Commit Graph
679 Commits
Author SHA1 Message Date
curo1305 e56d17efcb feat(10-02): implement EmptyState.vue — shared empty-state component (GREEN)
- Options API component with props: icon, headline, subtext, size
- Computed containerClass/iconClass/headlineClass/subtextClass for md and sm variants
- Named #cta slot with no fallback content
- Imports AppIcon from ./AppIcon.vue (child component)
- Also creates AppIcon.vue (deviation Rule 3: required to resolve EmptyState import)
- All 7 EmptyState tests pass; all 144 tests pass
2026-06-15 20:12:09 +02:00
curo1305 848b5fcf36 docs(10-01): complete AppIcon plan — 32 icons, 6/6 tests green
- AppIcon.vue: 31 single-path + 1 dual-path (cog) registry
- 6 unit tests cover name→path, class forwarding, dual-path, svg attrs, unknown-name warn, stroke path attrs
- Full frontend suite: 153/153 passed
2026-06-15 20:11:58 +02:00
curo1305 75970352fc test(10-05): Wave 0 skeleton + dropdown stubs (UX-02, UX-03, UX-04, UX-13, UX-14)
- StorageBrowser.skeleton.test.js: 7 it.todo stubs for UX-02 skeleton rows + UX-13 Teleport dropdown
- AppSidebar.empty.test.js: 10 it.todo stubs for UX-03 skeleton, UX-01 micro empty states, UX-14 inline-New removal
- AdminAuditView.skeleton.test.js: 5 it.todo stubs for UX-04 audit skeleton + UX-01 empty state
- AdminUsersView.skeleton.test.js: 3 it.todo stubs for UX-04 users skeleton
- dropdown.test.js: 4 it.todo stubs for UX-13 Teleport+getBoundingClientRect pattern
2026-06-15 20:11:40 +02:00
curo1305 b6ea858c9b test(10-03): add failing BreadcrumbBar tests (RED)
- 10 Vitest unit tests covering showRoot, rootLabel, navigate emits
- Tests segments shape {id?, label} (not {id, name})
- Covers ellipsis collapse for >4 segments, no-id static segments
- AppIcon stubbed via global.stubs for isolated rendering
2026-06-15 20:11:37 +02:00
curo1305 f92d98d067 feat(10-04): implement toast store, ToastContainer, mount in App.vue
- toast.js: reactive toasts array, show/dismiss with auto-dismiss via setTimeout
- ToastContainer.vue: Options API, Teleport to body, TransitionGroup, data-test attr
- type-to-class maps: accentClass/iconName/iconColorClass for success/error/warning/info
- App.vue: import and mount <ToastContainer /> after layout div
- all 10 tests pass; SettingsAccountTab and TotpEnrollment regressions green
2026-06-15 20:11:12 +02:00
curo1305 74fc41cefa feat(10-01): implement AppIcon.vue with full ICON_PATHS registry
- Options API component with inheritAttrs: false for class forwarding
- 32 named icons: 31 single-path + 1 dual-path (cog as Array)
- resolvedPaths computed warns in DEV for unknown icon names
- v-if guard renders nothing for unknown names
- Array.isArray check renders v-for paths for dual-path icons
- All 6 AppIcon tests pass (GREEN)
2026-06-15 20:10:41 +02:00
curo1305 96f4b5f80e test(10-02): add failing EmptyState tests (RED)
- 7 it() blocks covering prop rendering, slot rendering, and size variants
- Tests stub AppIcon via global.stubs to avoid ordering dependency
- All 7 tests fail with module-not-found (EmptyState.vue not yet created)
2026-06-15 20:10:15 +02:00
curo1305 b12137c4ce test(10-04): add failing tests for toast store and ToastContainer
- 6 toast store tests: show/dismiss/auto-dismiss/duration=0/stacking
- 4 ToastContainer tests: empty/render count/click dismiss/accent class
- uses vi.useFakeTimers() for timer-based assertions
- Teleport and AppIcon stubbed for DOM-safe mounting
2026-06-15 20:10:00 +02:00
curo1305 4a45dd4801 test(10-01): add failing AppIcon tests for icon registry contract
- 6 tests covering name→path rendering, class forwarding, dual-path (cog), svg attrs, unknown-name warn, and path stroke attrs
