
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-21a8-7296-bfce-2381b3604639
title: Design and migrate tenant-scoped core tables
status: done
priority: high
tags: ["database","multitenancy","backend"]
assigned_to: ai
created_at: 2026-02-13 17:24:14
updated_at: 2026-02-13 17:57:02
description:
  Create migrations for tenants, users, roles, user_tenant mapping (if needed), and base tenant_id strategy across domain tables with indexes.

work_log:
  [2026-02-13T17:57:02+00:00] Completed: Implemented tenant-scoped core schema and relationships end-to-end. Added migrations for tenants, roles, tenant_user, role_user, plus users.active_tenant_id with indexes and foreign keys. Introduced a reusable Blueprint tenantColumn macro for tenant_id strategy in AppServiceProvider. Added and updated Eloquent models (Tenant, Role, User) with tenant-aware relationships. Strengthened tenant isolation in role assignments via composite foreign keys (tenant+user and tenant+role consistency). Added comprehensive schema/integrity tests in tests/Feature/TenantSchemaTest.php. Verification passed: php artisan migrate:fresh, composer test (12 tests passing), php artisan optimize. Updated docs in backend/docs (multi-tenancy-schema.md, README.md, development-commands.md, CHANGELOG.md).


id: 019c5808-2592-7353-8792-59d5e0d38188
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-21a8-7296-bfce-2381b3604639
title: Implement authentication endpoints
status: done
priority: high
tags: ["auth","api","security"]
assigned_to: ai
created_at: 2026-02-13 17:24:14
updated_at: 2026-02-13 18:07:13
description:
  Build POST /auth/login, POST /auth/logout, and GET /me using Sanctum or JWT with secure token lifecycle handling.

work_log:
  [2026-02-13T18:07:13+00:00] Completed: Implemented Sanctum-based authentication endpoints end-to-end. Installed/published Sanctum (config + personal_access_tokens migration), enabled stateful API middleware, and added routes: POST /api/v1/auth/login, POST /api/v1/auth/logout, GET /api/v1/me. Built login flow with LoginRequest validation, LoginUserAction, and AuthController using standardized ApiResponse envelope. Implemented secure token lifecycle: rotate same-device token on login, return bearer token metadata, revoke current token on logout, support session logout path for stateful requests. Added AuthUserResource for response shaping, login rate limiter (5/min by email+IP), env/config defaults for token expiration/prefix, and User model HasApiTokens integration. Added comprehensive tests in tests/Feature/AuthEndpointsTest.php and updated composer test script to clear route cache before running tests. Verification passed: composer test (20 tests, 66 assertions) and php artisan optimize. Updated docs under backend/docs including auth contract + changelog.


id: 019c5808-26f0-7020-b7de-091da6164bb7
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-21a8-7296-bfce-2381b3604639
title: Implement tenant registration and current tenant endpoints
status: done
priority: medium
tags: ["api","multitenancy","backend"]
assigned_to: ai
created_at: 2026-02-13 17:24:15
updated_at: 2026-02-13 19:15:09
description:
  Build POST /tenants for self-signup flow and GET /tenants/current for authenticated tenant context retrieval.

work_log:
  [2026-02-13T19:15:09+00:00] Completed: Implemented tenant registration and current-tenant APIs end-to-end. Added `POST /api/v1/tenants` and `GET /api/v1/tenants/current` routes in `routes/api.php`; current-tenant endpoint is protected with `auth:sanctum` + `tenant:true`. Built registration workflow via `RegisterTenantRequest`, `RegisterTenantAction`, `TenantController`, and `TenantResource`. Registration now creates tenant + owner user, tenant membership (`is_owner`), baseline roles (`owner/staff/viewer`) from RBAC config, and owner role assignment; owner active_tenant is set. Added register throttling (`throttle:register`) and new `register` rate limiter in `AppServiceProvider`. Hardened slug conflict handling with retry-on-unique-violation to safely resolve concurrent slug collisions using incremental suffixes. Added comprehensive feature tests in `tests/Feature/TenantEndpointsTest.php` for success flow, slug conflicts, validation, throttling, auth, tenant header behavior, invalid header, and inactive tenant rejection. Verification passed: `composer test` (41 tests, 142 assertions) and `php artisan optimize`. Ran gpt53-code-reviewer loop to approval (approve with minor notes). Updated docs via codex53-documenter: added `docs/api/tenants.md`, updated `docs/README.md`, and appended `docs/CHANGELOG.md`.


