oier/collective-lists
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(mvp2): close out — 6/6 fases shipped, 476 tests green

Browse Source 
Final test totals after MVP2:
- pgTAP:               166 (was 45 → +121)
- Vitest integration:  173 (was 140 → +33)
- Vitest unit:          47 (was 15  → +32)
- Playwright e2e:       89 (was 59  → +30)
- Rate-limit gated:      1
- Total active:        476 (was 259 → +217)
- Skipped:               3 (unchanged: 2 Realtime presence + 1 gated)

Cycle summary:
- Fase 9  — dark mode + max-w-2xl + sync_conflicts + WebKit project
- Fase 10 — H06/H07/H08 + trash restore + account delete + sidebar create
            + reset-from-detail + auto language detection
- Fase 11 — item tags + drag-reorder
- Fase 12 — section visibility (feature flags, JSONB + section_enabled())
- Fase 13 — server admin (/admin, server_admins, audit log, server-layer
            section_enabled extension)
- Fase 14 — PWA auto-update toast + offline polish + version chip

Migrations 015 → 025 (11 new). pgTAP 009 → 017 (9 new files).
Per-fase history docs under docs/history/fase-{9,10,11,12,13,14}-*.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Oier Bravo
2026-05-18 07:39:54 +02:00
parent 7bf9135f33
commit d9d5f780c1
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
CLAUDE.md
View File

