50 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
bermudalamb	cd07f9a1c5	Merge pull request 'test: disambiguate the Email locator in auth.spec' (#22) from fix/auth-spec-email-locator into main ... Reviewed-on: #22	2026-08-15 18:37:38 -05:00
bermudalambandClaude Opus 5	a240d86762	test: disambiguate the Email locator in auth.spec ... getByLabel('Email') matched two elements on /register -- the email input and the marketing consent checkbox, whose label "Send me occasional emails" contains the substring. Playwright's strict mode failed both tests that filled it. getByRole('textbox', ...) narrows by role, so the checkbox no longer collides. Applied to the /login usage too, so the same concept reads the same way throughout the file. These failures were latent: the frontend-e2e job died at the build step before it ever reached the tests, so CI never reported them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-15 18:35:43 -05:00
bermudalamb	02c2c74013	Merge pull request 'fix: add the missing /verify-email page' (#20) from fix/verify-email-page into main ... Reviewed-on: #20	2026-08-15 18:23:11 -05:00
bermudalambandClaude Opus 5	b7c8c37447	fix: add the missing /verify-email page ... Verification emails linked to /verify-email?token=..., but no such route existed in main.tsx and nothing in the frontend ever called POST /api/customers/verify-email. The SPA catch-all served index.html, no route matched, and the page rendered blank -- so the token was never redeemed and accounts stayed unverified forever. The gap was invisible until SMTP was configured, because no verification email had ever actually been delivered. Adds VerifyEmail.tsx (verifying / verified / failed states), a verifyEmail call in customerApi, and the route. The request is pinned to a single firing via a ref: the endpoint deletes the token on success, so StrictMode's double effect invocation in dev would otherwise overwrite the success state with "invalid or expired token". Verified end to end against a local stack: a real token flips customers.email_verified to true and is consumed from customer_tokens. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-15 18:16:32 -05:00
bermudalamb	e7fb7271f0	Merge pull request 'fix: unset NODE_ENV in e2e job so devDependencies install' (#19) from fix/e2e-devdeps-and-summarize into main ... Reviewed-on: #19	2026-08-15 08:56:25 -05:00
bermudalambandClaude Opus 5	ec63b9cdb0	fix: unset NODE_ENV in e2e job so devDependencies install ... npm treats NODE_ENV=production as --omit=dev, so `npm install` in the frontend-e2e job skipped typescript and the build died on `tsc: not found`. The same env var would have stripped vite and @playwright/test from the frontend install, and flipped the session cookie to Secure on a run served over plain http. The reported summarize crash was a symptom: the job aborted before Playwright ran, but Summarize is `if: always()` and threw ENOENT on the missing JSON, burying the real failure. Both summarize scripts now report the missing file and exit 0 -- the job still fails via its own step. Also split build from start, replaced `sleep 3` with a readiness poll against /api/config, and dump the backend log when e2e fails. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-15 08:56:25 -05:00
bermudalamb	96edce5159	Merge pull request 'refactor: delete superseded checkout routes and dedupe cart checkout' (#17) from refactor/remove-dead-checkout-routes into main ... Reviewed-on: #17	2026-08-14 17:59:42 -05:00
bermudalambandClaude Opus 5	977489cbc0	refactor: delete superseded checkout routes and dedupe cart checkout ... routes/paypal.ts and routes/demo.ts were the pre-cart single-item checkout flow. Nothing has imported them since the cart flow landed: app.ts mounts only cartCheckout, the frontend calls /api/checkout/cart/*, and no test touches them. They duplicated PAYPAL_BASE, getAccessToken, and a second handler for the /webhooks/paypal mount. Also extract openCheckout() from /paypal/create and /demo/purchase in cartCheckout.ts, which repeated the same address-ownership check, cart lock, and checkouts/checkout_items inserts. It returns a discriminated union so callers keep control of the transaction and the response. Add CartItem/LockedCart interfaces, dropping the (it: any) casts. Note: paypal.ts was the only writer of items.reserved_until and items.paypal_order_id. Those columns are now write-dead; the schema is left alone for a separate migration. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-14 17:59:42 -05:00