id: 019c5808-27fc-7160-a30d-f13347cf663d
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-21a8-7296-bfce-2381b3604639
title: Enforce tenant scoping middleware and global scope
status: done
priority: high
tags: ["multitenancy","security","backend"]
assigned_to: ai
created_at: 2026-02-13 17:24:15
updated_at: 2026-02-13 18:15:19
description:
  Add middleware and model-level global scopes to ensure all tenant data access is restricted by authenticated tenant context.

work_log:
  [2026-02-13T18:15:19+00:00] Completed: Implemented tenant scoping middleware and model-level global scoping with security hardening. Added TenantContext service + scoped container binding, ResolveTenantContext middleware (alias: tenant), strict X-Tenant-Id validation, tenant membership checks, and active-tenant validation. Attached required tenant middleware (`tenant:true`) to GET /api/v1/me and propagated X-Tenant-Id response header. Added BelongsToTenant concern with fail-closed authenticated reads, tenant-enforced creates, and mismatch protection; applied it to Role model and removed tenant_id from fillable to prevent spoofing. Added/updated tests: TenantScopingTest plus adjustments in AuthEndpointsTest and TenantSchemaTest. Verification passed: composer test (24 tests, 75 assertions) and php artisan optimize. Updated docs: tenant-scoping.md, authentication docs, multi-tenancy docs, docs index, changelog.


id: 019c5808-2912-7313-9f5c-977a847d7c84
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-21a8-7296-bfce-2381b3604639
title: Implement RBAC for Owner, Staff, Viewer
status: done
priority: high
tags: ["auth","security","backend"]
assigned_to: ai
created_at: 2026-02-13 17:24:15
updated_at: 2026-02-13 19:06:43
description:
  Define role permissions and enforce via policies/gates for user management, sync operations, and sensitive store credential actions.

work_log:
  [2026-02-13T19:06:43+00:00] Completed: Implemented tenant-scoped RBAC for Owner/Staff/Viewer end-to-end. Added role-to-ability mapping config (`config/rbac.php`), tenant authorization policies (`TenantUserPolicy`, `SyncPolicy`, `StoreCredentialPolicy`), gate registration in `AppServiceProvider`, and `tenant-ability` middleware (`EnsureTenantAbility`) with alias registration in `bootstrap/app.php`. Extended `User` model with `hasTenantAbility()` and tenant role resolution using tenant-scoped role assignments, membership checks, and inactive-tenant denial. Added comprehensive feature coverage in `tests/Feature/RbacAuthorizationTest.php` for role matrix, tenant isolation, middleware allow/deny, missing tenant context, and inactive tenant behavior. Ran verification: `composer test` (32 tests, 97 assertions passing) and `php artisan optimize` (success). Ran code review cycle with gpt53-code-reviewer; addressed requested hardening changes and got verdict 'approve with minor notes'. Updated docs via codex53-documenter: added `docs/rbac.md`, updated `docs/README.md`, and appended `docs/CHANGELOG.md`.


id: 019c5808-2a2f-72d6-abfc-7703ffa5e77c
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-21a8-7296-bfce-2381b3604639
title: Seed baseline roles and create auth integration tests
status: done
priority: medium
tags: ["testing","auth","multitenancy"]
assigned_to: ai
created_at: 2026-02-13 17:24:16
updated_at: 2026-02-13 19:24:47
description:
  Add seeders for default roles and write feature tests for login, tenant isolation, and role access boundaries.

