style(13-03): apply Prettier formatting across repo
Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.
This commit is contained in:
Lucas Berger
@@ -21,48 +21,48 @@ autonomous: false
|
||||
requirements: [NOTIF-01, NOTIF-02, NOTIF-03]
|
||||
user_setup:
|
||||
- service: web-push (VAPID — self-generated, no external account)
|
||||
why: "Server signs push messages with a VAPID keypair; the private key must live in the API env, the public key is served to the PWA. No third-party account — the keypair is generated locally."
|
||||
why: 'Server signs push messages with a VAPID keypair; the private key must live in the API env, the public key is served to the PWA. No third-party account — the keypair is generated locally.'
|
||||
env_vars:
|
||||
- name: VAPID_PUBLIC_KEY
|
||||
source: "Generated by `npx web-push generate-vapid-keys --json` (Task 2 runs this and prints the values)"
|
||||
source: 'Generated by `npx web-push generate-vapid-keys --json` (Task 2 runs this and prints the values)'
|
||||
- name: VAPID_PRIVATE_KEY
|
||||
source: "Same command — paste into apps/api `.env` (NEVER commit; .env is gitignored)"
|
||||
source: 'Same command — paste into apps/api `.env` (NEVER commit; .env is gitignored)'
|
||||
- name: VAPID_SUBJECT
|
||||
source: "A mailto: or https: contact URL, e.g. mailto:admin@familysync.bergerhouse.net"
|
||||
source: 'A mailto: or https: contact URL, e.g. mailto:admin@familysync.bergerhouse.net'
|
||||
|
||||
must_haves:
|
||||
truths:
|
||||
- "web-push + @types/web-push are installed in apps/api; workbox-precaching/core/routing are devDeps in apps/pwa"
|
||||
- "push_subscriptions table exists in MariaDB with (user_id FK cascade, endpoint unique, p256dh, auth) after migrate"
|
||||
- "calendar_events has a title varchar(500) column after migrate (D-02/NOTIF-01 readable copy)"
|
||||
- "A real generated VAPID keypair is recorded in .env (private) and .env.example documents the three env vars (public placeholder only)"
|
||||
- "All Wave-0 RED test files exist and fail for the right reason (missing implementation, not import/syntax errors)"
|
||||
- "test/setup.ts afterEach truncates push_subscriptions"
|
||||
- 'web-push + @types/web-push are installed in apps/api; workbox-precaching/core/routing are devDeps in apps/pwa'
|
||||
- 'push_subscriptions table exists in MariaDB with (user_id FK cascade, endpoint unique, p256dh, auth) after migrate'
|
||||
- 'calendar_events has a title varchar(500) column after migrate (D-02/NOTIF-01 readable copy)'
|
||||
- 'A real generated VAPID keypair is recorded in .env (private) and .env.example documents the three env vars (public placeholder only)'
|
||||
- 'All Wave-0 RED test files exist and fail for the right reason (missing implementation, not import/syntax errors)'
|
||||
- 'test/setup.ts afterEach truncates push_subscriptions'
|
||||
artifacts:
|
||||
- path: "apps/api/src/db/schema.ts"
|
||||
provides: "pushSubscriptions table + calendarEvents.title column"
|
||||
contains: "pushSubscriptions"
|
||||
- path: "apps/api/src/db/migrations"
|
||||
provides: "0003 migration adding push_subscriptions + calendar_events.title"
|
||||
contains: "push_subscriptions"
|
||||
- path: "apps/api/tests/fixtures/vapid.ts"
|
||||
provides: "Static test VAPID keypair fixture (no network) for unit tests"
|
||||
- path: 'apps/api/src/db/schema.ts'
|
||||
provides: 'pushSubscriptions table + calendarEvents.title column'
|
||||
contains: 'pushSubscriptions'
|
||||
- path: 'apps/api/src/db/migrations'
|
||||
provides: '0003 migration adding push_subscriptions + calendar_events.title'
|
||||
contains: 'push_subscriptions'
|
||||
- path: 'apps/api/tests/fixtures/vapid.ts'
|
||||
provides: 'Static test VAPID keypair fixture (no network) for unit tests'
|
||||
min_lines: 3
|
||||
- path: "apps/api/tests/lib/pushDispatcher.test.ts"
|
||||
provides: "RED scaffold for 410/404 pruning"
|
||||
- path: "apps/api/tests/lib/pushCoalescer.test.ts"
|
||||
provides: "RED scaffold for list-change coalescing"
|
||||
- path: "apps/api/tests/broker/reminderScheduler.test.ts"
|
||||
provides: "RED scaffold for reminder scan (shared/timed/all-day filters)"
|
||||
- path: "apps/api/tests/lib/eventChangeDispatcher.test.ts"