- RED phase: AppIcon.vue does not exist yet; tests fail on import
2026-06-15 20:09:21 +02:00
curo1305andClaude Sonnet 4.6 d3d3f711eb docs(10): create phase plan — 12 plans, 6 waves, UX-01..14 + CODE-05
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-15 06:55:11 +02:00
curo1305 c84dcb77c1 docs(phase-10): research UX & interaction 2026-06-14 22:04:12 +02:00
curo1305 71118076a4 docs(state): record phase 10 context session 2026-06-14 21:53:38 +02:00
curo1305 4c8c394bc3 docs(10): capture phase context 2026-06-14 21:53:34 +02:00
curo1305andClaude Sonnet 4.6 e6f5f2be3b test(phase-09): complete UAT — 9/9 tests passed; mark phase complete
All 9 UAT items verified via live API + source inspection:
- GET /api/admin/overview live data (78 users, 8MB storage, 10 audit rows)
- Auth guard: 401 unauthenticated, 403 non-admin on all protected endpoints
- Admin login redirect (D-08) confirmed in LoginView.vue line 212
- Sidebar: 5 nav links, indigo Admin badge, no back-to-app link
- 4-stat-card overview + When/Event/Actor/Target/IP audit table
- 5 standalone admin views (Users, Quotas, AI, Audit) with no Pinia stores
- API key write-only invariant confirmed in AdminAiView.vue
- Color-coded audit badges (auth=blue, admin=amber, folder/share=purple)
- to.matched.some() guard covers all /admin/* child routes
- No sensitive fields (password_hash, credentials_enc) in any response

Phase 9 marked complete. STATE.md and PROJECT.md updated for Phase 10.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-13 11:32:19 +02:00
curo1305andClaude Sonnet 4.6 3363e23436 docs(phase-09): mark VALIDATION.md complete — all 5 gaps resolved
Audit confirmed all Wave 0 gaps were filled during execution:
- test_admin_overview.py: 8/8 passing (ADMIN-11 aggregate + no sensitive fields)
- router.guard.test.js: 11/11 passing (ADMIN-12 non-admin redirect + admin-to-admin guard)
- AdminView.vue absent from repo (ADMIN-08 dead-code check)
- Tailwind safelist covers all provider color classes (CODE-06)

nyquist_compliant: true

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-13 10:45:34 +02:00
curo1305andClaude Sonnet 4.6 c4adf9a990 docs(phase-09): add security threat verification — 15/15 threats closed
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 22:28:15 +02:00
curo1305andClaude Sonnet 4.6 6f9f045a9a docs(phase-09): add VERIFICATION.md + REVIEW.md — phase 9 complete
5/5 automated must-haves verified. 4 human runtime checks pending.
Code review: 4 blockers (CR-01 testAiConnection POST/GET mismatch,
CR-02 open redirect, CR-03 unvalidated role field, CR-04 password
shuffle bias), 6 warnings, 3 info.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 22:22:47 +02:00
curo1305andClaude Sonnet 4.6 baa462870d docs(phase-09): update tracking after wave 4 — plan 09-05 complete
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 22:09:22 +02:00
curo1305andClaude Sonnet 4.6 777c003ce9 docs(09-05): complete CODE-09 comment purge plan — SUMMARY.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 22:09:22 +02:00
curo1305andClaude Sonnet 4.6 7ef65de046 refactor(09-05): CODE-09 purge — Phase 9 files (WHAT comments removed)
Frontend: AdminLayout, AdminSidebar, AdminOverviewView, AdminUsersView,
AdminQuotasView, AdminAiView, AdminAuditView, router/index.js, LoginView,
tailwind.config.js, api/admin.js — WHAT labels stripped; WHY constraints
preserved (D-16 anchors, security notes, api_key write-only invariant,
router guard rationale, D-08/D-09/D-10 decision refs, fetchWithRetry reason).
Backend: overview.py was already clean (no WHAT comments present).
