luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,026 Commits 2 Branches 2 Tags
51ec9c3e821567b1bb0639bebb7061cfffe33e7e
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Lucas Berger 51ec9c3e82 docs(roadmap): add Phase 20 — Admin Member Editor & Form Declutter 2026-06-18 15:14:25 -04:00
Lucas Berger b8d4a69b73 docs(phase-17): add security threat verification (9 closed, 0 open)
CI / changes (pull_request) Successful in 4s
Details
CI / fast-checks (pull_request) Failing after 1m41s
Details
CI / api (pull_request) Successful in 2m2s
Details
CI / security (pull_request) Successful in 54s
Details
CI / gate (pull_request) Has been cancelled
Details
CI / harness (pull_request) Has been cancelled
Details
2026-06-18 14:33:10 -04:00
Lucas Berger 881f2d2d18 test(17): complete UAT - 9 passed, 0 issues (playwright-cli verified) 2026-06-18 14:31:32 -04:00
Lucas Berger 6fa6725fe8 docs(17): add code review fix report (auto-loop, 3 iterations) 2026-06-18 14:06:03 -04:00
Lucas Berger 287ecae2f7 fix(17): CR-01 make focus-trap visibility filter tolerant of jsdom; IN-01 drop inert containment guard 2026-06-18 14:04:33 -04:00
Lucas Berger 89dee4f586 fix(17): IN-03 render visible Redirecting status during OIDC redirect 2026-06-18 13:57:31 -04:00
Lucas Berger f7575ea2c3 fix(17): IN-02 document hand-maintained favicon.ico coupling 2026-06-18 13:56:48 -04:00
Lucas Berger 7578d48d3d fix(17): IN-01 pull focus back into dialog when activeElement escapes 2026-06-18 13:56:32 -04:00
Lucas Berger 5b4625b41d fix(17): WR-01 exclude hidden/zero-size nodes from focus-trap boundaries 2026-06-18 13:56:23 -04:00
Lucas Berger 4bc1e2a820 fix(17): IN-05 normalize AdminPage JSX formatting with Prettier 2026-06-18 13:48:34 -04:00
Lucas Berger 11b6b36cb9 fix(17): IN-07 memoize Intl.DateTimeFormat timezone resolution 2026-06-18 13:47:37 -04:00
Lucas Berger 2317833b74 fix(17): IN-04 remove dead brand placeholder tokens 2026-06-18 13:46:47 -04:00
Lucas Berger 3f4b7eac73 fix(17): IN-02 useCallback handleClose, drop exhaustive-deps disables 2026-06-18 13:46:27 -04:00
Lucas Berger dd0b76128d fix(17): WR-08 replace cp icon chain with cross-platform Node copy script 2026-06-18 13:45:36 -04:00
Lucas Berger 1c0f35748d fix(17): WR-06 WR-07 clamp tz combobox active index; Tab-to-commit, blur-timer unmount cleanup 2026-06-18 13:44:44 -04:00
Lucas Berger f601c0c408 fix(17): WR-02 WR-03 WR-04 IN-06 admin tab Home/End+wrap; toast re-announce, wrap, z-index 400 2026-06-18 13:43:10 -04:00
Lucas Berger fb30800e9a fix(17): WR-01 trap focus in modal dialogs via useFocusTrap 2026-06-18 13:41:33 -04:00
Lucas Berger a4a7438641 fix(17): WR-05 IN-03 IN-01 resize-aware useIsPhone hook; OidcRedirect side-effect in effect 2026-06-18 13:40:00 -04:00
Lucas Berger c2ceebf130 docs(17): add deep code review report 2026-06-18 13:35:10 -04:00
Lucas BergerandClaude Opus 4.8 a986c74963 docs(phase-17): mark phase complete (pending human verification) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-18 13:11:35 -04:00
Lucas BergerandClaude Opus 4.8 fcc02e3833 docs(17): add phase verification report (10/10 decisions delivered; human_needed for device-only checks) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-18 13:11:23 -04:00
Lucas BergerandClaude Opus 4.8 9730d3dcdb docs(17): add code review report 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-18 13:06:20 -04:00
Lucas BergerandClaude Opus 4.8 ea49a4dc83 docs(phase-17): update tracking after wave 2 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-18 13:03:12 -04:00
Lucas BergerandClaude Opus 4.8 b5fcd1d172 fix(17): resolve post-merge wave 2 integration issues 
- SettingsSheet: void the navigate('/login') promise (react-router v7 returns Promise) — eslint no-floating-promises