work_log:
  [2026-02-13T19:24:47+00:00] Completed: Completed baseline role seeding and auth integration coverage. Added `database/seeders/BaselineRolesSeeder.php` to seed tenant roles from `config/rbac.php` idempotently across all existing tenants (using upsert without mutating existing `created_at`). Updated `database/seeders/DatabaseSeeder.php` to call baseline role seeding. Added integration feature tests in `tests/Feature/AuthRbacIntegrationTest.php` to verify login-issued tokens respect tenant isolation and role boundaries on RBAC-protected routes. Added `tests/Feature/BaselineRolesSeederTest.php` for seeding behavior and idempotency, deriving expected role sets from config. Verification passed: `composer test` (46 tests, 156 assertions) and `php artisan optimize`. Ran gpt53-code-reviewer loop to 'approve with minor notes'. Updated docs via codex53-documenter in `docs/rbac.md`, `docs/README.md`, and `docs/CHANGELOG.md`.


id: 019c5808-2d00-71de-b2dd-88e4ce25df55
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-2bf5-73b5-b7d5-4c6840e2982d
title: Create store connection data model and migrations
status: done
priority: high
tags: ["database","backend","multitenancy"]
assigned_to: ai
created_at: 2026-02-13 17:24:16
updated_at: 2026-02-13 19:30:44
description:
  Add tenant-scoped store connection schema including base_url, token (encrypted), store/website mapping, and sync option flags.

work_log:
  [2026-02-13T19:30:44+00:00] Completed: Implemented store connection data model and migration end-to-end. Added `store_connections` schema migration (`2026_02_13_190001_create_store_connections_table.php`) with tenant scoping, connection metadata, sync flags, `last_tested_at`, and uniqueness constraints on (`tenant_id`,`name`) and (`tenant_id`,`endpoint_fingerprint`). Added `App\Models\StoreConnection` with `BelongsToTenant`, encrypted `api_token` cast, hidden sensitive fields (`api_token`, `endpoint_fingerprint`), normalized endpoint fingerprint generation on save, and tenant relation. Extended `Tenant` model with `storeConnections()` relation. Added comprehensive feature coverage in `tests/Feature/StoreConnectionSchemaTest.php` for schema columns, uniqueness semantics (including empty-code edge case), cross-tenant behavior, encryption-at-rest, hidden serialization fields, and tenant global-scope filtering. Verification passed: `composer test` (53 tests, 166 assertions) and `php artisan optimize`. Ran gpt53-code-reviewer loop to final verdict 'approve'. Updated docs via codex53-documenter: added `docs/store-connections.md`, updated `docs/multi-tenancy-schema.md`, `docs/README.md`, and appended `docs/CHANGELOG.md`.


id: 019c5808-2e1b-73b5-8c69-7ac076f2ac0f
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-2bf5-73b5-b7d5-4c6840e2982d
title: Build store connection CRUD APIs
status: done
priority: high
tags: ["api","backend","multitenancy"]
assigned_to: ai
created_at: 2026-02-13 17:24:17
updated_at: 2026-02-13 19:42:27
description:
  Implement tenant-aware endpoints for creating, updating, listing, and deleting Magento store connections with policy checks.