Frontend: 137 tests pass, build succeeds.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 21:52:30 +02:00
curo1305 3b639b7a72 chore: merge partial 09-05 — Phase 8 backend comment purge 2026-06-12 20:11:27 +02:00
curo1305 6d1c02f703 refactor(09-05): CODE-09 purge — Phase 8 backend sub-packages (WHAT comments removed)
- api/admin/users.py: removed module docstring + 7 WHAT function docstrings
- api/admin/quotas.py: removed module docstring + 2 WHAT function docstrings
- api/admin/ai.py: removed module docstring + 3 WHAT inline comments; security invariant docstrings preserved
- api/admin/shared.py: unchanged (all comments are WHY — constraint notes)
- api/documents/upload.py: removed 4 WHAT inline comments; T-03-05/T-03-06 WHY notes preserved
- api/documents/content.py: removed WHAT function docstring + WHAT inline comment
- api/documents/crud.py: removed 7 WHAT inline comments; D-16 + security constraint docstrings preserved
- api/auth/shared.py: removed module docstring + 1 WHAT inline comment
- api/auth/tokens.py: removed module docstring + 8 WHAT function docstrings/comments; family-revocation + SEC-02 WHY notes preserved
- api/auth/totp.py: removed module docstring + 2 WHAT function docstrings + 2 WHAT inline comments
- api/auth/password.py: removed module docstring + 2 WHAT function docstrings + 3 WHAT inline comments
- All NO-prefix anchor comments and security-invariant WHY comments preserved
- pytest: 413 passed, 1 failed (pre-existing ModuleNotFoundError unrelated to purge)
2026-06-12 16:59:46 +02:00
curo1305andClaude Sonnet 4.6 9ddd599897 docs(phase-09): update tracking after wave 3 — plan 09-04 complete
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 16:14:43 +02:00
curo1305 a21b206b3f chore: merge executor worktree (worktree-agent-a38a2f14f84388704) 2026-06-12 16:14:00 +02:00
curo1305 b9e5facd55 docs(09-04): complete plan 04 — router rewire, login redirect, cleanup, safelist
Tasks:
- Task 1: Nested /admin route + to.matched.some() guard + Tailwind safelist (sky+amber)
- Task 2: Admin login redirect D-08 in LoginView.vue
- Task 3: Delete 5 legacy files; migrate 3 tests; fix stale references
All 137 tests pass, npm run build green (5 admin lazy chunks)
2026-06-12 16:12:50 +02:00
curo1305 e6467d18cf feat(09-04): delete AdminView + 4 tab files; update tests + router guard test
- git rm AdminView.vue, AdminUsersTab.vue, AdminQuotasTab.vue, AdminAiConfigTab.vue, AuditLogTab.vue
- Migrate tab tests to import from views/admin/Admin*View.vue
- Update router.guard.test.js: replace AdminView mock with AdminLayout + 5 admin view mocks
- Add D-09 redirect test (admin on / → /admin)
- Fix stale api/admin.js JSDoc consumer list
- Fix SettingsView.vue stale AdminView comment reference
2026-06-12 16:11:00 +02:00
curo1305 bdd68b2edf feat(09-04): wire admin login redirect in LoginView.vue (D-08)
- After successful login, admin users redirect to /admin; regular users to /
- Honors ?redirect= query param for non-admin users as before
- authStore.user.role is synchronously populated before handleLoginResult fires
2026-06-12 16:08:25 +02:00
curo1305 5dbfb6c1d8 feat(09-04): rewire /admin nested route + guard + Tailwind safelist
- Replace flat /admin route with nested AdminLayout subtree (5 children)
- Fix beforeEach guard to use to.matched.some(r => r.meta.requiresAdmin)
- Add D-09 admin-on-user-route redirect and D-10a non-admin-on-admin redirect
- Add Tailwind safelist covering sky+amber color families (formatters + AuditLogTab)
2026-06-12 16:07:56 +02:00
curo1305andClaude Sonnet 4.6 b19ab8bcd1 docs(phase-09): update tracking after wave 2 — plan 09-03 complete
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 16:03:58 +02:00
curo1305 71329798d5 chore: merge executor worktree (worktree-agent-ae0df1181a91ce55b) 2026-06-12 16:03:19 +02:00
curo1305 ec4bd691d1 docs(09-03): complete tab-to-view extraction plan — 4 views created
