50d2348b36
refactor: rename MERGE_CHECKLIST to ALL_TESTS + add per-service test files
...
- tests/MERGE_CHECKLIST.md → tests/ALL_TESTS.md (git rename, updated header + index of sub-files)
- tests/backend_tests.md — §1–9, §18 (auth, users, admin, groups, appearance, service health, plugins, AI/doc settings, infra/security)
- tests/frontend_tests.md — §19 (UI & routing)
- tests/doc-service_tests.md — §10–16 (upload/processing, list/filtering, slide-over, sharing, categories, bulk actions, watch directory)
- tests/ai-service_tests.md — §17 (AI queue & providers)
- CLAUDE.md: updated merge checklist section, file tree, and self-update checkpoint with mandatory test-file update rule
- settings.local.json: added docker inspect/ps, curl, lsof, git merge/branch/log/diff/status/config/mv permissions
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-19 02:19:51 +02:00
09555f3470
Connect ux-designer agent to Figma via curl; mark setup tasks done
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-17 11:49:51 +02:00
2e629d55c5
Switch UX/UI design tool from Penpot to Figma
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-17 11:40:15 +02:00
d423bea134
Isolate backend and db from host: two Docker networks
...
- backend-net (internal: true): db ↔ backend ↔ frontend reverse proxy
- frontend-net: frontend only; single host port binding (80 prod / 5173 dev)
- Remove ports: from db (5432) and backend (8000) — unreachable from host
- Security auditor: hard rule to never add host ports to db or backend
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-14 00:06:38 +02:00
03fcc6e117
Document app container architecture and socket proxy requirement
...
- TODO: add app container architecture section with socket proxy, network
isolation, image allowlist, and Podman evaluation items
- security-auditor: hard rules for never mounting raw Docker socket and
never spawning privileged containers
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-13 23:19:38 +02:00
e2c55556ac
Switch JWT signing from HS256 to RS256 (4096-bit RSA)
...
- Replace symmetric SECRET_KEY with JWT_PRIVATE_KEY / JWT_PUBLIC_KEY (PEM)
- Add iat claim to every token
- Add expand_newlines validator in config for single-line .env PEM values
- Add scripts/generate_jwt_keys.py key-generation helper
- Update security-auditor agent JWT checklist with RS256 enforcement rules
- Mark RS256 as done in TODO.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-13 23:00:35 +02:00
0af5e8cc24
Harden JWT: 8-hour expiry, add JWT vulnerability checks
...
- Reduce ACCESS_TOKEN_EXPIRE_MINUTES from 24h to 8h (no permanent sessions)
- Add JWT_PATTERNS to security_check.py: algorithm=none, verify_exp=False,
multi-day timedelta, oversized EXPIRE_MINUTES, hardcoded secret
- Add JWT security checklist to security-auditor agent
- Document auth/session security items in TODO.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-13 22:54:53 +02:00
b9485ca492
Switch UX/UI tooling to self-hosted Penpot; add setup checklist
...
- ux-designer.md: replace Figma with Penpot REST API approach; add
next-session checklist (LXC setup, project creation, access token,
component library decision, agent connection)
- TODO.md: add Penpot setup section with five actionable items
- changelog: document the tooling decision and rationale
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-13 22:07:44 +02:00
6cfb41b71e
Sync session changes: CLAUDE.md teardown step, settings allowed commands
...
- CLAUDE.md: add step 5 to infrastructure protocol (tear down after testing)
- .claude/settings.local.json: add git push, docker compose, docker run to
allowed commands accumulated during this session
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-13 21:53:48 +02:00
f37c7ae55d
Add four custom subagent definitions
...
- .claude/agents/backend-dev.md: advisory, read-only, FastAPI/SQLAlchemy expert
- .claude/agents/frontend-dev.md: advisory, read-only, React/TS/TanStack expert
- .claude/agents/ux-designer.md: advisory, read-only, UX + Figma MCP setup guide
- .claude/agents/security-auditor.md: active, full write access, fixes
vulnerabilities directly; uses claude-opus-4-6 for deeper reasoning
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-13 21:04:19 +02:00
606b7bd6b3
Initial project scaffold: FastAPI + React/Vite + PostgreSQL SaaS starter
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-12 15:00:44 +02:00
curo1305