work_log:
  [2026-02-13T19:42:27+00:00] Completed: Implemented tenant-aware Magento store connection CRUD APIs end-to-end. Added `/api/v1/stores` routes for GET/POST/PATCH/DELETE with `auth:sanctum` + `tenant:true`, numeric route constraints on update/delete IDs, and controller implementation in `StoreConnectionController`. Added request validation classes (`StoreConnectionStoreRequest`, `StoreConnectionUpdateRequest`) with normalized endpoint fingerprint computation and request-level uniqueness validation to return 422 on duplicate endpoint mappings. Added `StoreConnectionResource` response shaping (no sensitive token exposure). Added `StoreConnectionPolicy` with role boundary enforcement: owner full CRUD, staff list-only, viewer denied; registered policy mapping in `AppServiceProvider`. Hardened authorization error envelope consistency and scoped update-validation lookup by tenant context. Added comprehensive API tests in `tests/Feature/StoreConnectionCrudTest.php` for owner CRUD flow, staff/viewer restrictions, tenant isolation, non-numeric route behavior, and duplicate endpoint validation. Verification passed: `composer test` (59 tests, 207 assertions) and `php artisan optimize`. Ran gpt53-code-reviewer loop to final verdict 'approve with minor notes'. Updated docs via codex53-documenter: added `docs/api/store-connections.md`, updated `docs/README.md`, `docs/api-foundation.md`, and appended `docs/CHANGELOG.md`.


id: 019c5808-2ff6-71b9-a425-f5ff371ca630
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-2bf5-73b5-b7d5-4c6840e2982d
title: Implement POST /stores/{id}/test-connection
status: done
priority: high
tags: ["api","integration","magento"]
assigned_to: ai
created_at: 2026-02-13 17:24:17
updated_at: 2026-02-13 19:55:51
description:
  Add service call to Magento API health endpoint to validate URL/token and return actionable validation results.

work_log:
  [2026-02-13T19:55:51+00:00] Completed: Implemented `POST /stores/{id}/test-connection` end-to-end with security hardening and actionable output. Added route `POST /api/v1/stores/{storeConnection}/test-connection` (numeric ID constraint) in `routes/api.php`, protected by tenant auth context and store-credential authorization (owner/manage credentials only), plus endpoint-specific throttling (`throttle:stores-test-connection`). Added `MagentoConnectionTester` service to probe Magento authenticated endpoint and return structured actionable checks/statuses (`ok`, `unauthorized`, `insufficient_permissions`, `invalid_endpoint`, `network_error`, `invalid_url`, `blocked_host`, `request_failed`). Added runtime security guards to prevent credential exfiltration/SSRF: HTTPS enforcement, localhost/private/reserved host blocking, A+AAAA DNS validation, and fail-closed behavior on unresolved hosts. Enforced HTTPS base URLs in store create/update requests (`url:https`). Endpoint persists `last_tested_at` after probe attempts. Added comprehensive tests in `tests/Feature/StoreConnectionTestConnectionTest.php` for success, unauthorized token, network failure, invalid URL, blocked host, and role restriction; updated store CRUD tests for HTTPS validation. Verification passed: `composer test` (66 tests, 248 assertions) and `php artisan optimize`. Ran gpt53-code-reviewer loop to final verdict 'approve with minor notes'. Updated docs via codex53-documenter in `docs/api/store-connections.md`, `docs/store-connections.md`, `docs/api-foundation.md`, `docs/README.md`, and `docs/CHANGELOG.md`.


id: 019c5808-3134-716a-9a0a-60e2fb281385
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-2bf5-73b5-b7d5-4c6840e2982d
title: Add credential encryption and rotation workflow
status: done
priority: high
tags: ["security","integration","backend"]
assigned_to: ai
created_at: 2026-02-13 17:24:17
updated_at: 2026-02-13 19:46:50
description:
  Encrypt stored Magento tokens at rest, implement token update/rotation flow, and ensure old secrets are revoked logically.