- InstructionSheet.test: wrap SettingsSheet render in MemoryRouter — 17-05 added useNavigate() which needs Router context

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-18 13:01:39 -04:00
Lucas Berger 4887ba1b5f chore: merge executor worktree (worktree-agent-a12887546a61a8053) 2026-06-18 12:58:59 -04:00
Lucas Berger aaf754d938 chore: merge executor worktree (worktree-agent-a65077bbd9885bf7e) 2026-06-18 12:58:58 -04:00
Lucas Berger 9e39a5c492 chore: merge executor worktree (worktree-agent-ad448992e936c77aa) 2026-06-18 12:58:57 -04:00
Lucas Berger 29f3d62312 chore: merge executor worktree (worktree-agent-a1f3ad1ab5d67e70c) 2026-06-18 12:58:56 -04:00
Lucas Berger f4c65d478a docs(17-06): complete admin polish plan — toasts + two-tab ARIA nav + e2e assertions 2026-06-18 12:58:06 -04:00
Lucas Berger 944045cd7e test(17-06): add admin two-tab ARIA and keyboard assertions to admin.spec.ts 
- Add 'Admin two-tab ARIA strip (D-10)' describe block: tablist visible,
  both named tabs visible, ArrowRight/ArrowLeft keyboard switching,
  panel aria-labelledby, phone overflow check
- Add 'Admin success toast structure (D-08)' describe: role=status absent on load
- Satisfies Wave 0 admin-ARIA CI requirement — 12/12 tests pass on pixel profile
 2026-06-18 12:56:34 -04:00
Lucas Berger caff8b4b0a docs(17-05): complete logout control + sheet centering plan 
- Sign out control (D-07): LogOut icon, handleSignOut fire-and-best-effort, navigate /login
- Desktop centering (D-09): phone/desktop style branch on SettingsSheet, ChangePasswordSheet, LinkOidcSheet, CredentialSheet
- playwright-cli verified: centered modal @1280x720, bottom-sheet @390x844, Sign out redirects to /login
 2026-06-18 12:54:43 -04:00
Lucas Berger 28e9ca9840 docs(17-03): complete phone layout overlap fix plan — SUMMARY.md 
FAB lifted above BottomTabBar, phone content padding added, D-01
regression guard committed to layout.spec.ts; 3-profile e2e sweep green.
 2026-06-18 12:54:30 -04:00
Lucas Berger 620d64138a feat(17-06): add success toasts to admin create-member and reset-password 
- Add toast state + 3000ms auto-dismiss useEffect to AdminPage
- Set toast 'Member added.' in createMemberMutation.onSuccess
- Propagate 'Password reset.' up from ResetPasswordSheet via onSuccess callback
- Render role=status/aria-live=polite toast with CheckCircle icon
- Phone toast offset uses calc(var(--bottom-chrome-h) + var(--space-4)) to clear BottomTabBar
 2026-06-18 12:53:12 -04:00
Lucas Berger b71238634f feat(17-05): add phone/desktop style branch to CredentialSheet (D-09) 
- Add window.matchMedia('(max-width: 767px)') phone check
- Desktop branch: position fixed, top/left 50%, translate(-50%, -50%), maxWidth 480px, borderRadius 12px
- Phone branch: unchanged bottom-sheet (bottom 0, left 0, right 0, borderRadius 12px 12px 0 0)
- role=dialog, aria-modal, aria-label unchanged — only position CSS branched
- SettingsSheet, ChangePasswordSheet, LinkOidcSheet centering in prior commit (Task 1)
 2026-06-18 12:52:59 -04:00
Lucas Berger 132a5e4eae feat(17-05): add Sign out control with handleSignOut to SettingsSheet (D-07) 
- Add LogOut icon (lucide-react) and fetchLocalLogout (api/client) imports
- Add useNavigate (react-router) for post-logout redirect
- Implement handleSignOut: fire-and-best-effort try/catch, navigate to /login in both branches
- Add Sign out button row at bottom of sheet (44px tap target, var(--color-destructive), divider separator)
- Always navigates to /login even on API failure (server cookie cleared or expired)
 2026-06-18 12:52:48 -04:00
Lucas Berger 4cb16f8271 docs(17-04): complete brand wiring plan — BrandSlot logo, favicons, maskable icon fix, accent 
- BrandSlot: placeholder div replaced with decorative logo img (ce95aa3)
- tokens.css: --brand-logo-border-radius 0, --color-member-0 #e8915a (df578fd)
- index.html: favicon.svg + favicon.ico links, theme-color #e8915a (df578fd)
- vite.config.ts: maskable icon fixed to /icon-maskable-512.png, theme_color #e8915a (df578fd)
- Build: green; manifest.webmanifest verified correct
 2026-06-18 12:51:58 -04:00
Lucas Berger 85a803fba6 test(17-03): add FAB↔BottomTabBar overlap regression guard to layout.spec.ts 
- New test: "New Event FAB does not overlap BottomTabBar (A — phone only)"
- Skips on desktop profile; runs iphone + pixel (the profiles that exposed D-01)
- Asserts fabBox.y + fabBox.height <= navBox.y (FAB bottom ≤ bar top)
- Confirms Task 1 fix resolves the seed defect — passes green on both profiles
 2026-06-18 12:51:32 -04:00
Lucas Berger df578fd7b7 feat(17-04): wire favicons + theme-color in index.html, fix maskable icon + accent in manifest 
- index.html: add favicon.svg (SVG, modern browsers first) + favicon.ico (legacy) links
- index.html: update theme-color from #4A90D9 to approved #e8915a (warm amber)
- vite.config.ts: fix maskable icon — reference /icon-maskable-512.png (separate file) not /icon-512.png
- vite.config.ts: update manifest theme_color to #e8915a to match index.html
- tokens.css: update --color-member-0 to #e8915a (warm amber, Variant B, operator-approved 17-02)
- --sx-color-primary follows automatically via var(--color-member-0)
 2026-06-18 12:50:50 -04:00
Lucas Berger ce95aa3e6b feat(17-04): wire logo img into BrandSlot, set --brand-logo-border-radius 0 
- Replace placeholder FS div with decorative <img src="/logo.svg" alt="" aria-hidden>
- Apply Surface B-1 style (width/height brand-logo-size, borderRadius token, contain/block)
- Update --brand-logo-border-radius from 50% to 0 (SVG draws its own rx=104 shape)
- h1 FamilySync and tagline p unchanged; LoginPage.tsx untouched (seam contract honored)
- No dangerouslySetInnerHTML (T-05-24 invariant maintained)
 2026-06-18 12:48:55 -04:00
Lucas Berger 5e1c714894 fix(17-03): lift FAB above BottomTabBar and reserve phone content padding 
- CalendarShell.tsx: FAB bottom changed from var(--space-6) to
  calc(var(--bottom-chrome-h) + var(--space-6)) — sits 24px above bar
- App.tsx: contentStyle gains phone-only paddingBottom: var(--bottom-chrome-h)
  via spread pattern ...(phone ? {...} : {}) — desktop unchanged
 2026-06-18 12:48:35 -04:00
Lucas Berger 9e080fb22a docs(phase-17): update tracking after wave 1 2026-06-18 12:45:49 -04:00
Lucas Berger 65e6222944 chore: merge executor worktree (worktree-agent-af89750bf86857964) 2026-06-18 12:44:24 -04:00
Lucas Berger 58d11caee0 chore: merge executor worktree (worktree-agent-a1fb88aa75fd00c8f) 2026-06-18 12:44:23 -04:00
Lucas Berger d917157c63 docs(17-02): complete branding assets plan summary 
Records approved brand decisions for plan 17-04:
- logo art approved (family-house redesign)
- brand accent #e8915a (warm amber)
- --brand-logo-border-radius: 0
 2026-06-18 12:43:45 -04:00
Lucas Berger 4c99470c1a feat(17-02): apply approved family-house logo + regenerate icon set 
- Overwrite logo.svg with approved higher-contrast family-house SVG
  (warm peach gradient bg, amber roof, bold white walls, heart finial,
  three clearly-spaced family figures in rose/gold/blue)
- Regenerate full icon/favicon set from new art:
  favicon.svg, favicon.ico (967 B), icon-192.png (192x192),
  icon-512.png (512x512), icon-maskable-512.png (512x512 safe-zone),
  apple-touch-icon.png (180x180)
- Approved brand decisions recorded for plan 17-04:
  accent #e8915a, --brand-logo-border-radius: 0
 2026-06-18 12:42:43 -04:00
Lucas Berger d01ec2388c docs(17-01): complete token groundwork plan — SUMMARY 
tokens.css restructured to :root,[data-theme=light] combined selector;
--bottom-chrome-h added; all --sx-color-* overrides intact; build green;
layout.spec.ts pixel profile 15/15 pass; Schedule-X colors verified.
 2026-06-18 12:14:45 -04:00
Lucas Berger b364573285 feat(17-02): generate full icon/favicon set from logo.svg (Task 2) 
- Run @vite-pwa/assets-generator minimal2023Preset against public/logo.svg
- Produce: favicon.ico (861 B, non-trivial), favicon.svg, icon-192.png (1617 B),
  icon-512.png (4221 B), icon-maskable-512.png (3353 B, 512x512 distinct maskable
  with safe-zone padding), apple-touch-icon.png (1110 B, 180x180)
- Replace 3 placeholder stubs with real generated assets
- Update pwa:icons script to include post-generation canonical rename step
- Add generator intermediate output filenames to .gitignore
 2026-06-18 12:13:50 -04:00
Lucas Berger c2f89bd55f feat(17-01): restructure tokens.css to combined :root,[data-theme=light] selector + add --bottom-chrome-h 
- Change :root { to :root, [data-theme="light"] { (D-06 combined selector)
- Add --bottom-chrome-h: calc(56px + env(safe-area-inset-bottom, 0px)) to spacing scale
- Keep all 12 --sx-color-* overrides inside the combined block (cascade unchanged)
- Keep --brand-logo-* tokens inside the combined block (verbatim, no value changes)
- Add dark-theme stub as comment-only (Phase 999.20 fills values; no live rule)
- All existing values unchanged; PWA build passes; Schedule-X colors verified via playwright-cli
 2026-06-18 12:12:42 -04:00
Lucas Berger 7db9005645 feat(17-02): install @vite-pwa/assets-generator, author logo.svg, add pwa-assets.config.ts 
- Add @vite-pwa/assets-generator@1.0.2 as devDependency in apps/pwa
- Add pwa:icons script (pwa-assets-generator generate) to apps/pwa/package.json
- Approve sharp build scripts in pnpm-workspace.yaml (required for @vite-pwa/assets-generator)
- Hand-author apps/pwa/public/logo.svg: warm/rounded/at-home family scene with house, two adults, child, heart — square 512x512 viewBox, self-contained, text-free
- Create apps/pwa/pwa-assets.config.ts with minimal2023Preset, images: ['public/logo.svg'], no overrideManifestIcons
 2026-06-18 12:12:17 -04:00
Lucas Berger eb0db8beef docs(17): create phase plan 2026-06-18 11:36:21 -04:00
Lucas Berger 280438b2d3 docs(17): create phase plan (6 plans, 2 waves) — UI optimization & polish 2026-06-18 11:34:04 -04:00
Lucas Berger 28cf79754a docs(17): add validation strategy 2026-06-18 11:19:24 -04:00
Lucas Berger f789a67f95 docs(17): research phase domain 2026-06-18 11:17:44 -04:00
Lucas Berger a1457a5b30 docs(17): UI design contract 2026-06-18 10:59:25 -04:00
Lucas Berger efeee02a36 Merge remote-tracking branch 'origin/main' into gsd/phase-17-ui-optimization-polish 
# Conflicts:
#	.planning/STATE.md
 2026-06-18 10:08:45 -04:00
Lucas BergerandClaude Opus 4.8 cfe84715d5 docs: add developer profile section to CLAUDE.md
Publish / publish (push) Successful in 11s
Details 
Generated by /gsd-profile-user from session analysis (8 dimensions).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-18 10:07:03 -04:00
Lucas Berger 1e2cc52659 docs: refresh project documentation against current codebase
Publish / publish (push) Successful in 26s
Details
2026-06-18 06:44:29 -04:00
Lucas BergerandClaude Opus 4.8 b6490feff4 fix(19): satisfy CI fast-checks + secret scan
CI / changes (pull_request) Successful in 9s
Details
CI / api (pull_request) Successful in 3m2s
Details
CI / fast-checks (pull_request) Successful in 4m20s
Details
CI / security (pull_request) Successful in 1m14s
Details
CI / harness (pull_request) Successful in 6m56s
Details
CI / gate (pull_request) Successful in 2s
Details 
Lint (eslint --max-warnings 0):
- index.ts: disable no-unsafe-argument on the type-only Context mismatch when
  delegating to the OIDC handler inside the local-session skip wrapper
- localAuth.ts: handleLogout is sync (no await) — drop async (require-await)
- devBypass.ts: disable detect-possible-timing-attacks on the public well-known
  dev-placeholder string compare (not a secret comparison)
- remove dead code / unused bindings flagged by no-unused-vars: makeTestApp
  (localSession.test), makeUnauthContext + BrowserContext import (login.spec),
  unused memberId (admin.test), unused txSelectCount counter (me.test)
- localAuthMiddleware.test / me.test: fix unused + reflow-detached
  eslint-disable directives

Format: prettier --write across the 20 Phase-19 files that were never formatted.

Secret scan (gitleaks): allowlist two false positives — the synthetic >=32-char
TEST_SECRET in localSession.test.ts, and .planning/ design prose (a generic-api-key
regex hit on "credential atomically, 409-equivalent"). Neither is a real secret.

Verified locally: format:check, lint, typecheck, md:lint, gitleaks (no leaks),
PWA 266/266, API 452/452.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-17 23:05:15 -04:00
Lucas Berger 91ab9d1f78 docs(19): ship phase 19 — PR #23 2026-06-17 22:49:45 -04:00
Lucas Berger abf7be782a docs(phase-19): add security threat verification (28/28 closed, threats_open: 0)
CI / changes (pull_request) Successful in 10s
Details
CI / fast-checks (pull_request) Failing after 2m17s
Details
CI / api (pull_request) Successful in 2m51s
Details
CI / security (pull_request) Failing after 12s
Details
CI / harness (pull_request) Successful in 5m9s
Details
CI / gate (pull_request) Failing after 2s
Details
2026-06-17 22:47:45 -04:00
Lucas Berger f3af130e9e docs(17): add workstream D — 4 UI findings from Phase 19 UAT (logout button, admin feedback, popup centering, admin nav) 2026-06-17 22:34:18 -04:00
Lucas Berger af0a70ccec test(19): complete UAT — Tests 1-3 pass live, 4 resolved-by-fix, 5→ship; 4 UI findings routed to Phase 17 2026-06-17 22:32:52 -04:00
Lucas Berger 73dd6a2383 docs(19): re-review after fixes — status clean (0 critical/warning, 2 info) 2026-06-17 20:50:25 -04:00
Lucas Berger 9cccf17ef9 chore: enable MemPalace discuss-time recall + KG mirror 2026-06-17 20:45:39 -04:00
Lucas Berger 5f74ae965d docs(19): add code review fix report 2026-06-17 20:42:51 -04:00
Lucas Berger cef2c66de5 merge(19): land code-review fixes (CR-01..04, BL-01..04, WR-01..07, IN-01..04) 2026-06-17 20:39:49 -04:00
Lucas Berger 2691dd0f95 fix(19): IN-04 enforce single-use OIDC-link nonce to prevent state replay 2026-06-17 20:37:09 -04:00
Lucas Berger 83e23d760d docs(state): record phase 17 context session 2026-06-17 20:37:02 -04:00
Lucas Berger 3784762817 docs(17): capture phase context (layout polish + branding + theme groundwork; dark mode/styling deferred) 2026-06-17 20:37:02 -04:00
Lucas Berger f02521dd02 fix(19): IN-03 evict stale loginAttempts entries to bound in-memory map growth 2026-06-17 20:35:43 -04:00
Lucas Berger e392bf2eb7 fix(19): IN-02 add lockstep test pinning inlined scrypt params against canonical verifyPassword 2026-06-17 20:34:58 -04:00
Lucas Berger f2fc1404d4 fix(19): IN-01 validate LOCAL_SESSION_EXPIRES coercion (fallback on NaN/non-positive) 2026-06-17 20:34:14 -04:00
Lucas Berger 916fb34f17 docs: add backlog items 999.20 (dark mode/theming) + 999.21 (styling refresh) 2026-06-17 20:34:02 -04:00
Lucas Berger 4bd6b2c057 fix(19): WR-05 add no-echo tests for admin create-member and me password hook sites 2026-06-17 20:33:46 -04:00
Lucas Berger 32bdd1e92d fix(19): WR-07 reject route ids with trailing garbage via strict integer parse 2026-06-17 20:32:26 -04:00
Lucas Berger 4cf2ad4bff fix(19): WR-06 stop sliding the rate-limit cooldown window on rejected attempts 2026-06-17 20:31:07 -04:00
Lucas Berger 30ad25c026 fix(19): WR-03 make scrypt hashing async (threadpool) to avoid event-loop starvation DoS 2026-06-17 20:30:28 -04:00
Lucas Berger 322929aebe fix(19): WR-02+WR-04 centralize OIDC config (env-or-app_config) and discover auth endpoint 2026-06-17 20:26:47 -04:00
Lucas Berger c4d8d76a4c fix(19): WR-01 parse reset-admin flags explicitly and stop echoing username 2026-06-17 20:25:18 -04:00
Lucas Berger 40666e1cc5 fix(19): BL-04 keep context oidcIss/oidcSub null for local users (no fabricated identity sentinels) 2026-06-17 20:24:01 -04:00
Lucas Berger 71537601ce fix(19): BL-03 reject OIDC-link bind on empty iss/sub or mismatched local session (takeover guard) 2026-06-17 20:22:37 -04:00
Lucas Berger cd095e5b67 fix(19): BL-02 match Secure attribute on logout cookie deletion to issue-time logic 2026-06-17 20:21:51 -04:00
Lucas Berger 3674b255b2 fix(19): BL-01 enforce LOCAL_SESSION_SECRET length floor in devSessionCookieMiddleware 2026-06-17 20:21:17 -04:00
Lucas Berger b083cb7193 fix(19): CR-04 scope login lockout to username, add TTL auto-expiry + admin-reset unlock 2026-06-17 20:20:43 -04:00
Lucas Berger 6ef8e03f8c fix(19): CR-03 return 403 for wrong current password so change-password does not log user out 2026-06-17 20:17:32 -04:00
Lucas Berger 93c47b38aa fix(19): CR-02 send initialPassword + map 409 conflict in fetchCreateMember 2026-06-17 20:15:58 -04:00
Lucas Berger 1688f229e0 fix(19): CR-01 align OIDC-link client contract with server (authorizationUrl) 2026-06-17 20:15:23 -04:00
Lucas BergerandClaude Opus 4.8 46eaf070ea chore: enable MemPalace for project and ignore per-project files 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-17 20:12:50 -04:00
Lucas Berger 4b635784e4 docs(19): add code review report 2026-06-17 20:08:26 -04:00
Lucas Berger 37fd896ce9 docs(phase-19): mark phase complete (verification passed, 5/5 plans) 2026-06-17 20:00:21 -04:00
Lucas Berger 0aca22f743 docs(19): verification passed (21/21) after blocker fix; UAT for live/CI items 2026-06-17 20:00:00 -04:00
Lucas BergerandClaude Opus 4.8 53da4be62b fix(19): correct admin reset-password client URL (AUTH-LOCAL-08 blocker) 
VERIFICATION.md found a cross-layer URL mismatch: fetchAdminResetPassword
POSTed to /api/admin/members/:id/reset-password but the API registers the
route as /api/admin/members/:id/password (admin.ts), so the Admin reset sheet
404'd on every submit. Confirmed live: old path -> 404, correct path -> 400
(route reached). Unit tests missed it because API tests hit the real path
directly and PWA tests mock the fetcher — no test crossed both layers.

Fix the client URL and add a URL-contract regression test that pins the exact
path (asserts fetch is called with /api/admin/members/:id/password).