@@ -6,7 +6,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
**Fase 0–5 complete. Fase 6 complete (deploy readiness: PWA injectManifest SW + manifest + iOS meta tags + placeholder icons + Kong rate-limit on invitations + dev JWT rotation + prod env template + rls-audit.sh + Justfile lighthouse/rls-audit/test-rate-limit). Production stack deployed to ambrosio (OVH VPS) at https://erosi.limonia.net (app + Supabase, external Keycloak); edge proxy now off-stack — internal Caddy fans kong/app on host port 3000, whatever external proxy fronts the host terminates TLS and forwards plain HTTP to ambrosio:3000 (originally NetBird's self-hosted Traefik, now proxy-agnostic); PWA strategy switched to generateSW to unblock the prod build (see the "injectManifest hardcoded filename" gotcha below). Fase 7 complete: 12 new Playwright tests fill the collective-flow UI gap (O-01..O-03 onboarding, I-01..I-05 invitation acceptance, MC-02..MC-05 admin-manage) — writing them surfaced + fixed three latent bugs in the product code (atomic `create_collective()` RPC, pendingInvitationToken restore after login, manage page not reloading on late $currentCollective hydration). Plus migration 013 (auth.users role/aud default trigger) — found after the first real self-registration on prod via Keycloak→GoTrue left the user with empty `role`/`aud` columns, breaking every REST call with `role "" does not exist`. Post-fase-7 prod auth hardening (2026-04-20..21, see `docs/history/fase-8-auth-logout.md`): migration 014 extends the role/aud guard to UPDATE (GoTrue's pop-ORM resends role='' right after the INSERT and clobbered the INSERT trigger's backfill); `logout()` now does RP-initiated Keycloak end-session + lands on a new public `/logged-out` route, which both actually ends the Keycloak SSO cookie (so the next login re-prompts) and closes a PKCE-verifier race that produced "PKCE code verifier not found in storage" on prod. 259 tests green: 45 pgTAP + 140 Vitest integration + 15 Vitest unit + 59 Playwright + 1 Vitest rate-limit (gated, run via `just test-rate-limit`). 3 skipped in `just test-all` (2 Realtime presence — upstream `handle_out/3` bug; 1 rate-limit — gated). Push notifications + CI Docker + final production icons deliberately out of scope. ✅**
**MVP2 — in progress (5/6 ✅).** Branch `mvp2`. **Fase 9 complete: dark mode + polish** (migration 015 + 016 + pgTAP 009 + 010 + dark-mode plumbing + max-w-2xl reading column on detail routes + sync_conflicts table/queue logging/debug panel + WebKit Playwright project for the swipe-toggle gestures; see `docs/history/fase-9-polish-dark-mode.md`). **Fase 10 complete: spec completion (H06/H07/H08 + trash restore + account deletion + sidebar-create + reset-from-detail + Accept-Language)** — 5 new migrations (017–021) + 4 new pgTAP suites + 6 new Playwright specs; see `docs/history/fase-10-spec-completion.md`. **Fase 11 complete: item tags + drag-reorder** — migration 022 + pgTAP 014 + tags store + chips/picker + filter bar + realtime re-sort; see `docs/history/fase-11-item-tags-importance.md`. **Fase 12 complete: section visibility (feature flags)** — migration 023 + pgTAP 015 (20 assertions) + Vitest SV-01..SV-06 + Playwright SV-01..SV-03; JSONB `feature_flags` on `users`+`collectives`, `public.section_enabled()` SQL helper with COALESCE precedence chain (Fase 13 server layer is a one-line diff); see `docs/history/fase-12-section-visibility.md`. **Fase 13 complete: server administration** — migrations 024+025 (server_admins + admin_actions + server_settings + 9 SECURITY DEFINER admin RPCs) + pgTAP 016+017 (43 assertions) + Vitest SA-01..SA-10 + Playwright SA-01..SA-04 (new `loginAsAdmin` fixture); `/admin` route group with red banner + collectives/admins/audit/server pages; `is_server_admin()` STABLE SECURITY DEFINER (also breaks otherwise-recursive RLS policy on `server_admins`); soft-delete + 30-day-or-force hard-delete on `collectives.deleted_at`; last-admin guard on `revoke_server_admin` (P0003); audit append-only via missing INSERT/UPDATE/DELETE policies on `admin_actions`; `section_enabled()` extended with server layer (server → collective → user → default); bootstrap via `SERVER_ADMIN_EMAIL` + `infra/db-init/10-server-admin-seed.sh` on first volume init (prod gotcha: needs manual re-run after the operator's first Keycloak login because `public.users` is empty on cold init), dev pre-seeds Ana via `supabase/seed.sql`. `isServerAdmin` + `isServerAdminLoaded` stores refreshed on every `onAuthStateChange`; the latter prevents the (admin) layout from redirecting away during the SIGNED_IN→RPC race; see `docs/history/fase-13-server-admin.md`. Test totals: 167 pgTAP (running-total mode; 43 new in 016+017) + 173 Vitest integration + 45 Vitest unit + 86 Playwright + 1 Vitest rate-limit (gated) = **472+ tests green**; 3 skipped in `just test-all` (2 Realtime presence — upstream `handle_out/3` bug `supabase/realtime#1617` still open; 1 rate-limit — gated). 1 flaky Playwright test under full `just test-e2e` load (`section-visibility` SV-02 — pre-existing realtime propagation flakiness; passes standalone and in `admin + section-visibility` combined runs). Remaining fases (📋): Fase 14 PWA hardening — update toast, offline polish, version chip, depends on Fase 9.3 (`plan/fase-14-pwa-hardening.md`, no migration). Fase 7+8 already shipped as MVP cleanup, not MVP2.
**MVP2 — COMPLETE (6/6 ✅, 2026-05-18).** Branch `mvp2`. **Fase 9: dark mode + polish** (migrations 015–016 + pgTAP 009–010 + dark-mode plumbing + max-w-2xl reading column + sync_conflicts table/queue logging + WebKit Playwright project; see `docs/history/fase-9-polish-dark-mode.md`). **Fase 10: spec completion (H06/H07/H08 + trash restore + account deletion + sidebar-create + reset-from-detail + Accept-Language)** — migrations 017–021 + 4 new pgTAP suites + 6 new Playwright specs; see `docs/history/fase-10-spec-completion.md`. **Fase 11: item tags + drag-reorder** — migration 022 + pgTAP 014 + tags store + chips/picker + filter bar + realtime re-sort; see `docs/history/fase-11-item-tags-importance.md`. **Fase 12: section visibility (feature flags)** — migration 023 + pgTAP 015 + JSONB `feature_flags` on `users`+`collectives` + `public.section_enabled()` SQL helper with COALESCE precedence; see `docs/history/fase-12-section-visibility.md`. **Fase 13: server administration** — migrations 024+025 (server_admins + admin_actions + server_settings + 9 SECURITY DEFINER admin RPCs) + pgTAP 016+017 + `/admin` route group + last-admin guard + audit-append-only via missing-policies pattern + `section_enabled()` extended with server layer + `SERVER_ADMIN_EMAIL` bootstrap (prod needs manual re-run after the operator's first Keycloak login); see `docs/history/fase-13-server-admin.md`. **Fase 14: PWA hardening** — `useRegisterSW` + `UpdateToast` (auto-update toast) + offline chip + queued-op badge + `/settings/sync-conflicts` review route + `__APP_VERSION__`/`__APP_COMMIT__`/`__BUILD_TIME__` defines baked at build via Dockerfile `GIT_SHA` build-arg (host-side `git rev-parse --short HEAD` in `deploy-erosi.sh`) + "Acerca de" version chip in `/settings`; no migration; see `docs/history/fase-14-pwa-hardening.md`. **Final test totals (`just test-all`): 166 pgTAP + 173 Vitest integration + 47 Vitest unit + 89 Playwright + 1 gated rate-limit = 476 tests green; 3 skipped (2 Realtime presence — upstream `handle_out/3` bug `supabase/realtime#1617`; 1 rate-limit — gated). Delta vs MVP close: +121 pgTAP + +33 integration + +32 unit + +30 e2e = +217 tests across MVP2.** Fase 7+8 already shipped as MVP cleanup, not MVP2.
## Documentation Map