bermudalamb	0935bc14f1	Merge pull request 'chore: sync package-lock with declared dependencies' (#18) from chore/sync-package-lock into main ... Reviewed-on: #18	2026-08-14 17:58:14 -05:00
bermudalambandClaude Opus 5	b0a38d0ac6	chore: sync package-lock with declared dependencies ... node-cron, node-pg-migrate, and @types/node-cron are declared in package.json but were missing from the lockfile, so npm ci fails and a plain npm install silently rewrites the lock. Regenerated to match. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-14 17:58:14 -05:00
bermudalamb	ecaef5dc6d	Merge pull request 'fix: resolve SonarQube hotspots for upload size and X-Powered-By' (#16) from fix/sonarqube-hotspots into main ... Reviewed-on: #16	2026-08-14 17:24:06 -05:00
bermudalambandClaude Opus 5	ab1024a1b6	fix: resolve SonarQube hotspots for upload size and X-Powered-By ... - S5693: MAX_IMAGE_BYTES was 8 * 1024 * 1024 (8,388,608), just over the 8,000,000-byte ceiling the rule treats as safe, so the hotspot on the multer storage config never cleared. Use 8_000_000. - S5689: Express advertises its stack in X-Powered-By by default, which tells an attacker what to aim exploits at. Disable the header. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-14 17:18:42 -05:00
bermudalamb	9e4adb0586	Merge pull request 'docs: update project context with deployment lessons and cart architecture' (#15) from docs/update-project-context into main ... Reviewed-on: #15	2026-08-14 17:02:16 -05:00
bermudalamb	05441f78ad	docs: update project context with deployment lessons and cart architecture	2026-08-14 16:58:59 -05:00
bermudalamb	9d5e2daf6e	Merge pull request 'fix: use node-pg-migrate instead of deleted init.sql in e2e workflow' (#14) from fix/e2e-workflow-migrations into main ... Reviewed-on: #14	2026-08-14 16:21:40 -05:00
bermudalamb	483b1391a5	fix: use node-pg-migrate instead of deleted init.sql in e2e workflow	2026-08-14 16:18:20 -05:00
bermudalamb	1355b3076a	Merge pull request 'fix: remove stale single-item demo-checkout tests, add cart integration tests' (#13) from fix/stale-demo-checkout-tests into main ... Reviewed-on: #13	2026-08-14 16:12:29 -05:00
bermudalamb	1c46632e8f	fix: remove stale single-item demo-checkout tests, add cart integration tests	2026-08-14 16:11:20 -05:00
bermudalamb	9de3e6a2fa	Merge pull request 'Fix/cart back navigation' (#12) from fix/cart-back-navigation into main ... Reviewed-on: #12	2026-08-14 15:37:21 -05:00
bermudalamb	1421694a0c	fix: add back-to-shop navigation on cart page	2026-08-14 15:36:30 -05:00
bermudalamb	86f48ed3f8	fix: add back-to-shop navigation on cart page	2026-08-14 15:20:11 -05:00
bermudalamb	cc3798a7f8	Merge pull request 'fix: cart badge not updating after account creation due to stale closure' (#11) from fix/cart-badge-stale-closure into main ... Reviewed-on: #11	2026-08-14 15:15:12 -05:00
bermudalamb	b85cdb9c44	fix: cart badge not updating after account creation due to stale closure	2026-08-14 15:13:55 -05:00
bermudalamb	853a962eb5	Merge pull request 'fix: TypeScript type mismatch between UspsValidationResult and local fallback object' (#10) from fix/usps-type-mismatch into main ... Reviewed-on: #10	2026-08-14 14:49:05 -05:00
bermudalamb	b73b472d80	fix: TypeScript type mismatch between UspsValidationResult and local fallback object	2026-08-14 14:47:52 -05:00
bermudalamb	4f055a2fcd	Merge pull request 'feat: add customer cart with expiry, shipping addresses with USPS validation, and multi-item PayPal checkout' (#9) from feature/cart-shipping-checkout into main ... Reviewed-on: #9	2026-08-14 14:05:09 -05:00
