Oier Bravo Urtasun
2db5aaac14
Closes the deferrals from Fase 4 that gated a public deploy of the MVP.
PWA install
- Custom SW at apps/web/src/sw.ts (named sw.ts, not service-worker.ts, so
SvelteKit doesn't intercept it and block Workbox imports).
- vite.config.ts switched to injectManifest strategy with precache of the
built shell; no runtime caching of Supabase (offline writes stay on the
existing $lib/sync pending_ops queue).
- Root +layout.svelte onMount() calls registerSW({ immediate: true }) from
virtual:pwa-register — the plugin does not auto-register.
- Web manifest with 192/512/512-maskable icons + iOS meta tags
(apple-mobile-web-app-capable, apple-touch-icon, etc.) in app.html.
- Placeholder icons generated via ImageMagick; replace before public launch
(noted in apps/web/static/icons/README.md).
Kong rate-limit
- /rest/v1/collective_invitations POST: 20/hour per Authorization header.
Anti-spam on invitation creation is the only rate-limit that survived —
auth rate-limits were dropped during execution (see plan §6.3): Keycloak
already provides bruteForceProtected=true on the realm, and stacking a
Kong limit on /auth/v1/token throttled legitimate PKCE code exchanges
during E2E.
- Added 'rate-limiting' to KONG_PLUGINS in docker-compose.dev.yml.
- Discovered: strip_path=true on a full-table path sends "/" upstream and
PostgREST rejects POST to root with PGRST117. Route carries a
request-transformer plugin that rewrites the URI back.
JWT rotation + prod template
- infra/scripts/rotate-jwt.sh signs anon + service_role JWTs with a fresh
48-byte secret via openssl. Prints three values for the operator to
paste; does not touch files.
- Dev secret rotated as a dry-run. Updated both .env (local, gitignored)
and apps/web/.env.development. Existing sessions are invalidated — all
users must re-login once.
- .env.production.example committed with placeholders + rotation notes.
Lighthouse + RLS audit tooling
- `just lighthouse` boots the prod build + Supabase stack and runs
lighthouse CLI against PWA/A11y/Best-Practices.
- `just rls-audit` runs infra/scripts/rls-audit.sh which signs an Eva JWT
(non-member) and GETs 8 REST endpoints — all must return []. Complements
the Vitest rls-audit.test.ts suite.
Tests
- 236 green: 34 pgTAP + 140 Vitest integration + 15 unit + 46 Playwright.
- 1 rate-limit test gated behind RUN_RATE_LIMIT_TESTS=1 (Kong counters are
shared state); run via `just test-rate-limit` which force-recreates Kong
first to reset counters.
- 3 skipped in `just test-all` (2 Realtime presence upstream bug, 1 gated
rate-limit).
Deliberately out of scope: push notifications, CI ephemeral Docker, final
production icons, runtime caching of Supabase (SyncBanner + pending_ops
already covers offline).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
53 lines
1.5 KiB
JSON
53 lines
1.5 KiB
JSON
{
|
|
"name": "@colectivo/web",
|
|
"private": true,
|
|
"version": "0.0.1",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"build": "vite build",
|
|
"preview": "vite preview",
|
|
"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
|
|
"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
|
|
"lint": "prettier --check . && eslint .",
|
|
"format": "prettier --write .",
|
|
"test:unit": "vitest run",
|
|
"test:e2e": "playwright test",
|
|
"test:e2e:headed": "playwright test --headed"
|
|
},
|
|
"dependencies": {
|
|
"@colectivo/types": "workspace:*",
|
|
"@inlang/paraglide-sveltekit": "^0.16.1",
|
|
"@supabase/supabase-js": "^2.46.2",
|
|
"cropperjs": "^1.6.2",
|
|
"idb": "^8.0.1",
|
|
"lucide-svelte": "^1.0.1",
|
|
"svelte-dnd-action": "^0.9.51"
|
|
},
|
|
"devDependencies": {
|
|
"@playwright/test": "^1.50.0",
|
|
"@sveltejs/adapter-node": "^5.2.11",
|
|
"@sveltejs/kit": "^2.15.1",
|
|
"@sveltejs/vite-plugin-svelte": "^5.0.3",
|
|
"@vite-pwa/sveltekit": "^0.6.6",
|
|
"@vitest/ui": "^4.1.4",
|
|
"autoprefixer": "^10.4.20",
|
|
"eslint": "^9.18.0",
|
|
"eslint-plugin-svelte": "^2.46.1",
|
|
"fake-indexeddb": "^6.2.5",
|
|
"jsdom": "^29.0.2",
|
|
"postcss": "^8.5.1",
|
|
"prettier": "^3.4.2",
|
|
"prettier-plugin-svelte": "^3.3.2",
|
|
"prettier-plugin-tailwindcss": "^0.6.9",
|
|
"svelte": "^5.17.3",
|
|
"svelte-check": "^4.1.1",
|
|
"tailwindcss": "^3.4.17",
|
|
"typescript": "^5.7.3",
|
|
"vite": "^6.0.7",
|
|
"vitest": "^2.1.8",
|
|
"workbox-precaching": "^7.4.0",
|
|
"workbox-window": "^7.3.0"
|
|
}
|
|
}
|