Week of 7-13 September on Lif-align: an unauthenticated caller no longer reaches the API, the application layer went in, and then it went out over HTTP.
What the factory did
An endpoint is now locked until someone writes that it is public - it used to be the other way round. A rate limit went in beside it.
The signed-in user reached the database connection: the caller scope opens a transaction and sets the claims and the role inside it.
Twelve areas got an application layer above their repositories, all in the same shape - domain type, repository interface, use case, mapper.
That layer then went out over HTTP, ten more parts of the domain by Sunday.
Five changes were visible in the app: the user’s own time zone, a two-layer budget slider, a note length, offering an archived template again, and taking a todo off the list and back.
Penpot ended. A screen is now assembled from real components in a gallery inside the repository.
The Actions minutes ran out, so the repository checks moved into the factory’s own run.
A test that no runner executed turned up, and a guard against the next one went in with it.
What I did
Deploying migrations to production failed on our own guard, and the fix is still not written.