3 Commits

Include renames

Author	SHA1	Message	Date
Lucas Berger	8bd44b33c7	feat(02-01): dev-auth bypass middleware with production hard guard ... - Create apps/api/src/auth/devBypass.ts: devAuthBypass() middleware with NODE_ENV=production hard guard as first conditional (T-02-01 mitigation) - Exports DEV_USER const (id:1, color:COLOR_PALETTE[0]) for test reference - Mount devAuthBypass() before oidcAuthMiddleware on /api/* in index.ts - Add devBypass.test.ts: all three behavioral cases pass (production guard, unset-flag passthrough, active-injection) - Add DEV_AUTH_BYPASS to .env.example with production warning comment - Extend docs/deployment.md with dev-auth bypass section and production prohibition	2026-06-05 09:32:00 -04:00
Lucas Berger	61c258c021	test(01-02): add failing tests for upsertUser color assignment + identity ... - Replace it.todo stubs with real failing tests (RED gate) - Tests cover palette[0] first user, palette[1] second user, idempotent re-upsert, iss+sub identity key, full row shape - Tests fail: src/auth/user.ts does not exist yet	2026-06-04 10:20:27 -04:00
Lucas Berger	3f591566d1	chore(01-01): scaffold monorepo, Docker Compose stack, and Vitest harness ... - pnpm workspace with apps/api (Hono/Drizzle) and apps/pwa (Vite/React 19) - Pinned versions per RESEARCH: hono@4.12.23, drizzle-orm@0.45.2, mysql2@3.22.4, tsdav@2.2.2, ical.js@2.2.1, zod@^3.25.0, node-cron@^4.2.1 - docker-compose.yml with mariadb:11 healthcheck, api depends_on service_healthy, redis stub - docker-compose.dev.yml overrides for local dev (bind mounts, exposed ports) - .env.example lists all env vars (DB_*, OIDC_*, APP_PASSWORD_ENCRYPTION_KEY) - .gitignore excludes .env (never commit secrets) - apps/api/vitest.config.ts with environment: node - Wave 0 test stubs: health, auth/user, broker/crypto, broker/sync, broker/poller	2026-06-04 09:50:16 -04:00