work_log:
  [2026-02-13T19:46:50+00:00] Completed: Implemented credential encryption and rotation workflow enhancements for store credentials. Added migration `2026_02_13_190100_add_token_rotated_at_to_store_connections_table.php` introducing `store_connections.token_rotated_at`. Updated `StoreConnection` model to set `token_rotated_at` whenever `api_token` is written/rotated, while keeping `api_token` encrypted at rest and hidden from serialization. Updated `StoreConnectionResource` to expose rotation metadata (`token_rotated_at`) without exposing secrets. Strengthened workflow coverage by extending store CRUD/schema tests to verify rotation timestamp behavior during token updates plus existing encryption-at-rest and non-leakage guarantees. Verification passed: `composer test` (59 tests, 210 assertions) and `php artisan optimize`. Ran gpt53-code-reviewer with verdict 'approve with minor notes'. Updated docs via codex53-documenter in `docs/store-connections.md`, `docs/api/store-connections.md`, `docs/multi-tenancy-schema.md`, `docs/README.md`, and `docs/CHANGELOG.md`.


id: 019c5808-326b-70c1-9b13-6130489ba458
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-2bf5-73b5-b7d5-4c6840e2982d
title: Create Magento API client abstraction
status: done
priority: medium
tags: ["integration","backend","magento"]
assigned_to: ai
created_at: 2026-02-13 17:24:18
updated_at: 2026-02-13 20:02:39
description:
  Build reusable client with tenant/store context, common request methods, error normalization, and auth header handling.

work_log:
  [2026-02-13T20:02:39+00:00] Completed: Implemented reusable Magento API client abstraction and integrated it into connection testing flow. Added `App\Services\Magento\MagentoApiClient` with shared `get`/`post` helpers, tenant/store-context tokenized requests, normalized result contract (`ok`, `status_code`, `data`, `error.code`, `error.message`, `error.retryable`), and error normalization (`unauthorized`, `forbidden`, `not_found`, `validation_error`, `rate_limited`, `server_error`, `network_error`, `redirect_blocked`, etc.). Added outbound security controls in client: HTTPS enforcement, redirect blocking (`withoutRedirecting`), and fail-closed host validation using A+AAAA DNS checks to block localhost/private/reserved targets. Refactored `MagentoConnectionTester` to consume `MagentoApiClient` and preserve actionable test-connection statuses. Verified integration with updated store connection request validation and route throttling. Added feature coverage in `tests/Feature/MagentoApiClientTest.php` for success, unauthorized, network, retryable 5xx, blocked host, and redirect handling; updated connection tests accordingly. Verification passed: `composer test` (72 tests, 272 assertions) and `php artisan optimize`. Ran gpt53-code-reviewer loop to final verdict 'approve with minor notes'. Updated docs via codex53-documenter: added `docs/magento-api-client.md` and updated linked docs/changelog (`docs/store-connections.md`, `docs/api/store-connections.md`, `docs/README.md`, `docs/CHANGELOG.md`).


id: 019c5808-340e-72e6-81d9-669a8cd7ff78
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-2bf5-73b5-b7d5-4c6840e2982d
title: Add connection and permission tests
status: done
priority: medium
tags: ["testing","api","security"]
assigned_to: ai
created_at: 2026-02-13 17:24:18
updated_at: 2026-02-13 20:02:54
description:
  Write feature and integration tests for store CRUD, tenant isolation, test-connection behavior, and credential update paths.

work_log:
  [2026-02-13T20:02:54+00:00] Completed: Completed via expanded automated coverage delivered during store connection implementation work. Added/extended feature tests covering exactly this task scope: `tests/Feature/StoreConnectionCrudTest.php` (store CRUD role permissions, tenant isolation on update/delete, duplicate endpoint validation, HTTPS validation, credential update/rotation paths), `tests/Feature/StoreConnectionTestConnectionTest.php` (test-connection success, unauthorized token, network errors, blocked host, invalid URL, and staff permission denial), and supporting integration tests (`tests/Feature/MagentoApiClientTest.php`) for normalized Magento client behavior. Verification passed with full suite: `composer test` (72 tests, 272 assertions) and `php artisan optimize`.


