Sync master: scrub public docs, untrack internal notes/caches, roadmap update #71

Merged

ilia merged 30 commits from dev into master 2026-07-26 14:52:55 -05:00

Conversation 0 Commits 30 Files Changed 125

+7333 -2183

ilia commented 2026-07-26 14:31:56 -05:00

Owner

Copy Link

Copy Source

• Scrub homelab IPs and default credentials from README.md and .cursorrules; reduce emoji density in README
• Untrack .notes/ (internal meeting notes) and frontend/.vite/ cache; ignore .notes/, logs/, .vite/
• Deduplicate env templates: merge .env_example variants into .env.example (root, viewer, admin) and update docs/scripts references
• Roadmap update

- Scrub homelab IPs and default credentials from README.md and .cursorrules; reduce emoji density in README - Untrack .notes/ (internal meeting notes) and frontend/.vite/ cache; ignore .notes/, logs/, .vite/ - Deduplicate env templates: merge .env_example variants into .env.example (root, viewer, admin) and update docs/scripts references - Roadmap update

ilia added 30 commits 2026-07-26 14:31:57 -05:00

fix: prevent sign-out crash and surface real email-send failures ... bb09159133

- NextAuth session/jwt callbacks no longer return null (the client
  useSession() hook chokes on a null session, crashing the app on
  sign-out for deactivated/refreshed sessions) — fixes #57
- UserMenu/Header sign-out handlers close the Manage Users overlay and
  popover before calling signOut(), and no longer let a rejected
  signOut() promise go unhandled
- Added an app-level error boundary as a safety net for any remaining
  client render errors
- Registration and forgot-password flows now tell the user honestly
  when the confirmation/reset email failed to send instead of always
  claiming success — related to #56
- lib/email.ts throws a clear, actionable error when neither
  SMTP nor Resend is configured, instead of a cryptic SDK error
- Documented required SMTP/Resend env vars in DEPLOYMENT_CHECKLIST.md
  (were missing entirely, which is why no confirmation/reset emails
  were ever sent in deployed environments) — fixes #56

Merge pull request 'fix: prevent sign-out crash and surface real email-send failures' (#58) from fix/logout-crash-and-email-delivery into dev e54c60912c

feat: add dark mode and audit viewer-frontend accessibility ... c011c8078e

Add next-themes light/dark/system theming with an accessible toggle
in every header, and close out an a11y pass across the viewer app:
skip-to-content link, main landmarks and heading hierarchy on every
route, focus-trapped dialog semantics for the photo viewer modals,
aria-label/live-region coverage for dynamic messages and icon
buttons, and dark: variants for previously light-only colors.

Merge pull request 'feat: add dark mode and audit viewer-frontend accessibility' (#59) from a11y/dark-mode-and-focus-management into dev 44f3d696e4

test: add Playwright e2e smoke suite for punimtag dev ... 0a9223c943

Add an e2e/ Playwright harness (via @levkin/playkit) that smoke-tests
the public DEV host: login page loads, sign-out never redirects to a
LAN host, FastAPI /health responds, and forgot-password mail lands in
Mailtrap with a public reset link (Kolby #56/#57 regressions).

Wire it into Gitea Actions as a new `e2e` job (self-hosted runner,
Chromium via Playwright), gated behind the existing skip-ci-check.
Add npm root scripts (install:e2e, test:e2e) and gitignore e2e build
artifacts (node_modules, reports, .env).

Merge pull request 'test: add Playwright e2e smoke suite for punimtag dev' (#60) from test/e2e-playwright-smoke into dev 0f24e7e6ba

test: cover 7 previously-untested backend API route modules ... 2d6bbf1d13

Adds pytest coverage for metrics, click_log, role_permissions, videos,
pending-identifications, pending-linkages, and reported-photos — the
last three required extending conftest with a second (auth) test
database + DDL mirroring the Prisma schema-auth.prisma tables, since
those endpoints read/write DATABASE_URL_AUTH via raw SQL.

pending-photos.py is intentionally left uncovered for now (heavy
filesystem/hash-based duplicate-detection logic needs its own mocking
strategy) and tracked as a follow-up.

Merge pull request 'test: cover 7 previously-untested backend API route modules' (#61) from test/backend-pytest-coverage-gaps into dev fc8b47863d

test: add cross-endpoint integration and error-handling suites ... 5303580107

Adds test_api_integration.py (person identification, tag+search,
favorites+search, bulk favorites, and role-permission-grant workflows
chained across multiple endpoints) and test_api_errors.py (404/401/403/422
consistency sweeps, SQL-injection/XSS-style input handling, large-payload
handling) per the two suites the existing tests/API_TEST_PLAN.md already
documented but never implemented.

Along the way, found and documented (via a passing test, not a fix) that
GET /api/v1/faces/unidentified has no auth dependency, unlike its sibling
routes.

Merge pull request 'test: add cross-endpoint integration and error-handling suites' (#62) from test/backend-integration-error-suites into dev 05b908241d

Add Vitest + React Testing Library setup for viewer-frontend ... 975d0c809d

Establishes frontend unit testing infra (jsdom env, RTL, jest-dom
matchers, common Radix/jsdom polyfills) and seeds it with tests for
lib/utils.ts, lib/photo-utils.ts, hooks/useFocusTrap.ts, and
ThemeToggle.tsx (46 tests total).

