style(13-03): apply Prettier formatting across repo
Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.
This commit is contained in:
Lucas Berger
@@ -1,6 +1,6 @@
|
||||
---
|
||||
phase: 01-foundation-broker-spike
|
||||
plan: "04"
|
||||
plan: '04'
|
||||
subsystem: integration
|
||||
tags: [hono, sse, caldav, react, typescript, pwa, spike, pangolin]
|
||||
|
||||
@@ -21,12 +21,12 @@ affects:
|
||||
# Tech tracking
|
||||
tech-stack:
|
||||
added:
|
||||
- "hono/streaming (streamSSE) — SSE streaming helper, already a peer dep of hono"
|
||||
- "ical.js@2.2.1 added to apps/pwa (already in apps/api; needed for EventProof summary parsing)"
|
||||
- 'hono/streaming (streamSSE) — SSE streaming helper, already a peer dep of hono'
|
||||
- 'ical.js@2.2.1 added to apps/pwa (already in apps/api; needed for EventProof summary parsing)'
|
||||
patterns:
|
||||
- "SSE auth: sseRouter mounted under /api/sse, behind oidcAuthMiddleware — no unauthenticated SSE access (T-04-01)"
|
||||
- "Bootstrap order: /callback → /health (pre-guard) → app.use(/api/*, oidcAuthMiddleware) → /api/me → /api/events → /api/sse → startBrokerPoller → serveStatic"
|
||||
- "Spike pattern: env-var credentials (FASTMAIL_EMAIL, FASTMAIL_APP_PASSWORD) → createFastmailClient → fetchCalendars → print URLs; never log password (T-04-04)"
|
||||
- 'SSE auth: sseRouter mounted under /api/sse, behind oidcAuthMiddleware — no unauthenticated SSE access (T-04-01)'
|
||||
- 'Bootstrap order: /callback → /health (pre-guard) → app.use(/api/*, oidcAuthMiddleware) → /api/me → /api/events → /api/sse → startBrokerPoller → serveStatic'
|
||||
- 'Spike pattern: env-var credentials (FASTMAIL_EMAIL, FASTMAIL_APP_PASSWORD) → createFastmailClient → fetchCalendars → print URLs; never log password (T-04-04)'
|
||||
- "EventProof: tries ical.js parse for SUMMARY field; falls back to 'Untitled event' on parse failure — resilient to malformed VEVENT blobs"
|
||||
|
||||
key-files:
|
||||
@@ -42,13 +42,13 @@ key-files:
|
||||
- apps/pwa/package.json (added ical.js@2.2.1 dependency)
|
||||
|
||||
key-decisions:
|
||||
- "ical.js added to PWA for VEVENT summary parsing in EventProof: EventProof parses rawVevent to extract the SUMMARY field for a human-readable event title; ical.js is already approved and used in the API — the same package at the same version"
|
||||
- "spike.ts uses tsx (dev-only runner) via pnpm exec: tsx is accepted per T-04-SC; spike is not imported by the API or Docker image"
|
||||
- 'ical.js added to PWA for VEVENT summary parsing in EventProof: EventProof parses rawVevent to extract the SUMMARY field for a human-readable event title; ical.js is already approved and used in the API — the same package at the same version'
|
||||
- 'spike.ts uses tsx (dev-only runner) via pnpm exec: tsx is accepted per T-04-SC; spike is not imported by the API or Docker image'
|
||||
- "CAL-08-DECISION.md committed as a template now, human-filled after running spike: the file must contain 'Decision:' to satisfy the artifact spec; template pre-populates the structure"
|
||||
|
||||
# Metrics
|
||||
duration: ~3min (code tasks only; live verification pending)
|
||||
completed: "2026-06-04"
|
||||
completed: '2026-06-04'
|
||||
---
|
||||
|
||||
# Phase 01 Plan 04: Integration + Gate Slice — Summary
|
||||
@@ -102,6 +102,7 @@ These are `checkpoint:human-action` tasks that require real infrastructure:
|
||||
- Fastmail Settings → Privacy & Security → App Passwords → scope: "Mail, Contacts & Calendars"
|
||||
|
||||
2. Run the spike:
|
||||
|
||||
```bash
|
||||
cd apps/api
|
||||
FASTMAIL_EMAIL=lucas@fastmail.com \
|
||||
@@ -112,6 +113,7 @@ These are `checkpoint:human-action` tasks that require real infrastructure:
|
||||
3. Confirm in output: (a) shared family calendar collection URL appears; (b) Lucas's personal calendar URL appears. Record both.