id: 019c5808-3662-71ef-9583-d487fae9cf27
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-3532-70fd-938d-411801846a18
title: Create migrations for products, orders, order_items, customers
status: pending
priority: high
tags: ["database","backend","orders","products"]
created_at: 2026-02-13 17:24:19
updated_at: 2026-02-13 17:24:19
description:
  Define normalized tenant-scoped schema with store linkage, external Magento identifiers, and required indexes for filters.


id: 019c5808-37d6-709a-988c-5b23b651985c
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-3532-70fd-938d-411801846a18
title: Add stock snapshots/movements and cost configuration tables
status: pending
priority: high
tags: ["database","inventory","accounting"]
created_at: 2026-02-13 17:24:19
updated_at: 2026-02-13 17:24:19
description:
  Create stock tracking tables and product cost fields/configs with optional shipping/payment fee configuration placeholders for MVP.


id: 019c5808-395f-713e-a588-e70037a716f2
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-3532-70fd-938d-411801846a18
title: Implement idempotency constraints for imported entities
status: pending
priority: high
tags: ["database","sync","reliability"]
created_at: 2026-02-13 17:24:19
updated_at: 2026-02-13 17:24:19
description:
  Add unique keys for order increment_id + store and product sku + store to support safe reruns without duplicates.


id: 019c5808-3aad-72c1-bcef-fd6c9f1dbe44
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-3532-70fd-938d-411801846a18
title: Build GET /orders and GET /orders/{id}
status: pending
priority: medium
tags: ["api","orders","backend"]
created_at: 2026-02-13 17:24:20
updated_at: 2026-02-13 17:24:20
description:
  Implement filtered order listing (date, status, search) and detailed order endpoint with items and computed fields.


id: 019c5808-3c6b-71d6-a705-32495a270a6b
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-3532-70fd-938d-411801846a18
title: Build GET /products and PATCH /products/{id}/cost
status: pending
priority: medium
tags: ["api","products","accounting"]
created_at: 2026-02-13 17:24:20
updated_at: 2026-02-13 17:24:20
description:
  Implement product listing filters (sku, name, low_stock) and secure endpoint for Owner/Staff to update product cost.


id: 019c5808-3d86-7393-bf23-4dcce704a214
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-3532-70fd-938d-411801846a18
title: Implement request validation and API resources
status: pending
priority: medium
tags: ["api","backend","quality"]
created_at: 2026-02-13 17:24:20
updated_at: 2026-02-13 17:24:20
description:
  Add form requests, transformers/resources, and consistent pagination/meta response patterns across data endpoints.


id: 019c5808-41ba-73d7-b970-f28e966689db
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-4046-7340-bb9b-8e1badae0119
title: Set up queue infrastructure and job conventions
status: in_progress
priority: high
tags: ["queue","backend","reliability"]
assigned_to: ai
created_at: 2026-02-13 17:24:22
updated_at: 2026-02-13 20:02:59
description:
  Configure queue driver, retry settings, dead-letter/failed-jobs handling, and base job contracts for sync operations.


id: 019c5808-4499-7210-abdd-362864f97eb4
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-4046-7340-bb9b-8e1badae0119
title: Build order sync job and upsert service
status: pending
priority: high
tags: ["sync","orders","magento","queue"]
created_at: 2026-02-13 17:24:22
updated_at: 2026-02-13 17:24:22
description:
  Pull new/updated Magento orders, map payload, and upsert orders/items/customers using idempotent keys.


id: 019c5808-464d-7303-bde4-cfb340e7b986
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-4046-7340-bb9b-8e1badae0119
title: Build product sync and stock sync jobs
status: pending
priority: high
tags: ["sync","products","inventory","queue"]
created_at: 2026-02-13 17:24:23
updated_at: 2026-02-13 17:24:23
description:
  Implement product and stock import jobs with batching, upserts, and update of stock snapshot/movement tables.


id: 019c5808-4759-7185-a5c7-920c9b4a62a1
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-4046-7340-bb9b-8e1badae0119
title: Create sync trigger endpoints
status: pending
priority: high
tags: ["api","sync","queue"]
created_at: 2026-02-13 17:24:23
updated_at: 2026-02-13 17:24:23
description:
  Implement POST /sync/orders, /sync/products, /sync/stock, and /sync/full to enqueue tenant-store scoped jobs.


id: 019c5808-486c-72f3-842f-01ca00d80a6d
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-4046-7340-bb9b-8e1badae0119
title: Add rate-limit handling and exponential backoff
status: pending
priority: medium
tags: ["reliability","integration","sync"]
created_at: 2026-02-13 17:24:23
updated_at: 2026-02-13 17:24:23
description:
  Detect Magento API throttle responses and apply retry/backoff strategies to prevent repeated failures.


id: 019c5808-4974-71df-8541-ac6c516ab420
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-4046-7340-bb9b-8e1badae0119
title: Develop sync integration tests with rerun safety
status: pending
priority: medium
tags: ["testing","sync","reliability"]
created_at: 2026-02-13 17:24:24
updated_at: 2026-02-13 17:24:24
description:
  Validate incremental behavior, full sync execution, idempotent reruns, and duplicate prevention under retries.


id: 019c5808-4bde-7017-a9b0-bef2a40d4ef7
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-4a8c-70c2-9b67-5945bcde4143
title: Implement profit calculation service per order
status: pending
priority: high
tags: ["reporting","accounting","backend"]
created_at: 2026-02-13 17:24:24
updated_at: 2026-02-13 17:24:24
description:
  Calculate revenue, COGS, and optional shipping/payment costs to produce operational profit metrics on order data.


id: 019c5808-5001-7276-8e5f-7d6d4fa3e490
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-4a8c-70c2-9b67-5945bcde4143
title: Create sync logs and status tracking model
status: pending
priority: high
tags: ["observability","database","sync"]
created_at: 2026-02-13 17:24:25
updated_at: 2026-02-13 17:24:25
description:
  Implement sync_logs schema (entity_type, entity_id, store_id, status, attempts, last_error, last_synced_at) and lifecycle updates.


id: 019c5808-5105-71e4-9e2c-3df604f35af2
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-4a8c-70c2-9b67-5945bcde4143
title: Implement GET /sync/status and manual retry endpoint
status: pending
priority: high
tags: ["api","sync","reliability"]
created_at: 2026-02-13 17:24:25
updated_at: 2026-02-13 17:24:25
description:
  Expose sync progress/last run and create endpoint to manually retry failed sync jobs per tenant/store/entity.


id: 019c5808-52d2-7364-9c07-06964ab6591a
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-4a8c-70c2-9b67-5945bcde4143
title: Add correlation ID and structured logging
status: pending
priority: medium
tags: ["observability","logging","backend"]
created_at: 2026-02-13 17:24:26
updated_at: 2026-02-13 17:24:26
description:
  Introduce request/job correlation IDs and structured log fields for tracing failures across API and workers.


id: 019c5808-541d-732a-b4fa-560f8cc422e9
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-4a8c-70c2-9b67-5945bcde4143
title: Implement tenant user management endpoints
status: pending
priority: medium
tags: ["auth","api","admin"]
created_at: 2026-02-13 17:24:26
updated_at: 2026-02-13 17:24:26
description:
  Allow Owner to manage tenant users and roles (create/invite/update/deactivate) with strict policy enforcement.


id: 019c5808-559d-71cc-9719-e6e22fe09f73
project_id: 019c5808-204c-712d-88e8-706477d679bc
sprint_id: 019c5808-4a8c-70c2-9b67-5945bcde4143
title: Hardening, documentation, and release readiness
status: pending
priority: medium
tags: ["docs","testing","security","release"]
created_at: 2026-02-13 17:24:27
updated_at: 2026-02-13 17:24:27
description:
  Finalize API docs, run end-to-end tests, security checklist for secrets/scoping, and prepare MVP deployment notes.