- AdminUsersView, AdminQuotasView, AdminAiView, AdminAuditView all extracted
- One import path rewrite (SearchableModelSelect depth correction)
- Build clean: 143 modules, 0 errors
2026-06-12 16:02:43 +02:00
curo1305 164003b19b feat(09-03): extract AdminAiView + AdminAuditView from tab components
- Created frontend/src/views/admin/AdminAiView.vue (extracted from AdminAiConfigTab.vue)
  - Import path for SearchableModelSelect rewritten to ../../components/ui/SearchableModelSelect.vue
  - System AI Providers (Global) section preserved above per-user table (Phase 7 constraint)
- Created frontend/src/views/admin/AdminAuditView.vue (verbatim from AuditLogTab.vue per D-13)
  - actionTypeClass() helper preserved verbatim with all bg-amber-50, bg-purple-50 dynamic classes
  - Filter bar, paginated table, CSV download, daily-export list all preserved as-is
- Both files have no defineProps, no top-level padding, identical line counts to sources
- Build succeeds: 143 modules transformed, no errors
2026-06-12 16:01:29 +02:00
curo1305 d690a445b9 feat(09-03): extract AdminUsersView + AdminQuotasView from tab components
- Created frontend/src/views/admin/AdminUsersView.vue (verbatim extraction of AdminUsersTab.vue)
- Created frontend/src/views/admin/AdminQuotasView.vue (verbatim extraction of AdminQuotasTab.vue)
- Both files have no defineProps, no top-level padding, identical import paths (../../api/client.js, ../../utils/formatters.js)
- Line counts match source exactly (480 and 182 lines respectively)
- Build succeeds with no Vite errors referencing new view files
2026-06-12 15:58:51 +02:00
curo1305andClaude Sonnet 4.6 1b1cc5d566 docs(phase-09): update tracking after wave 1 — plans 09-01 + 09-02 complete
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 15:54:05 +02:00
curo1305 42cf3bfa06 chore: merge executor worktree (worktree-agent-a0c8d4832f87a5517) 2026-06-12 15:52:52 +02:00
curo1305 151f474854 docs(09-01): complete ADMIN-11 plan — admin overview endpoint summary
- SUMMARY.md documents 2 tasks completed, 8 tests passing, security invariants verified
- Self-check: all files present, commits verified
2026-06-12 15:51:45 +02:00
curo1305 41d81c089f feat(09-01): implement GET /api/admin/overview endpoint — ADMIN-11
- New backend/api/admin/overview.py: aggregate stats (user_count,
  total_storage_bytes, doc_status) + last 10 audit entries in one payload
- Sub-router carries NO prefix (parent __init__.py carries /api/admin)
- Reuses _build_filtered_query_with_handles + _audit_to_dict_with_handles
  from api.audit — no new serializer or query logic
- Registered overview_router on admin parent router in __init__.py
- All 8 ADMIN-11 tests pass; existing admin and audit suites stay green
2026-06-12 15:50:38 +02:00
curo1305 4e37cb0fab docs(09-02): complete admin route shell plan — layout, sidebar, overview view
- AdminLayout.vue: flex sidebar shell with router-view in padded content area
- AdminSidebar.vue: 5 nav links (D-07 order), indigo Admin badge (D-05), no Back-to-app (D-06)
- AdminOverviewView.vue: single-fetch 4-card stats + recent audit table
- getAdminOverview() API function added to api/admin.js
2026-06-12 15:49:07 +02:00
curo1305 1e14e15cbf feat(09-02): create AdminOverviewView.vue
- Single-fetch view calling getAdminOverview() on mount with loading/error states
- Four stat cards grid (Users, Storage, Processing, Ready) per ADMIN-11 and D-01
- Recent audit table with 5 columns (When/Event/Actor/Target/IP) matching AuditLogTab.vue structure
- Uses formatSize/formatDate from shared utils/formatters.js (no duplication)
- No top-level padding (AdminLayout owns p-8 max-w-5xl mx-auto)
- No Pinia store — single-fetch component consistent with admin tab pattern
2026-06-12 15:48:19 +02:00
curo1305 4eb489feb8 feat(09-02): create AdminLayout.vue and AdminSidebar.vue