|
||||
|
||||
4. To insert the credential into the DB for the broker to use (one-off node script):
|
||||
|
||||
```bash
|
||||
# First ensure APP_PASSWORD_ENCRYPTION_KEY is set in .env
|
||||
cd apps/api
|
||||
@@ -124,6 +126,7 @@ These are `checkpoint:human-action` tasks that require real infrastructure:
|
||||
```
|
||||
|
||||
5. Start the stack and verify at least one event lands in `calendar_events`:
|
||||
|
||||
```bash
|
||||
docker compose exec mariadb mariadb -ufamilysync -p<pw> familysync \
|
||||
-e "SELECT id, uid, all_day FROM calendar_events LIMIT 5;"
|
||||
@@ -145,12 +148,15 @@ These are `checkpoint:human-action` tasks that require real infrastructure:
|
||||
**What to do:**
|
||||
|
||||
1. Register FamilySync OIDC client in Authelia (see 01-02-SUMMARY.md for full YAML):
|
||||
|
||||
```bash
|
||||
authelia crypto hash --sha512 <your-plain-client-secret>
|
||||
```
|
||||
|
||||
Add the client block to Authelia's `configuration.yml` and reload.
|
||||
|
||||
2. Set env vars in `.env`:
|
||||
|
||||
```
|
||||
OIDC_AUTH_SECRET=<openssl rand -base64 32>
|
||||
OIDC_ISSUER=https://auth.<domain>
|
||||
@@ -161,6 +167,7 @@ These are `checkpoint:human-action` tasks that require real infrastructure:
|
||||
```
|
||||
|
||||
3. Expose FamilySync through Pangolin under the SAME parent domain as Authelia (same-site cookie requirement — Pitfall 1).
|
||||
|
||||
```bash
|
||||
docker compose up -d
|
||||
```
|
||||
@@ -172,9 +179,11 @@ These are `checkpoint:human-action` tasks that require real infrastructure:
|
||||
6. Repeat for second member (wife) → confirm distinct color (AUTH-03).
|
||||
|
||||
7. SSE smoke test (D-08) — run from external network with a valid session cookie:
|
||||
|
||||
```bash
|
||||
curl -N -b "session=<cookie-value>" https://familysync.<domain>/api/sse/heartbeat
|
||||
```
|
||||
|
||||
Keep open 5+ minutes. Record: **PASS** (events keep arriving) or **FAIL** (stream cut by proxy).
|
||||
|
||||
8. Record SSE smoke result in SUMMARY (update this file) for Phase 4 transport decision.
|
||||
@@ -193,6 +202,7 @@ If FAIL: investigate Pangolin idle-timeout config; note for Phase 4.
|
||||
## Deviations from Plan
|
||||
|
||||
**[Rule 2 - Missing dependency] ical.js added to PWA for EventProof summary parsing**
|
||||
|
||||
- **Found during:** Task 1 (EventProof.tsx implementation)
|
||||
- **Issue:** EventProof.tsx parses rawVevent strings using ical.js to extract human-readable SUMMARY. ical.js was only in apps/api; EventProof runs in the browser.
|
||||
- **Fix:** Added ical.js@2.2.1 to apps/pwa/package.json. Same package, same version, already approved in the legitimacy audit.
|
||||
@@ -206,6 +216,7 @@ If FAIL: investigate Pangolin idle-timeout config; note for Phase 4.
|
||||
## Threat Surface Scan
|
||||
|
||||
All surfaces within Plan 04 threat model:
|
||||
|
||||
- **T-04-01 (SSE auth):** sseRouter mounted under `/api/sse` behind `oidcAuthMiddleware` — confirmed
|
||||
- **T-04-02 (SSE payload):** heartbeat carries only `{ ts, id }` — no user data or secrets
|
||||
- **T-04-03 (same-site cookies):** operator must expose FamilySync under same parent domain as Authelia — documented in Task 3 steps
|
||||
@@ -227,5 +238,6 @@ All surfaces within Plan 04 threat model:
|
||||
- `pnpm vitest run` 24/24 tests green: PASSED
|
||||
|
||||
---
|
||||
*Phase: 01-foundation-broker-spike*
|
||||
*Completed (code): 2026-06-04 — Live verification pending*
|
||||
|
||||
_Phase: 01-foundation-broker-spike_
|
||||
_Completed (code): 2026-06-04 — Live verification pending_
|
||||
|
||||
Reference in New Issue
Block a user