Merge pull request 'Add Vitest + React Testing Library setup for viewer-frontend' (#63) from test/viewer-frontend-vitest-setup into dev 62d5a66ffa

Expand e2e auth coverage, Vitest CI, and shared URL defaults ... 47b15049bc

Wire viewer-frontend Vitest into Gitea Actions, centralize DEV base URLs
in env-defaults.json, expand playkit API catalog specs, and land auth/mail
flows plus verify-email public-host redirect and idle-logout e2e hooks.

Bump playkit to v0.3 and use Zod API schemas ... 217b82d912

Adopt assertSchema via ApiClient, playkitFailureArtifacts in Playwright
config, and keep e2e login on e2e@levkine.ca credentials from CI secrets.

Merge pull request 'Expand e2e auth, Vitest CI, env-defaults, API catalog' (#64) from test/e2e-auth-vitest-ci into dev 988e9accf8

Fill e2e gaps: storageState, real upload POST, session smoke ... d9910acdde

Add auth setup project, viewer session check, upload that posts a fixture,
FastAPI login spec (skips without E2E_API_*), and repo ROADMAP.md.

Track e2e fixture PNG (gitignore exception) 4ef8fcc7e7

Merge pull request #65 from test/e2e-gaps-roadmap ... c31c76b5a8

Fill e2e gaps and ROADMAP (#65)

test: FastAPI e2e role-permission gates + gallery search filter coverage ... e78fad692f

- Wire E2E_API_USERNAME/PASSWORD (admin) + E2E_API_VIEWER_USERNAME/PASSWORD
  (viewer) into the Gitea Actions e2e job so FastAPI-authed specs run in CI.
- Add api.role-permissions.spec.ts: viewer 403 vs admin 200/200/200 on
  /api/v1/users, /api/v1/role-permissions, and /api/v1/photos/bulk-delete
  (safe no-op via a non-existent photo id — proves the gate, not deletion).
- Add gallery.search-filters.spec.ts: tag_id and person_id filters on the
  public /api/search route return correct subsets, combined filters narrow
  results, and the /search UI tag-filter interaction updates the URL/count.
- Update ROADMAP/README/.env.example for the new env vars and coverage.

Merge pull request 'test: FastAPI e2e role-permission gates + gallery search filters' (#66) from test/fastapi-e2e-role-search into dev e60abd9263

docs: playkit gaps + next e2e ideas (#67) 72e89aef9f

test: playkit v0.3.1 adoption, Zod widening, PROD smoke, NextAuth write gates (#68) 96351288f0

test: timing budgets + CI hardening (artifact v3 pin, npm cache retry) ... c0c997f796

Closes three items from the outstanding e2e/CI gap list:

- Timing budgets: timings.measure() only ever recorded durations for the
  (still-unwired) Pushgateway export — nothing failed CI when a step got
  slow. Add e2e/timing-budgets.ts (expectWithinBudget + shared BUDGET_MS
  buckets) and wire it into every measure() call site across the suite.
  Mail-wait steps are deliberately left unbudgeted (external mail-trap
  delivery latency, not a code performance signal).

- actions/upload-artifact@v4 doesn't work against this Gitea/act runner's
  artifact backend — pin to v3 for the e2e failure-report upload.

- Shared act_runner npm cache has corrupted platform-native tarballs before
  (@next/swc-linux-x64-musl) and reds viewer-unit/admin-unit/e2e with no
  product bug involved. All three npm ci steps now retry once after
  `npm cache clean --force` on first failure.

Verified: full local suite green against DEV (37 passed, 6 skipped, no
budget assertion failures) before wiring into CI.

Merge pull request 'test: timing budgets + CI hardening (artifact v3 pin, npm cache retry)' (#69) from test/timing-budgets-ci-hardening into dev da4fc72807

security: remove plaintext dev/Postgres passwords from .cursorrules ... 586243cd56

These were committed in cleartext and pushed to remote history. Rotate the
dev server SSH password and Postgres 'ladmin' password separately; this
only stops the leak going forward and points at Infisical/vault instead.

Merge pull request 'security: remove plaintext credentials from .cursorrules' (#70) from security/scrub-cursorrules-creds into dev 23f0616646

Update roadmap 5f8f2e0bee

docs: scrub homelab IPs and default credentials, reduce emoji noise 86d2b476b0

chore: untrack internal notes and Vite cache, ignore logs 6be4877666

chore: deduplicate env templates into .env.example d6b546c95e

ilia closed this pull request 2026-07-26 14:43:10 -05:00

ilia reopened this pull request 2026-07-26 14:43:13 -05:00

ilia merged commit 688c6f7d8e into master 2026-07-26 14:52:55 -05:00

ilia referenced this issue from a commit 2026-07-26 14:52:57 -05:00

Merge pull request 'Sync master: scrub public docs, untrack internal notes/caches, roadmap update' (#71) from dev into master

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

ira (Ira) noam tanyar09 ilia (Ilia)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: ilia/punimtag#71