collective-lists/docs/history/fase-10-spec-completion.md

Fase 10 — Spec completion (MVP2 2/6)

Status: ✅ complete · 2026-05-18.

Closes the 8 functional-spec gaps audited on 2026-04-22:

1. CU-H06 Abandonar colectivo
2. CU-H07 Renombrar colectivo + cambiar emoji
3. CU-H08 Disolver colectivo
4. Trash drawer — restore + hard delete
5. Eliminación de cuenta (hard delete)
6. "Crear nuevo colectivo" desde la sidebar
7. Botón "Reiniciar lista" en vista de detalle
8. Detección automática de idioma (Accept-Language)

Spec coverage on the CU-H* axis (collective management + user lifecycle) is now 100 %.

---

Migrations introduced

#	File	Purpose
017	017_leave_collective_rpc.sql	public.leave_collective(uuid) — sole-admin auto-promote inline; P0001 for sole-member
018	018_dissolve_collective_rpc.sql	public.dissolve_collective(uuid) — admin only (P0002), cascade-driven
019	019_user_deletion_fks.sql	Relax every created_by / updated_by FK from NOT NULL RESTRICT → NULL SET NULL
020	020_restore_list_rpc.sql	public.restore_list(uuid) + public.hard_delete_list(uuid) with explicit role guards
021	021_delete_account_rpc.sql	public.delete_account() — two-step (public.users then auth.users); P0003 for sole-admin-stuck

Migration 019 was held back from the trash work (10.4) and used here in 10.5 — that's why the trash RPC migration is 020, leaving 019 as the FK-normalization seat.

---

FK on-delete audit (Fase 10.5.1)

Before migration 019, deleting a public.users row would have been blocked by every table where the user had ever created content. The relaxed behaviour after 019:

Table	Column	Before	After
collectives	created_by	NOT NULL RESTRICT	NULL SET NULL
collective_members	user_id	NOT NULL CASCADE	(unchanged — membership belongs to the user)
collective_invitations	created_by	NOT NULL CASCADE	NULL SET NULL
collective_invitations	accepted_by	NULL SET NULL	(unchanged)
shopping_lists	created_by	NOT NULL RESTRICT	NULL SET NULL
shopping_items	created_by	NOT NULL RESTRICT	NULL SET NULL
shopping_items	checked_by	NULL SET NULL	(unchanged)
task_lists	created_by	NOT NULL RESTRICT	NULL SET NULL
tasks	created_by	NOT NULL RESTRICT	NULL SET NULL
tasks	completed_by	NULL SET NULL	(unchanged)
notes	created_by	NOT NULL RESTRICT	NULL SET NULL
notes	updated_by	NOT NULL RESTRICT	NULL SET NULL
sync_conflicts	user_id	NOT NULL CASCADE (→ auth.users)	(unchanged — log entries vanish with the user)

Implication: any UI that renders the author of a row must defensively handle NULL. The intended label is "Deleted user" — the visual polish is deferred to a later cosmetic pass; the data layer is correct now.

---

Decisions documented

1. Keycloak is NOT cleaned up on delete_account(). The Keycloak admin API requires an admin token (separate auth realm), and is the external operator's domain. After delete_account() the row is gone from GoTrue's auth.users and the identity link in auth.identities, but the Keycloak account itself survives. The next OIDC login with the same email reaches GoTrue with no matching identity, GoTrue provisions a new auth.users row with a fresh UUID, the handle_new_user trigger creates the corresponding public.users row, and the user is effectively a brand-new profile. The settings modal makes this explicit.

2. Sole-member "leave" is rejected, not auto-converted to dissolve. leave_collective raises errcode P0001 in that case; the UI surfaces the "use Dissolve instead" hint with no follow-up navigation. This keeps the destructive paths explicit (per plan §Riesgo 4).

3. Dissolve confirmation by typing the collective name, not a checkbox — pattern from GitHub/Vercel for destructive operations. Plan §10.3 confirmed; D-02 enforces it.

4. Auto-language detection lives client-side (navigator.languages) not server-side (Accept-Language header). The OIDC dance (browser ↔ Keycloak ↔ GoTrue) bypasses SvelteKit entirely, so a hooks.server.ts would never see those requests. The bootstrap is gated to the post-SIGNED_IN path on the layout, fires only once per account (60-second-old + language='en' heuristic), and skips any user who has explicitly set a language before. Hispanic-locale users land in Spanish without touching anything; existing users are not retroactively re-detected.

