Commit Graph

110 Commits

Author SHA1 Message Date
RevIQ
df9b8808d0 Update docs/initial-app.md with Workstream N-Completions status
Mark N17 (reviq completions bash/zsh/fish) as completed.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 17:11:56 +08:00
RevIQ
9158146462 Build api-server and cli as compiled binaries
- Rename api-server package to @reviq/api-server
- Add --compile flag to bun build for both packages
- Output standalone executables instead of bundled JS

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 17:11:20 +08:00
RevIQ
c4b0509023 Implement shell completions for CLI (Workstream N-Completions)
Add `reviq completions bash/zsh` command with dynamic shell completions:

- Create bash-complete.ts entry point using stricli's proposeCompletions API
- Add completions command with bash and zsh support (fish planned)
- Extract app export to separate app.ts for shared imports
- Add @stricli/auto-complete dependency and __reviq_bash_complete bin entry

Also fix lint/type errors in api-server tests and helpers.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 17:11:10 +08:00
RevIQ
a66511a80d Mark Workstream J as complete in docs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 17:04:01 +08:00
RevIQ
786232e1b1 Merge branch 'workstream-k' 2026-01-09 17:03:07 +08:00
RevIQ
3eb44adf05 Fix TypeScript and lint errors
- Add missing reqHeaders/resHeaders to webauthn test context
- Fix Session.id type from number to string in test
- Remove unnecessary Number() conversion in countOwners

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 17:01:22 +08:00
RevIQ
c0966365f3 Refactor admin procedures into separate files
Extract admin procedures from router.ts into dedicated files under
procedures/admin/ with consolidated exports via _routes.ts. Adds shared
helper functions for response transformation and includes race condition
fixes via transaction-scoped existence checks.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 17:00:04 +08:00
RevIQ
2655c57b9e Merge branch 'wt3': WebAuthn enhancements and virtual authenticator
- Enhanced createRegistrationOptions to look up existing users
- Added virtual-authenticator testing package
- Added WebAuthn e2e and unit tests

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 16:55:14 +08:00
RevIQ
f0f1a4f4f7 Merge branch 'workstream-h-v2' 2026-01-09 16:50:52 +08:00
RevIQ
9cf95095c3 Implement Workstream J: Org procedures (backend)
Add complete organization management procedures:
- orgs.list, create, get, update, delete, leave
- orgs.members.list, updateRole, remove
- orgs.invites.list, create, cancel, accept
- orgs.sites.list

Key features:
- Role-based access control (owner > admin > member)
- Transaction-protected owner count checks to prevent race conditions
- Privilege escalation prevention (only owners can invite owners)
- Graceful constraint violation handling with friendly error messages
- Email sending for org invitations

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 16:50:29 +08:00
RevIQ
f55ebccd74 Update docs/initial-app.md with Workstream H completion
- Mark all H1-H10 auth page tasks as complete
- Add missing frontend libraries: ua-parser-js, svelte-sonner

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 16:49:44 +08:00
RevIQ
bd9be3e441 Add comprehensive WebAuthn e2e/unit tests and virtual authenticator package
- Create @reviq/virtual-authenticator package with cryptographically valid
  WebAuthn credential generation for testing
- Add e2e tests for WebAuthn registration, authentication, passkey management
- Add unit tests for passkey-helpers and VirtualAuthenticator
- Add security tests for counter replay and tampered responses
- Configure test database environment in devenv.nix
- Add turbo.json test tasks and workspace configuration

Test results: 98 tests passing (54 virtual-authenticator, 25 e2e, 19 unit)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 16:46:02 +08:00
RevIQ
82078b3a05 Fix floating promise lint errors and apply code formatting
- Add void operator to async calls in $effect() blocks to satisfy
  noFloatingPromises lint rule:
  - passkey/+page.svelte: void authenticate()
  - verify/+page.svelte: void verifyEmail()
- Apply biome formatter import reorganization across auth files

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 16:39:33 +08:00
RevIQ
96807bdc3f Merge branch 'master' into workstream-h-v2
Resolve conflicts in router.ts by adopting master's modular architecture
for me.* procedures while keeping meGet and setupProfile inline.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 16:36:37 +08:00
RevIQ
073db98a91 Implement Workstream H: Auth pages with refactored components
Add 10 authentication pages for the Publisher Dashboard:
- H1: /auth/signup - Account creation with passkey/password
- H2: /auth/setup/user - Profile setup with phone validation
- H3: /auth/login - Email entry with routing logic
- H4: /auth/login/passkey - WebAuthn authentication
- H5: /auth/login/password - Password authentication
- H6: /auth/confirm - Email verification polling
- H7: /auth/trust-device - Device trust prompt
- H8: /auth/verify - Email verification callback
- H9: /auth/forgot-password - Password reset request
- H10: /auth/reset-password - New password form