bermudalamb	9ab689e624	feat: add customer cart with expiry, shipping addresses with USPS validation, and multi-item PayPal checkout	2026-08-14 14:02:25 -05:00
bermudalamb	433d7e1db5	Merge pull request 'fix: Dockerfile' (#8) from fix/Dockerfile into main ... Reviewed-on: #8	2026-08-14 10:58:33 -05:00
bermudalamb	845b1f29b9	fix: Dockerfile	2026-08-14 10:58:07 -05:00
bermudalamb	b3835c1e9d	Merge pull request 'chore: replace manual SQL migrations with node-pg-migrate' (#7) from feat/node-pg-migrate into main ... Reviewed-on: #7	2026-08-14 10:05:59 -05:00
bermudalamb	7f4479605a	chore: replace manual SQL migrations with node-pg-migrate	2026-08-14 10:05:09 -05:00
bermudalamb	6ca3366821	Merge pull request 'fix: markdown editor not accepting input due to Form.Item prop injection conflict' (#6) from fix/markdown-editor-not-editable into main ... Reviewed-on: #6	2026-08-14 09:45:22 -05:00
bermudalamb	9325610517	fix: markdown editor not accepting input due to Form.Item prop injection conflict	2026-08-14 09:43:59 -05:00
bermudalamb	83232d6ac2	Merge pull request 'fix: add frontend package-lock.json' (#5) from fix/package-lock into main ... Reviewed-on: #5	2026-08-14 09:27:22 -05:00
bermudalamb	336ad3d5ab	fix: add frontend package-lock.json ... Introduces the `package-lock.json` file to the frontend directory to ensure consistent dependency versions across development environments and deployments. This prevents dependency drift and improves build reliability.	2026-08-14 09:27:22 -05:00
bermudalamb	827f065bb2	Merge pull request 'fix: bound admin image uploads and use a CSPRNG for stored filenames' (#4) from fix/sonarqube-upload-limits-and-weak-rng into main ... Reviewed-on: #4	2026-08-14 09:25:58 -05:00
bermudalambandClaude Opus 5	aba47c81e3	fix: bound admin image uploads and use a CSPRNG for stored filenames ... SonarQube flagged three hotspots in the admin router: multer was configured with no content length limits, and stored filenames were derived from Date.now() plus Math.random(). - Cap the multipart body on every dimension: 6 files, 8 MiB per image, 8 fields, 64 KiB per field. Without limits a single request could fill the uploads volume. - Generate stored filenames with crypto.randomUUID() so paths are not predictable. Image ordering is unaffected; sort_order already drives it. - Wrap the upload middleware to translate MulterError into 413/400 JSON. The app mounts no error handler, so a limit rejection would otherwise surface as an HTML 500. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-14 09:22:45 -05:00
bermudalamb	da240621db	docs: fix local-dev commands for PowerShell, document branching/commit conventions	2026-08-14 08:50:46 -05:00
bermudalamb	01cf325018	Merge pull request 'fix: sonarqube denial of service issue' (#2) from fix/sonarqube-denial-of-service-issue into main ... Reviewed-on: #2	2026-08-14 08:43:37 -05:00
bermudalamb	81118245ce	fix: sonarqube denial of service issue	2026-08-14 08:43:37 -05:00
bermudalamb	7a026b7e82	Merge pull request 'ci: fix Postgres service port conflict in CI' (#3) from fix/fix-workflow-test-scenario-ports into main ... Reviewed-on: #3	2026-08-14 08:42:50 -05:00
bermudalamb	2bff3a231f	ci: fix Postgres service port conflict in CI	2026-08-14 08:41:40 -05:00
bermudalamb	8ffd05f73d	Merge pull request 'fix: move scripts folder to correct location' (#1) from fix/failing-workflows into main ... Reviewed-on: #1	2026-08-14 08:16:26 -05:00
bermudalamb	4b524e0da3	fix: move scripts folder to correct location	2026-08-14 08:15:52 -05:00
bermudalamb	234330e482	Add CI test workflow with job summaries	2026-08-13 19:10:30 -05:00
bermudalamb	f5218782e9	Fix header overflow on mobile viewports	2026-08-13 17:51:15 -05:00
bermudalamb	921022c658	Add backend unit/integration tests, Playwright e2e tests, README, cookie Secure fix	2026-08-13 22:35:38 +00:00
bermudalamb	2adbf24b23	Add SonarQube CI workflow	2026-08-13 21:53:31 +00:00
bermudalamb	8b19d86fdb	Trigger CI	2026-08-13 21:48:11 +00:00
bermudalamb	9be4986dd3	Initial commit: redefined-designs storefront	2026-08-13 21:07:54 +00:00