Lint (eslint --max-warnings 0):
- index.ts: disable no-unsafe-argument on the type-only Context mismatch when
delegating to the OIDC handler inside the local-session skip wrapper
- localAuth.ts: handleLogout is sync (no await) — drop async (require-await)
- devBypass.ts: disable detect-possible-timing-attacks on the public well-known
dev-placeholder string compare (not a secret comparison)
- remove dead code / unused bindings flagged by no-unused-vars: makeTestApp
(localSession.test), makeUnauthContext + BrowserContext import (login.spec),
unused memberId (admin.test), unused txSelectCount counter (me.test)
- localAuthMiddleware.test / me.test: fix unused + reflow-detached
eslint-disable directives
Format: prettier --write across the 20 Phase-19 files that were never formatted.
Secret scan (gitleaks): allowlist two false positives — the synthetic >=32-char
TEST_SECRET in localSession.test.ts, and .planning/ design prose (a generic-api-key
regex hit on "credential atomically, 409-equivalent"). Neither is a real secret.
Verified locally: format:check, lint, typecheck, md:lint, gitleaks (no leaks),
PWA 266/266, API 452/452.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
CREATE DATABASE IF NOT EXISTS reuses the prior run's data, so the test DB
would itself accumulate users run-over-run (the same flaky list_shares
fan-out the dev DB suffered). Truncate every table (except the drizzle
migration ledger) at globalSetup start, FK-safe, so each run is a clean
deterministic slate. Verified: familysync_test users 186 -> 93 across a run
(reset, not doubled); dev familysync untouched at 3.
- Update apps/api/test/setup.ts header: clarify tests run against familysync_test
(provisioned by global-setup.ts), document users-cleanup decision (intact across
tests), and note CI-vs-local env difference
- Add apps/api/README.md "Running API tests locally" section: documents the test
DB isolation, run command, DB_ROOT_PASSWORD requirement, and CI no-op behaviour
- Fix apps/api/test/global-setup.ts: switch from drizzle({ client, mode }) to
drizzle(pool, { mode }) — drizzle-orm@0.45.2 isConfig() has a tautological OR
in the `mode` branch that always returns false, causing the combined-config form
to pass the config object as the client (client.query is not a function); two-arg
form routes correctly; 244/244 tests pass against familysync_test
- tests/fixtures/vapid.ts: static TEST_VAPID keypair for offline unit tests
- tests/lib/pushDispatcher.test.ts: RED — 410/404 prune + 201/5xx no-delete
- tests/lib/pushCoalescer.test.ts: RED — burst coalesce fires once with count=N; excludeUserId
- tests/broker/reminderScheduler.test.ts: RED — shared+timed filter; dedup by (uid,minuteBucket)
- tests/lib/eventChangeDispatcher.test.ts: RED — create/meaningful-update fires; description-only silent; actor excluded
- tests/routes/push.test.ts: RED — POST 201/401; DELETE removes rows; GET vapid-public-key
- test/setup.ts: import pushSubscriptions + add db.delete(pushSubscriptions) in afterEach
- all 5 RED files fail on missing-module (correct; implementations in Plans 05-02..05-06)
- Add react-router@7, @dnd-kit/core, @dnd-kit/sortable, fractional-indexing to PWA
- Add fractional-indexing to API (rank generation server-side)
- ioredis NOT added (in-memory EventEmitter per RESEARCH Plan 02 justification)
- Create apps/api/test/setup.ts with afterEach DB cleanup for list tables
- Wire test.setupFiles in apps/api/vitest.config.ts
- Add 4 Wave-0 RED stub test files (LIST-01/02/03/04, D-04, D-11, D-07)
- All stubs run as todo, not import-error