5. Trash UI uses RPCs even though the existing PostgREST UPDATE/DELETE already works. The RPC route closes a is_active_member ambiguity (guest is excluded today via WITH CHECK, but the surface area was broader than the two intents) and pre-emptively flags the case where someone tries to hard-delete a still-active list. Direct UPDATEs continue to pass C-07..C-12 in rls-lists.test.ts — the policies are unchanged.

---

Test deltas

Suite	Baseline (Fase 9)	After Fase 10	Δ
pgTAP	65	96	+31 (010 leave +7, 011 dissolve +8, 012 trash-rpcs +8, 013 delete-account +8)
Vitest integration	144	151	+7 (trash-rpcs +5, language-bootstrap +2)
Vitest unit	26	38	+12 (accept-language)
Playwright E2E	65	74	+9 (L-01, MC-01a/b, D-01/02/03, O-04, RST-01, DEL-01)
Rate-limit (gated)	1	1	—
Total active	301	360	+59
Skipped	3	3	—

All suites green at end of fase. RLS audit clean.

---

Files added

• supabase/migrations/017_leave_collective_rpc.sql
• supabase/migrations/018_dissolve_collective_rpc.sql
• supabase/migrations/019_user_deletion_fks.sql
• supabase/migrations/020_restore_list_rpc.sql
• supabase/migrations/021_delete_account_rpc.sql
• supabase/tests/010_leave_collective.sql
• supabase/tests/011_dissolve_collective.sql
• supabase/tests/012_trash_rpcs.sql
• supabase/tests/013_delete_account.sql
• apps/web/src/lib/utils/accept-language.ts
• apps/web/src/lib/utils/accept-language.test.ts
• apps/web/src/lib/components/CreateCollectiveModal.svelte
• apps/web/tests/e2e/leave-collective.test.ts
• apps/web/tests/e2e/rename-collective.test.ts
• apps/web/tests/e2e/dissolve-collective.test.ts
• apps/web/tests/e2e/account-deletion.test.ts
• apps/web/tests/e2e/sidebar-create-collective.test.ts
• apps/web/tests/e2e/reset-from-detail.test.ts
• packages/test-utils/tests/trash-rpcs.test.ts
• packages/test-utils/tests/language-bootstrap.test.ts

Files modified

• apps/web/src/routes/(app)/settings/+page.svelte — Collectives section, Danger zone, delete-account modal
• apps/web/src/routes/(app)/collective/manage/+page.svelte — rename + emoji picker, Dissolve danger zone, dissolve confirm modal
• apps/web/src/routes/(app)/lists/[id]/+page.svelte — prominent Reset button on the completed-list view
• apps/web/src/lib/stores/lists.ts — restore/hard-delete go through the new RPCs
• apps/web/src/lib/components/layout/DesktopSidebar.svelte — switcher always-open, "+ New collective" entry
• apps/web/src/lib/components/layout/MobileDrawer.svelte — matching "+ New collective" entry
• apps/web/src/routes/+layout.svelte — maybeBootstrapLanguage() after SIGNED_IN
• apps/web/messages/en.json + apps/web/messages/es.json — ~30 new keys

---

Spec coverage table (analysis/analisis-funcional.md)

CU	Description	Status before	Status after
CU-H01	Crear cuenta	✅	✅
CU-H02	Crear colectivo	✅ (onboarding only)	✅ + sidebar
CU-H03	Invitar miembros	✅	✅
CU-H04	Aceptar invitación	✅	✅
CU-H05	Cambiar de colectivo	✅	✅
CU-H06	Abandonar colectivo	❌	✅
CU-H07	Renombrar / cambiar emoji	❌	✅
CU-H08	Disolver colectivo	❌	✅
§6.3	Eliminación de cuenta	❌	✅
§5.1	Trash restore	partial (no UI)	✅
§3.4	Reset list from detail	partial (overview only)	✅
§6.2	Accept-Language detection	❌	✅

All H-series CUs and the audited completion-debt items are now covered end-to-end.