3 Commits

Include renames

Author	SHA1	Message	Date
Lucas Berger	982438dc10	style(13-03): apply Prettier formatting across repo ... Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.	2026-06-11 20:35:18 -04:00
Lucas BergerandClaude Opus 4.8	fcc680e553	fix(07-02): fail-closed guard on global-setup seed (CR-01, data-loss prevention) ... global-setup.ts TRUNCATEs four tables against whatever DB_* points at, with no production guard — an operator with prod DB_* still exported could wipe lists/ list_items/list_shares/calendar_events. The README promised a DEV_AUTH_BYPASS guardrail the code never enforced. Adds a fail-closed guard mirroring apps/api/src/auth/devBypass.ts: hard NODE_ENV==='production' check first, then require DEV_AUTH_BYPASS==='true' before opening any DB connection. README updated with the test-process env requirement (run command + CI runner env). Verified: guard throws without DEV_AUTH_BYPASS; full 58-test suite passes with it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-11 02:23:38 -04:00
Lucas Berger	535ba11cda	docs(07-02): add e2e/README.md — run instructions and security guardrails ... - Documents pnpm test:e2e run commands and single-profile / headed variants - Documents DEV_AUTH_BYPASS=true must be set before API starts (Pitfall 5) - States production compose MUST NOT set DEV_AUTH_BYPASS (Elevation of Privilege) - Lists PLAYWRIGHT_BASE_URL and DB_* env vars (all credentials env-only, never hardcoded) - States no storageState file is used (D-01 — no expiring session cookie) - Describes globalSetup readiness gate + seed anchors (Milk/Eggs/Seeded Test Event) - Notes Phase 8 CI scope and --with-deps WebKit requirement	2026-06-11 01:50:58 -04:00