Skip to content

feat: implement OpenAPI-first workflow, CQRS analytics, audit trail, and benchmarking#649

Open
Dev-sandy1 wants to merge 1 commit into
Smartdevs17:mainfrom
Dev-sandy1:feat/openapi-cqrs-audit-benchmark
Open

feat: implement OpenAPI-first workflow, CQRS analytics, audit trail, and benchmarking#649
Dev-sandy1 wants to merge 1 commit into
Smartdevs17:mainfrom
Dev-sandy1:feat/openapi-cqrs-audit-benchmark

Conversation

@Dev-sandy1

@Dev-sandy1 Dev-sandy1 commented Jun 24, 2026

Copy link
Copy Markdown

Summary

This PR implements four major feature requests across the SubTrackr platform:

🔄 OpenAPI-First SDK Generation (#580)

  • Upgraded OpenAPI spec to 3.1 (spec/openapi.yaml) as the single source of truth
  • Added CI workflow (.github/workflows/sdk-generate.yml) for spec validation + auto-generation
  • Created scripts/sdk-generate.sh for JS/Python/Go SDK regeneration
  • Breaking changes require major version bump (validated in CI)

📊 CQRS Analytics Pattern (#576)

  • Query model: Materialized views for MRR, cohort retention, LTV (db/migrations/003_cqrs_materialized_views.sql)
  • Command model: Thin wrappers delegating to existing services (backend/analytics/command/)
  • Query handlers: View-specific repositories with <200ms p95 latency (backend/analytics/query/)
  • CDC pipeline: Logical replication config with per-view refresh policies (backend/shared/cdc/)
  • Updated MVRefreshJob with configurable intervals (5 min / 1h / 24h)
  • Stale view indicator with refreshed_at timestamp

🔒 Tamper-Evident Audit Trail (#572)

  • Linked hash chain: SHA-256(prev_hash + event_data) per entry (backend/audit/domain/HashChainService.ts)
  • Periodic anchoring: Every 1000 entries or 24h to Stellar blockchain via Soroban contract (contracts/audit/)
  • Verification API: POST /audit/verify returns chain integrity status
  • Audit search: By actor, resource, action, date range with pagination
  • Log retention: Configurable (default 7 years) with rotation job
  • Hash mismatch detection: Quarantine table + alert (audit_quarantine)

📈 Subscription Benchmarking (#571)

  • 6 verticals: SaaS, e-commerce, media, education, healthcare, fintech
  • Differential privacy: epsilon=1.0 with Laplace noise
  • k-anonymity: Min 10 peers per cohort (hides comparison if insufficient)
  • Mobile screen: BenchmarkReportScreen.tsx with interactive metric bars
  • Report metrics: MRR growth, churn rate, conversion rate, ARPA vs p25/p50/p75
  • Trend indicators: Improving/declining/stable
  • Opt-in consent: With revocation and data purge

Files Changed

  • 40 files changed across backend, mobile, contracts, CI, and specs
  • All existing patterns (DI container, error handling, barrel exports) respected

Closes #580
Closes #576
Closes #572
Closes #571

…and benchmarking

- Issue Smartdevs17#580: OpenAPI-first SDK generation workflow
  - Upgrade OpenAPI spec to 3.1 at spec/openapi.yaml (single source of truth)
  - Add CI workflow for spec validation and auto-generation
  - SDK generation script (scripts/sdk-generate.sh)
  - Update docs/openapi.yaml to 3.1

- Issue Smartdevs17#576: CQRS pattern with materialized views
  - Query handlers for MRR, cohort retention, LTV views
  - Command handlers for subscription write operations
  - Migration 003 with mrr_mv, cohort_retention_mv, ltv_mv
  - CDC connector configuration with per-view refresh policies
  - Updated mvRefreshJob with new views and scheduling

- Issue Smartdevs17#572: Tamper-evident audit trail
  - HashChainService with SHA-256 linked hash chain
  - AuditWriter for event capture
  - BlockchainAnchor with periodic Stellar anchoring (every 1000 entries/24h)
  - REST controller with query and verification API
  - Jobs: log rotation, integrity checker, blockchain anchor
  - Audit logging middleware for auto-capture
  - Soroban contract (contracts/audit/) for on-chain anchoring
  - Migration 004 with audit_events, audit_anchors, audit_quarantine tables

- Issue Smartdevs17#571: Subscription benchmarking
  - BenchmarkEngine with differential privacy (epsilon=1.0)
  - Industry vertical taxonomy (6 verticals)
  - Anonymized peer comparison (p25/p50/p75)
  - k-anonymity enforcement (min 10 peers)
  - BenchmarkConsentService with opt-in/opt-out
  - Mobile BenchmarkReportScreen with interactive bars
  - Monthly aggregation and data purge jobs

Closes Smartdevs17#580, Smartdevs17#576, Smartdevs17#572, Smartdevs17#571
@drips-wave

drips-wave Bot commented Jun 24, 2026

Copy link
Copy Markdown

@Dev-sandy1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants