- All four pnpm install steps now use --store-dir /pnpm-store --prefer-offline
- harness job env adds PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
- Updated stale D-PROBE-04 comments to reflect persistent store
- Playwright install step gets a comment noting the future runner-image optimization
UAT was committed locally after PR #25's final push, so it never reached
main. Recovered and committed directly per maintainer authorization.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add maxLength={256} to the edit-mode and create-mode display-name inputs,
and maxLength={128} to the create-mode username input, matching the server-
side Zod schema limits. This surfaces the constraint client-side instead of
letting a long entry reach the server and return a generic 400.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Render an explanatory helper line when displayName is empty and no
other error is showing, so admins editing an OIDC-provisioned member
with a null displayName understand why Save is disabled rather than
seeing a greyed-out button with no explanation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link the admin role="switch" toggle button to the profile-error region
via aria-describedby so screen-reader users who activate the toggle
hear the last-admin error announcement — matching the existing link on
the display-name input.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add maxHeight:90dvh + overflowY:auto to the phone bottom-sheet branch
so content overflowing a short viewport (iPhone SE 667px) is scrollable
rather than clipped and the Save buttons remain reachable.
Add paddingBottom with env(safe-area-inset-bottom) to clear the iOS home
indicator / Android gesture navigation bar (IN-03).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
WR-01: Send only changed fields in profileMutation so admin-toggle-only
saves don't re-send displayName (blocking members with null displayName
from ever having their admin flag toggled).
WR-02: Revert the toggle to member!.isAdmin explicitly instead of
`member?.isAdmin ?? true` — the prior fallback was correct by coincidence
but semantically wrong for any error path where member is non-null.
WR-04: Remove member-derived field resets (displayName, isAdmin) from
handleClose — those belong to the useEffect sync that already tracks
member?.id/displayName/isAdmin. Only ephemeral fields (passwords, errors)
are reset on close, eliminating the stale-closure Cancel regression.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Store only the member id in editorMemberId state rather than the full
AdminMember object. Derive editorMember from membersQuery.data after each
render, so query invalidations following a per-section save always give
MemberEditorSheet fresh server state — eliminating the stale-reference
silent-overwrite race.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Wrap the last-admin check and UPDATE in a db.transaction with a
SELECT...FOR UPDATE locking read so concurrent PATCH demotions
serialise and cannot both pass the guard, eliminating the TOCTOU
race (CR-01).
Add a .refine() to updateMemberSchema requiring at least one field,
returning 400 via noEchoHook instead of crashing Drizzle with an
empty SET clause (WR-06).
Add Test H asserting empty {} -> 400 { error: 'Invalid request' }.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- MemberRow: whole-row role=button, aria-label='Edit {name}', trailing ChevronRight
- Admin badge on member.isAdmin (12px/600, --color-member-0 on --color-surface-dim)
- 'Add member' ghost trigger with Plus icon opens MemberEditorSheet in create mode
- Single MemberEditorSheet replaces CredentialSheet + ResetPasswordSheet mounts
- Removed: inline Local Accounts add-form, ResetPasswordSheet definition, create-form state
- Empty state: 'No members yet' / 'Add a member to get started.' (UI-SPEC copy)
- Add isAdmin field to GET /members select and mapped member object (D-02)
- Add updateMemberSchema (displayName optional string, isAdmin optional boolean)
- Register adminRouter.patch('/members/:id') with noEchoHook and requireAdmin (inherited)
- Handler: parsePositiveIntParam id validation (400), existence check (404),
D-03 last-admin guard via COUNT(*) query (409), partial set() update (200)
- Fix Test D: switch to adminId2 for GET after self-demotion (adminId1 no longer admin)
- All 44 tests green including 7 new PATCH/isAdmin tests
- 8 RED tests covering: PATCH URL contract, credentials/redirect shape,
void on 200, SessionExpiredError on 401/opaqueredirect, last-admin
sentinel on 409 and 422, generic error on 500
- 1 compile-time shape test for AdminMember.isAdmin: boolean
- All new tests fail (updateMemberProfile is not a function); 42 existing pass
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Test A: PATCH displayName happy path → 200, GET reflects change
- Test B: PATCH isAdmin promote → 200, GET shows isAdmin true
- Test C: last-admin guard → 409 when only admin demotes self
- Test D: self-demotion → 200 when second admin exists
- Test E: non-admin PATCH → 403 (requireAdmin boundary)
- Test F: wrong-type body → 400 { error: "Invalid request" }; malformed :id → 400
- Test G: non-existent member id → 404
- Test H: GET /members includes boolean isAdmin per member
All 7 new tests fail RED for the right reasons (route 404 / isAdmin missing)
Phase 17 D-10 reworked /admin into a two-tab layout; the Timezone section
moved into the (initially hidden) Settings tab panel. timezone-verify.spec.ts
predates that rework and asserted the region visible on bare /admin, so all 7
tests timed out in the harness. Click the Settings tab in beforeEach and after
the persist-test reload. Product behavior is correct; the spec was stale.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reformats 4 phase-17 files (SettingsSheet.tsx, tokens.css, vite.config.ts,
pwa-assets.config.ts) plus 11 pre-existing non-conformant docs/READMEs that
the repo-wide format:check also flags.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Add toast state + 3000ms auto-dismiss useEffect to AdminPage
- Set toast 'Member added.' in createMemberMutation.onSuccess
- Propagate 'Password reset.' up from ResetPasswordSheet via onSuccess callback
- Render role=status/aria-live=polite toast with CheckCircle icon
- Phone toast offset uses calc(var(--bottom-chrome-h) + var(--space-4)) to clear BottomTabBar
- Add LogOut icon (lucide-react) and fetchLocalLogout (api/client) imports
- Add useNavigate (react-router) for post-logout redirect
- Implement handleSignOut: fire-and-best-effort try/catch, navigate to /login in both branches
- Add Sign out button row at bottom of sheet (44px tap target, var(--color-destructive), divider separator)
- Always navigates to /login even on API failure (server cookie cleared or expired)
- New test: "New Event FAB does not overlap BottomTabBar (A — phone only)"
- Skips on desktop profile; runs iphone + pixel (the profiles that exposed D-01)
- Asserts fabBox.y + fabBox.height <= navBox.y (FAB bottom ≤ bar top)
- Confirms Task 1 fix resolves the seed defect — passes green on both profiles
Records approved brand decisions for plan 17-04:
- logo art approved (family-house redesign)
- brand accent #e8915a (warm amber)
- --brand-logo-border-radius: 0
- Overwrite logo.svg with approved higher-contrast family-house SVG
(warm peach gradient bg, amber roof, bold white walls, heart finial,
three clearly-spaced family figures in rose/gold/blue)
- Regenerate full icon/favicon set from new art:
favicon.svg, favicon.ico (967 B), icon-192.png (192x192),
icon-512.png (512x512), icon-maskable-512.png (512x512 safe-zone),
apple-touch-icon.png (180x180)
- Approved brand decisions recorded for plan 17-04:
accent #e8915a, --brand-logo-border-radius: 0
- Add @vite-pwa/assets-generator@1.0.2 as devDependency in apps/pwa
- Add pwa:icons script (pwa-assets-generator generate) to apps/pwa/package.json
- Approve sharp build scripts in pnpm-workspace.yaml (required for @vite-pwa/assets-generator)
- Hand-author apps/pwa/public/logo.svg: warm/rounded/at-home family scene with house, two adults, child, heart — square 512x512 viewBox, self-contained, text-free
- Create apps/pwa/pwa-assets.config.ts with minimal2023Preset, images: ['public/logo.svg'], no overrideManifestIcons
Lint (eslint --max-warnings 0):
- index.ts: disable no-unsafe-argument on the type-only Context mismatch when
delegating to the OIDC handler inside the local-session skip wrapper
- localAuth.ts: handleLogout is sync (no await) — drop async (require-await)
- devBypass.ts: disable detect-possible-timing-attacks on the public well-known
dev-placeholder string compare (not a secret comparison)
- remove dead code / unused bindings flagged by no-unused-vars: makeTestApp
(localSession.test), makeUnauthContext + BrowserContext import (login.spec),
unused memberId (admin.test), unused txSelectCount counter (me.test)
- localAuthMiddleware.test / me.test: fix unused + reflow-detached
eslint-disable directives
Format: prettier --write across the 20 Phase-19 files that were never formatted.
Secret scan (gitleaks): allowlist two false positives — the synthetic >=32-char
TEST_SECRET in localSession.test.ts, and .planning/ design prose (a generic-api-key
regex hit on "credential atomically, 409-equivalent"). Neither is a real secret.
Verified locally: format:check, lint, typecheck, md:lint, gitleaks (no leaks),
PWA 266/266, API 452/452.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Lucas Berger