New reusable components:
- LoadingButton: Button with Loader2 spinner and loading state
- ErrorAlert: Accessible error display with ARIA live region
- PasswordFormField: Composite field with label, input, strength meter
- PasswordInput: Improved with bind:value and cn() class merging

New utilities:
- validation.ts: Email, phone validation, email masking, error parsing
- auth.svelte.ts: Login flow state store for SPA mode guards

Backend updates:
- Implement me.get, me.setupProfile, me.getDeviceInfo, me.trustDevice

Dependencies added:
- @simplewebauthn/browser, libphonenumber-js, ua-parser-js
- zxcvbn, svelte-sonner, shadcn alert component

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 16:32:35 +08:00
RevIQ
2d445cc47b Merge branch 'workstream-f1' 2026-01-09 16:31:58 +08:00
RevIQ
860d791125 Implement Workstream F1: me.get and me.setupProfile procedures
- Add me.get procedure returning user profile with needsSetup flag
- Add me.setupProfile procedure for initial profile setup after signup
- Add nonEmptyString/optionalString schema helpers with tests
- Use Web Crypto API (SubtleCrypto) for Cloudflare Workers compatibility
- Use @formatjs/intl-durationformat for duration formatting
- Remove node:crypto dependency from crypto utilities

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 16:29:41 +08:00
RevIQ
9b898678c7 Refactor me.* procedures with code review fixes
- Fix silent failures: add 404 NOT_FOUND for invalid resources in
  passkeysRename, revokeSession, trustDevice, untrustDevice
- Fix race condition in passkeysDelete using transaction
- Extract helper functions: requireDeviceFingerprint, defaultDeviceName
- Improve type safety in updateProfile with Kysely's Updateable<Users>
- Extract me.* procedures to separate files under procedures/me/
- Standardize naming to verb-first: listPasskeys, renamePasskey, deletePasskey

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 16:24:10 +08:00
RevIQ
1ebcf12cb9 Merge branch 'wt2' 2026-01-09 15:51:35 +08:00
RevIQ
23d8fd7792 Update workstream completion status in initial-app.md
Mark completed tasks across all phases:
- Phase 1 (A, B, C): All foundation tasks complete
- Phase 2 (D, E): All auth and WebAuthn procedures complete
- Phase 2 (F): Passkey management (F4) complete
- Phase 2 (G): Email helpers stubbed (G3-G5)
- Phase 4 (K): All admin procedures complete
- Phase 5 (N1-N16): All CLI commands complete

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 15:48:40 +08:00
RevIQ
93851afe38 Merge branch 'wt4': Add email sending and documentation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 15:45:39 +08:00
RevIQ
617fa78046 Fix Session.id type and restore nested passkey routes
- Change Session.id from number to string to match DB bigint type
- Restore me.passkeys.{list,rename,delete} nested route structure
- Remove unnecessary String() conversion in logout procedure
- Auto-formatted procedure files

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 15:44:45 +08:00
RevIQ
9456a98eac Implement Workstream G: Email Service with Postmark
- Add postmark dependency and email configuration constants
- Implement sendVerificationEmail, sendPasswordResetEmail,
  sendLoginConfirmationEmail, and sendOrgInviteEmail helpers
- Add HTML + text email templates with inline CSS
- Support dev mode (EMAIL_DEV_MODE=true) for console logging
- Use URL constructor for proper URL building
- Add XSS protection with HTML escaping in templates
- Create .env file with email environment variables

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 15:42:33 +08:00
RevIQ
1858ea9783 Merge branch 'wt2': Add typed context and middleware pattern
- Add procedures/base.ts with typed os implementer and middlewares
- Refactor router to use authMiddleware and loginRequestMiddleware
- Flatten passkey routes to me.listPasskeys/createPasskey/renamePasskey/deletePasskey
- Stub admin procedures with NOT_IMPLEMENTED (to be reimplemented with superuser middleware)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 15:40:55 +08:00
RevIQ
3f94a9e067 Merge branch 'wt2': Add auth procedures and password utilities
Integrates extracted auth handlers and Bun-based password hashing:
- Auth procedures moved to individual handler files
- Password hashing using Bun's argon2id (replaces scrypt)
- Password validation with zxcvbn
- Session, cookie, crypto, email, and geo utilities

