style(13-03): apply Prettier formatting across repo
Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.
This commit is contained in:
Lucas Berger
@@ -26,32 +26,32 @@ user_setup: []
|
||||
|
||||
must_haves:
|
||||
truths:
|
||||
- "Drizzle schema has an indexed hasRrule boolean on calendar_events and an isShared boolean on calendars, both pushed to the live MariaDB"
|
||||
- "PWA test runner (vitest + jsdom + @testing-library/react) executes and a smoke test passes"
|
||||
- "Dev-auth bypass middleware injects a fixed dev user only when DEV_AUTH_BYPASS=true AND NODE_ENV!=production"
|
||||
- "Failing-but-present test stubs exist for expand, events route, hydrateEvents, and calendarConfig (Wave 0 RED state) with concrete behavioral assertions, not bare failing imports"
|
||||
- 'Drizzle schema has an indexed hasRrule boolean on calendar_events and an isShared boolean on calendars, both pushed to the live MariaDB'
|
||||
- 'PWA test runner (vitest + jsdom + @testing-library/react) executes and a smoke test passes'
|
||||
- 'Dev-auth bypass middleware injects a fixed dev user only when DEV_AUTH_BYPASS=true AND NODE_ENV!=production'
|
||||
- 'Failing-but-present test stubs exist for expand, events route, hydrateEvents, and calendarConfig (Wave 0 RED state) with concrete behavioral assertions, not bare failing imports'
|
||||
artifacts:
|
||||
- path: "apps/api/src/db/schema.ts"
|
||||
provides: "hasRrule + isShared columns + idx_calendar_events_has_rrule index"
|
||||
contains: "has_rrule"
|
||||
- path: "apps/api/src/auth/devBypass.ts"
|
||||
provides: "devAuthBypass() middleware with hard production guard"
|
||||
exports: ["devAuthBypass"]
|
||||
- path: "apps/pwa/vitest.config.ts"
|
||||
provides: "jsdom-environment vitest config for PWA"
|
||||
contains: "jsdom"
|
||||
- path: "apps/api/tests/fixtures/weekly-dst.ics"
|
||||
provides: "DST-spanning weekly RRULE fixture for CAL-07 tests"
|
||||
- path: 'apps/api/src/db/schema.ts'
|
||||
provides: 'hasRrule + isShared columns + idx_calendar_events_has_rrule index'
|
||||
contains: 'has_rrule'
|
||||
- path: 'apps/api/src/auth/devBypass.ts'
|
||||
provides: 'devAuthBypass() middleware with hard production guard'
|
||||
exports: ['devAuthBypass']
|
||||
- path: 'apps/pwa/vitest.config.ts'
|
||||
provides: 'jsdom-environment vitest config for PWA'
|
||||
contains: 'jsdom'
|
||||
- path: 'apps/api/tests/fixtures/weekly-dst.ics'
|
||||
provides: 'DST-spanning weekly RRULE fixture for CAL-07 tests'
|
||||
min_lines: 10
|
||||
key_links:
|
||||
- from: "apps/api/src/index.ts"
|
||||
to: "apps/api/src/auth/devBypass.ts"
|
||||
- from: 'apps/api/src/index.ts'
|
||||
to: 'apps/api/src/auth/devBypass.ts'
|
||||
via: "app.use('/api/*', devAuthBypass()) before oidcAuthMiddleware"
|
||||
pattern: "devAuthBypass"
|
||||
- from: "apps/pwa/package.json"
|
||||
to: "vitest"
|
||||
via: "test script + devDependencies"
|
||||
pattern: "\"test\".*vitest"
|
||||
pattern: 'devAuthBypass'
|
||||
- from: 'apps/pwa/package.json'
|
||||
to: 'vitest'
|
||||
via: 'test script + devDependencies'
|
||||
pattern: '"test".*vitest'
|
||||
---
|
||||
|
||||
<objective>
|
||||
@@ -113,6 +113,7 @@ RED test stubs with concrete behavioral contracts.
|
||||
Create three ICS fixtures under `apps/api/tests/fixtures/`: `weekly-dst.ics` (VEVENT with `DTSTART;TZID=America/New_York:20260301T100000`, `RRULE:FREQ=WEEKLY`, and a full `VTIMEZONE` block for America/New_York with both STANDARD and DAYLIGHT subcomponents so DST rules are present), `allday-birthday.ics` (VEVENT with `DTSTART;VALUE=DATE:20260615`, yearly RRULE, no DTEND), `exdate-series.ics` (weekly VEVENT with one `EXDATE` line removing a single occurrence). These must be valid VCALENDAR strings parseable by ICAL.parse.
|
||||
|
||||
Create the four RED test stubs with the CONCRETE behavioral assertions described in <behavior> above — each must encode its real contract (the DST wall-clock assertion in expand.test.ts; the 'shared'/String(ownerUserId) calendarId routing assertion in hydrateEvents.test.ts), not merely a failing import. Each test imports the not-yet-existing module (`../../src/broker/expand.js`, etc.) so the file fails to resolve / the assertion fails — that is the intended RED state. Per the Nyquist rule, mark each `<automated>` for the modules they cover as satisfied here. Use the describe/it patterns from poller.test.ts and health.test.ts. Load fixtures with `readFileSync` relative to the test file. Do NOT implement expand.ts, the route changes, hydrateEvents.ts, or calendarConfig.ts in this task — only the stubs that later plans turn green.