PWA 266/266 (+1), typecheck clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-17 19:58:17 -04:00
Lucas Berger 9b10d875d4 docs(phase-19): update tracking after wave 4 2026-06-17 17:44:10 -04:00
Lucas BergerandClaude Opus 4.8 17a531550a fix(19): resolve post-merge wave-4 harness integration gaps 
Two issues surfaced only when plans 19-04 (login UI) and 19-05 (Option C
bypass + login.spec) were merged together and run against the real stack —
neither executor could catch them in isolation:

1. LOCAL_SESSION_SECRET was added to the CI harness (ci.yml) but not to the
   local dev stack (docker-compose.dev.yml). Without it the real-login success
   path (POST /api/auth/local/login) 503s when signing the session cookie, so
   the e2e round-trip failed. Add the same fixed dev-only value to the dev
   compose override (dev-only target; never a production secret).

2. login.spec test 1 assumed clearing the local-session cookie yields a
   logged-out state, but under the always-on DEV_AUTH_BYPASS devAuthBypass()
   injects DEV_USER into /api/me regardless of any cookie — a logged-out state
   is architecturally unreachable in this bypass-only harness. Reframe the test
   to drive /login directly (validating the real-browser render of all brand +
   form surfaces) and move the unauthenticated root->/login redirect-gate
   coverage to a unit test in App.test.tsx where meQuery.isError is controllable.

Result: API 446/446, PWA 265/265 (+2 gate tests), e2e desktop 42 passed / 3
skipped (all login specs green).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-17 17:43:11 -04:00
Lucas Berger 11977fddf4 chore: merge executor worktree (worktree-agent-ad5628ea37541e256) 2026-06-17 17:28:49 -04:00
Lucas Berger c7142b5fe5 chore: merge executor worktree (worktree-agent-a71adf90ed21b044c) 2026-06-17 17:28:48 -04:00
Lucas Berger 63beb74650 docs(19-04): complete PWA login UI + account management surfaces plan 2026-06-17 17:26:07 -04:00
Lucas Berger eba0bb095d docs(19-05): complete dev-bypass rework + harness + CI plan (checkpoint) 2026-06-17 17:22:39 -04:00
Lucas Berger 19c45eb069 feat(19-04): AdminPage LOCAL ACCOUNTS + SettingsSheet change-password / link-OIDC 
- Add hasLocalCredential to AdminMember type (mirrors API extension from plan 19-02)
- Add createMember mutation + Surface 11A inline add-member form in AdminPage
- Add Surface 11B Reset-password button in MemberRow (hasLocalCredential gate)
- Add ResetPasswordSheet component (bottom-sheet, role=dialog, focus-managed, Escape closes)
- Add Surface 12 Change-password row in SettingsSheet (hasLocalCredential gate)
- Add Surface 13 Link-OIDC identity row in SettingsSheet (hasLocalCredential + oidcEnabled gate)
- Add ChangePasswordSheet component (current/new/confirm fields, change-password mutation)
- Add LinkOidcSheet component (confirmation dialog; uses generic OIDC copy per D-06, no provider branding)
- Fix: update InstructionSheet.test.tsx to wrap with QueryClientProvider (Rule 1 - now uses useQuery)
- Fix: remove stale eslint-disable in App.test.tsx (lint --max-warnings 0 would fail)
- All 263 tests pass; typecheck clean; lint clean
 2026-06-17 17:21:20 -04:00
Lucas Berger 1f94dc5eb7 feat(19-05): global-setup local_credentials seed + login.spec.ts + CI harness env 
- global-setup.ts: TRUNCATE local_credentials + seed devuser/devpass (PHC scrypt inline)
- Create login.spec.ts: real-login-form e2e (gate redirect, wrong-password error, correct login)
- ci.yml: add LOCAL_SESSION_SECRET dev value + local_credentials seed step in harness job
- Fix all test mocks: add devSessionCookieMiddleware no-op to vi.mock(devBypass.js) blocks
  in admin/setup/push/lists/localAuth/authMode/requireAdmin tests (Rule 1 - Bug: missing export)
- Full API suite: 446/446 tests pass; pnpm typecheck: exit 0
 2026-06-17 17:21:05 -04:00