- AdminLayout: flex h-screen shell with AdminSidebar + main content area (p-8 max-w-5xl mx-auto router-view)
- AdminSidebar: 5 nav links in D-07 order (Overview/Users/Quotas/AI Config/Audit Log) with SVG icons
- Admin badge subtitle ("Admin" in indigo-500 per D-05) replaces "Document Manager"
- No Back-to-app link (D-06 applied)
- User identity footer + sign-out reused verbatim from AppSidebar.vue pattern
- Scoped nav-link/nav-link-active CSS identical to AppSidebar.vue
2026-06-12 15:47:35 +02:00
curo1305 4caeed2d22 test(09-01): add failing xfail tests for ADMIN-11 overview endpoint
- 8 xfail tests covering auth guards, aggregate stats, and sensitive field scan
- Tests will become real assertions once overview.py is implemented in Task 2
2026-06-12 15:47:18 +02:00
curo1305 fd12ee2a22 feat(09-02): add getAdminOverview() to api/admin.js
- Export async function calling request('/api/admin/overview')
- Follows existing GET helper pattern (no extra wrapping)
- Auto-re-exported via client.js barrel (Phase 8 CODE-04 invariant preserved)
2026-06-12 15:46:00 +02:00
curo1305andClaude Sonnet 4.6 2fd7591eac docs(09): fix plan checker warnings — ORDER BY desc, closed tag, resolved marker
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 15:40:31 +02:00
curo1305andClaude Sonnet 4.6 ba30ada87a docs(09): create phase 9 plan — Admin Panel Rearchitecture
5 plans across 4 waves covering ADMIN-08..12, CODE-06, CODE-09:

- 09-01 (W1): backend GET /api/admin/overview + 8 ADMIN-11 tests
- 09-02 (W1): AdminLayout + AdminSidebar + AdminOverviewView + getAdminOverview API
- 09-03 (W2): extract 4 admin tab components to standalone views
- 09-04 (W3): nested /admin route + to.matched.some guard + D-08/D-09/D-10 redirects + Tailwind safelist (sky+amber) + login redirect + delete AdminView/tabs
- 09-05 (W4): CODE-09 comment purge for Phase 9 + retroactive Phase 8 backend sub-packages + human UAT checkpoint

All locked decisions D-01..D-16 mapped to tasks; safelist corrected to include sky (OneDrive) and amber (audit badges) per RESEARCH.md Pattern 7.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 15:34:31 +02:00
curo1305andClaude Sonnet 4.6 373e009ed8 docs(09): research phase — admin panel rearchitecture
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 13:35:34 +02:00
curo1305 e5bed6e219 docs(state): record phase 9 context session 2026-06-12 13:23:29 +02:00
curo1305 6721e60166 docs(09): capture phase context 2026-06-12 13:23:25 +02:00
curo1305andClaude Sonnet 4.6 a42f0ed623 test(08): UAT complete — 7/7 passed, phase 8 marked complete
All 7 UAT tests passed (cold start, auth, documents, admin, cloud storage,
session revocation, Vite 6 build). Security gate: 0 threats open. Phase 8
transition complete — ROADMAP.md updated, PROJECT.md evolved with Phase 8
decisions, stale handoff deleted. Next: Phase 9 (Admin Panel Rearchitecture).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 11:28:56 +02:00
curo1305andClaude Sonnet 4.6 ee3d2d2d3d docs(phase-08): mark VALIDATION.md complete — Nyquist-compliant 9/9
Audit confirmed all phase-8 requirements are COVERED:
- CR-01/02/03: session revocation tests promoted from stubs → 3 passing
- CODE-01/02/03: route regression — 58 passed, 4 xfailed
- CODE-04: frontend smoke — 136/136 passed
- CODE-08: single CloudConnectionOut definition confirmed
- PERF-01: npm packages verified

Full suite: 405 passed, 6 skipped, 7 xfailed (1 pre-existing env gap: no local python-docx)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 11:24:49 +02:00
curo1305andClaude Sonnet 4.6 cd4f372e46 docs(phase-08): add security threat verification — all 45 threats closed
Register sourced from 8 PLAN.md threat_model blocks (register_authored_at_plan_time: true).
36 mitigate threats verified CLOSED by gsd-security-auditor. 9 accepted risks documented.
threats_open: 0 — phase advancement unblocked.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 11:18:16 +02:00