|
||||
|
||||
</action>
|
||||
<verify>
|
||||
<automated>cd apps/api && grep -q "has_rrule" src/db/schema.ts && grep -q "is_shared" src/db/schema.ts && grep -q "idx_calendar_events_has_rrule" src/db/schema.ts && echo SCHEMA_OK</automated>
|
||||
@@ -156,6 +157,7 @@ RED test stubs with concrete behavioral contracts.
|
||||
In `apps/api/src/index.ts`, mount `app.use('/api/*', devAuthBypass())` on the line immediately BEFORE the existing `app.use('/api/*', oidcAuthMiddleware())`. The bypass is a no-op when inactive, so production behavior is unchanged.
|
||||
|
||||
Add `DEV_AUTH_BYPASS` to `.env.example` with a comment: `# DEV ONLY — injects a fixed dev user, skips Authelia. Hard-disabled when NODE_ENV=production. NEVER set in prod.` Extend `docs/deployment.md` dev-auth-bypass section to note the NODE_ENV production hard guard and that the production Docker Compose must not set DEV_AUTH_BYPASS.
|
||||
|
||||
</action>
|
||||
<verify>
|
||||
<automated>cd apps/api && pnpm test -- tests/auth/devBypass.test.ts</automated>
|
||||
@@ -197,20 +199,22 @@ RED test stubs with concrete behavioral contracts.
|
||||
</tasks>
|
||||
|
||||
<threat_model>
|
||||
|
||||
## Trust Boundaries
|
||||
|
||||
| Boundary | Description |
|
||||
|----------|-------------|
|
||||
| browser → /api/* | OIDC-gated; dev-auth bypass replaces the gate in dev only |
|
||||
| CI/prod env → app config | DEV_AUTH_BYPASS env var could leak into production |
|
||||
| Boundary | Description |
|
||||
| ------------------------ | --------------------------------------------------------- |
|
||||
| browser → /api/\* | OIDC-gated; dev-auth bypass replaces the gate in dev only |
|
||||
| CI/prod env → app config | DEV_AUTH_BYPASS env var could leak into production |
|
||||
|
||||
## STRIDE Threat Register
|
||||
|
||||
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|
||||
|-----------|----------|-----------|-------------|-----------------|
|
||||
| T-02-01 | Elevation of privilege | devAuthBypass() | mitigate | Hard `NODE_ENV === 'production'` guard as the FIRST conditional, before reading DEV_AUTH_BYPASS; .env.example warning; prod compose must not set the flag (Pitfall 7) |
|
||||
| T-02-02 | Tampering | drizzle-kit push | accept | Local dev DB; push reviewed; no untrusted input. Operator runs push against own MariaDB |
|
||||
| T-02-SC | Tampering | pnpm installs (vitest, @testing-library/*, jsdom) | mitigate | All packages are mainstream, audited in RESEARCH §Package Legitimacy (Approved); no [ASSUMED]/[SUS] packages in this plan |
|
||||
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|
||||
| --------- | ---------------------- | -------------------------------------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| T-02-01 | Elevation of privilege | devAuthBypass() | mitigate | Hard `NODE_ENV === 'production'` guard as the FIRST conditional, before reading DEV_AUTH_BYPASS; .env.example warning; prod compose must not set the flag (Pitfall 7) |
|
||||
| T-02-02 | Tampering | drizzle-kit push | accept | Local dev DB; push reviewed; no untrusted input. Operator runs push against own MariaDB |
|
||||
| T-02-SC | Tampering | pnpm installs (vitest, @testing-library/\*, jsdom) | mitigate | All packages are mainstream, audited in RESEARCH §Package Legitimacy (Approved); no [ASSUMED]/[SUS] packages in this plan |
|
||||
|
||||
</threat_model>
|
||||
|
||||
<verification>
|
||||
@@ -221,16 +225,19 @@ RED test stubs with concrete behavioral contracts.
|
||||
</verification>
|
||||
|
||||
<success_criteria>
|
||||
|
||||
- Schema columns added, pushed, and verified against the live DB
|
||||
- PWA test runner operational
|
||||
- Dev-auth bypass green with production hard guard
|
||||
- ICS fixtures parse; RED stubs in place for later waves with concrete DST + calendarId-routing contracts
|
||||
</success_criteria>
|
||||
</success_criteria>
|
||||
|
||||
<artifacts_produced>
|
||||
|
||||
## Artifacts this phase produces (Plan 01)
|
||||
|
||||
New symbols/files created here (exclude from drift verification):
|
||||
|
||||
- `calendar_events.hasRrule` Drizzle column + `idx_calendar_events_has_rrule` index
|
||||
- `calendars.isShared` Drizzle column
|
||||
- `devAuthBypass` (function) — apps/api/src/auth/devBypass.ts
|
||||
@@ -240,7 +247,7 @@ New symbols/files created here (exclude from drift verification):
|
||||
- apps/api/tests/fixtures/{weekly-dst,allday-birthday,exdate-series}.ics
|
||||
- apps/api/tests/broker/expand.test.ts, apps/api/tests/routes/events.test.ts, apps/api/tests/auth/devBypass.test.ts (new test files)
|
||||
- apps/pwa/src/lib/hydrateEvents.test.ts, apps/pwa/src/lib/calendarConfig.test.ts (new test files)
|
||||
</artifacts_produced>
|
||||
</artifacts_produced>
|
||||
|
||||
<output>
|
||||
Create `.planning/phases/02-calendar-display/02-01-SUMMARY.md` when done
|
||||
|
||||
Reference in New Issue
Block a user