|
||||
provides: "RED scaffold for event-change dispatch + description-only suppression"
|
||||
- path: "apps/api/tests/routes/push.test.ts"
|
||||
provides: "RED scaffold for subscription POST/DELETE + vapid-public-key"
|
||||
- path: 'apps/api/tests/lib/pushDispatcher.test.ts'
|
||||
provides: 'RED scaffold for 410/404 pruning'
|
||||
- path: 'apps/api/tests/lib/pushCoalescer.test.ts'
|
||||
provides: 'RED scaffold for list-change coalescing'
|
||||
- path: 'apps/api/tests/broker/reminderScheduler.test.ts'
|
||||
provides: 'RED scaffold for reminder scan (shared/timed/all-day filters)'
|
||||
- path: 'apps/api/tests/lib/eventChangeDispatcher.test.ts'
|
||||
provides: 'RED scaffold for event-change dispatch + description-only suppression'
|
||||
- path: 'apps/api/tests/routes/push.test.ts'
|
||||
provides: 'RED scaffold for subscription POST/DELETE + vapid-public-key'
|
||||
key_links:
|
||||
- from: "apps/api/src/db/schema.ts"
|
||||
to: "apps/api/test/setup.ts"
|
||||
via: "pushSubscriptions export imported for truncation"
|
||||
pattern: "pushSubscriptions"
|
||||
- from: 'apps/api/src/db/schema.ts'
|
||||
to: 'apps/api/test/setup.ts'
|
||||
via: 'pushSubscriptions export imported for truncation'
|
||||
pattern: 'pushSubscriptions'
|
||||
---
|
||||
|
||||
<objective>
|
||||
@@ -200,20 +200,22 @@ Output: Installed deps + legitimacy checkpoint, generated VAPID keypair document
|
||||
</tasks>
|
||||
|
||||
<threat_model>
|
||||
|
||||
## Trust Boundaries
|
||||
|
||||
| Boundary | Description |
|
||||
|----------|-------------|
|
||||
| Boundary | Description |
|
||||
| ----------------------- | -------------------------------------------------------- |
|
||||
| developer machine → git | VAPID private key must never cross into a committed file |
|
||||
| pnpm registry → repo | package installs are untrusted supply-chain input |
|
||||
| pnpm registry → repo | package installs are untrusted supply-chain input |
|
||||
|
||||
## STRIDE Threat Register
|
||||
|
||||
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|
||||
|-----------|----------|-----------|-------------|-----------------|
|
||||
| T-05-01 | Information Disclosure | VAPID_PRIVATE_KEY | mitigate | Private key only in gitignored .env; .env.example carries placeholders; verify gate greps .env.example, never .env |
|
||||
| T-05-SC | Tampering | npm installs (web-push, workbox-*) | mitigate | RESEARCH legitimacy audit (all OK) + blocking-human checkpoint (Task 1) before install |
|
||||
| T-05-02 | Tampering | drizzle migration on populated MariaDB | mitigate | Use db:generate+db:migrate only; db:push forbidden (false truncate diff) |
|
||||
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|
||||
| --------- | ---------------------- | -------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------ |
|
||||
| T-05-01 | Information Disclosure | VAPID_PRIVATE_KEY | mitigate | Private key only in gitignored .env; .env.example carries placeholders; verify gate greps .env.example, never .env |
|
||||
| T-05-SC | Tampering | npm installs (web-push, workbox-\*) | mitigate | RESEARCH legitimacy audit (all OK) + blocking-human checkpoint (Task 1) before install |
|
||||
| T-05-02 | Tampering | drizzle migration on populated MariaDB | mitigate | Use db:generate+db:migrate only; db:push forbidden (false truncate diff) |
|
||||
|
||||
</threat_model>
|
||||
|
||||
<verification>
|
||||
@@ -223,11 +225,12 @@ Output: Installed deps + legitimacy checkpoint, generated VAPID keypair document
|
||||
</verification>
|
||||
|
||||
<success_criteria>
|
||||
|
||||
- web-push/@types/web-push installed (api); workbox-precaching/core/routing installed (pwa).
|
||||
- VAPID keypair generated; private key in .env; .env.example documents all three vars.
|
||||
- push_subscriptions table + calendar_events.title column migrated (generate+migrate, never push).
|
||||
- All Wave-0 RED scaffolds + VAPID fixture exist; setup.ts truncates push_subscriptions.
|
||||
</success_criteria>
|
||||
</success_criteria>
|
||||
|
||||
<output>
|
||||
Create `.planning/phases/05-web-push-notifications/05-01-SUMMARY.md` when done.
|
||||
|
||||
Reference in New Issue
Block a user