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 15:36:32 +08:00
RevIQ
a4d1f28f3d Add typed context and middleware for oRPC procedures
Use implement(contract).$context<APIContext>() for proper type safety
in all procedure handlers. Create authMiddleware and loginRequestMiddleware
using os.middleware() and apply with .use() on routes requiring auth.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 15:36:26 +08:00
RevIQ
410b937f9f Implement CLI commands and admin API endpoints
- Add bootstrap command with direct DB access for initial setup
- Implement auth login/logout/status CLI commands
- Implement user create/confirm-email CLI commands
- Implement org create/list/add-site CLI commands
- Add admin.orgs.* and admin.users.* API endpoints
- Add password hashing utility with scrypt
- Add token hashing and authentication utility
- Add superuser runtime checks for admin endpoints
- Wrap multi-step operations in transactions
- Fix config file permissions (0o600) for security
- Remove token display from status command
- Add return statements to void handlers
- Add reviq CLI command to devenv

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 15:30:10 +08:00
RevIQ
8db2adf4c0 Merge branch 'wt2' into wt4 2026-01-09 15:22:12 +08:00
RevIQ
829d365e80 Implement auth procedures with code review fixes
Add complete auth backend (Workstream D):
- Auth middleware for session/API key authentication
- Signup with password or passkey (WebAuthn)
- Login flow with device trust and email confirmation
- Password reset and email verification
- Session management and logout

Utilities created:
- cookies.ts: Cookie helpers and configuration
- crypto.ts: Token generation and hashing
- password.ts: zxcvbn validation, argon2id hashing
- geo.ts: IP/location extraction from headers
- email.ts: Stubbed email sending
- session.ts: Session creation and device trust

Code review improvements applied:
- Use ORPCError instead of Error in procedures
- Add ast-grep rule to enforce ORPCError usage
- Remove error info leakage (generic messages)
- Optimize N+1 query with JOIN in login-password
- Extract signupWithPassword/signupWithPasskey for testability
- Add 15-minute WebAuthn challenge expiry check
- Strengthen CookieOptions type definitions

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 15:19:15 +08:00
RevIQ
30ee35b25c Restructure passkey routes to me.passkeys namespace
- Remove createPasskey since verifyRegistration handles adding passkeys
- Move listPasskeys → me.passkeys.list
- Move renamePasskey → me.passkeys.rename
- Move deletePasskey → me.passkeys.delete

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 12:38:07 +08:00
RevIQ
8de88472b1 claude settings 2026-01-09 12:37:17 +08:00
RevIQ
b46146faa5 Implement WebAuthn passkey authentication
Add complete WebAuthn support for passkey registration and authentication:
- Install @simplewebauthn/server for WebAuthn utilities
- Create passkey-helpers.ts with base64url/Uint8Array conversion utilities
- Create webauthn.ts with registration/authentication option generation and verification
- Create context.ts with API context types
- Implement all WebAuthn router handlers (createRegistrationOptions, verifyRegistration, createAuthenticationOptions, verifyAuthentication)
- Implement passkey management handlers (listPasskeys, createPasskey, renamePasskey, deletePasskey)
- Add WebAuthn configuration constants and environment variables

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 12:34:26 +08:00
RevIQ
a4dff188eb Replace z.any() with z.custom<T>() for WebAuthn types
Use proper TypeScript types from @simplewebauthn/types instead of
z.any() for WebAuthn-related schemas:
- PublicKeyCredentialCreationOptionsJSON
- PublicKeyCredentialRequestOptionsJSON
- RegistrationResponseJSON
- AuthenticationResponseJSON

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 12:17:29 +08:00
RevIQ
b6bce41092 Fix zod imports with ast-grep namespace import rule
Applied ast-grep rule to convert named zod imports to namespace imports
across the api-contract package for consistency.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 12:14:19 +08:00
RevIQ
2e9ea74bc9 Connect frontend to oRPC server
- Add Vite proxy to forward /api/v1/rpc to API server (port 9861)
- Create oRPC client in src/lib/api/client.ts
- Add @orpc/client and @orpc/contract dependencies
- Add @reviq/api-contract workspace dependency
- Extract DEFAULT_PORT constant to api-server/src/constants.ts
- Change API server default port from 3001 to 9861

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 12:09:03 +08:00
RevIQ
bd3997ffe9 Ignore noExplicitAny in publisher-dashboard utils
Add biome override to allow `any` in conditional types used for
Svelte component utility types (WithoutChild, WithoutChildren).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 12:03:53 +08:00
RevIQ
8f3f711af0 Add ESLint to all packages and reorganize CLI
ESLint:
- Add @macalinao/eslint-config and eslint to all packages/apps
- Add lint scripts to all package.json files
- Create eslint.config.js for all apps
- Add lint task to turbo.json
- Add @macalinao/eslint-config and @types/bun to catalog

Biome:
- Exclude docs/ from biome checks

CLI Reorganization:
- Restructure CLI to use route maps with one command per file
- Move commands to routes/ directory structure
- Use func property instead of async loaders
- Route maps in _command.ts files for each directory

Environment:
- Use Bun.env instead of process.env for env vars
- Add DATABASE_URL and PORT to turbo.json globalEnv

Lint Fixes:
- Fix nullish coalescing operator usage
- Update deprecated Zod API (z.email() instead of .string().email())
- Fix import sorting

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 12:01:41 +08:00
RevIQ
b687d9cd1d Add turbo lint to root lint scripts
Run ESLint on all packages in addition to Biome check.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 11:48:18 +08:00
RevIQ
5eeef44850 Fix TypeScript compilation issues in packages
- Add explicit type annotations for isolatedDeclarations
- Export Database type alias from db-schema
- Fix import paths and add proper type exports
- Update common schemas with better exports

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 11:46:11 +08:00
RevIQ
aee22ae454 Update devenv and cleanup packages
- Add api-server process to devenv.nix
- Add dbmate and kysely-codegen scripts
- Configure PostgreSQL with localhost listener
- Update publisher-dashboard package to @apps/publisher-dashboard
- Fix deprecated asChild prop in mobile-nav component
- Remove unused publisher-utils package
- Update bun.lock with new dependencies

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 11:45:13 +08:00
RevIQ
93132d76c0 Add api-server and CLI applications
- Create api-server with Bun.serve:
  - oRPC router with stub handlers for all procedures
  - Auth middleware placeholder
  - CORS configuration
- Create CLI tool with stricli:
  - bootstrap command for initial superuser creation
  - Placeholder commands for auth, user, org management

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 11:45:03 +08:00
RevIQ
cc5fba0fc7 Add oRPC API contract with Zod schemas
- Create @reviq/api-contract package
- Define Zod schemas for all input/output types:
  - Auth schemas (signup, login, password reset, WebAuthn)
  - User/profile schemas
  - Organization schemas (CRUD, members, invites)
  - Admin procedure schemas
- Define oRPC contract with full procedure signatures:
  - auth.* (signup, login, password reset, WebAuthn)
  - me.* (profile, sessions, devices, passkeys)
  - orgs.* (CRUD, members, invites, sites)
  - admin.* (orgs, users, auth management)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 11:44:52 +08:00
RevIQ
392d976812 Add database schema and Kysely packages
- Create initial database migration with full auth schema:
  - users, sessions, passkeys, devices tables
  - orgs, org_members, org_sites, org_invites tables
  - email_verifications, password_resets, login_requests tables
  - Indexes for common lookups and cleanup jobs
- Add @reviq/db-schema package with kysely-codegen
- Add @reviq/db package with Kysely client

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-09 11:44:36 +08:00
RevIQ
322155b4a1 set up ast-grep and dbmate and postgres 2026-01-09 10:51:47 +08:00
RevIQ
82f39e0335 Add TanStack Query and update dashboard card styling
- Set up @tanstack/svelte-query and devtools in root layout
- Configure QueryClient with 5-minute stale time
- Update dashboard card to match Figma: regular font weight, no border
- Add .playwright-mcp to gitignore

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-08 17:27:23 +08:00
RevIQ
e42201fea6 Fix peak traffic chart to match Figma design
Overlay bars instead of positioning side by side, with transparent
hatched "Last month" bars on top of solid "This month" bars. Update
legend icons to circular. Add CLAUDE.md with dev server notes.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-08 09:47:02 +08:00
RevIQ
ad65469db6 Add DashboardCard component and redesign peak traffic chart
- Create reusable DashboardCard component with title and content slot
- Redesign PeakTrafficChart to match Figma design:
  - Vertical bar chart showing peak hours by day of week
  - Y-axis: hours (0:00 to 21:00)
  - X-axis: days (Mon-Sun)
  - Two data series: "This month" (solid) and "Last month" (hatched)
  - Diagonal stripe pattern for last month bars using SVG
  - Legend at bottom

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-08 08:15:57 +08:00
RevIQ
e387d8c123 Quote process names with hyphens in devenv.nix
Nix attribute names with hyphens need to be quoted.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-08 08:05:31 +08:00
RevIQ
bba08a4330 Fix turbo watch command syntax
Use `turbo watch build` instead of `turbo build --watch`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-08 08:04:23 +08:00
RevIQ
e4cbb9d565 Set publisher dashboard dev server to port 6827
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-08 08:03:51 +08:00