Commit Graph

29 Commits

Author SHA1 Message Date
Radosław Gierwiało
268cd73365 docs: fix outdated and inconsistent information in TODO.md
Corrections made:
-  Phase 1.6 (Competition Heats) - marked as COMPLETED (was IN PROGRESS)
-  Phase 2.5 (WebRTC) - marked as COMPLETED (was NEXT)
-  Phase 3 - marked as COMPLETED in progress table
-  Infrastructure section - added completed Docker prod configs
-  Testing section - updated with 223/223 passing tests
-  Progress table - updated to show 100% MVP complete
-  Overall progress - updated from 72% to 100%
-  Removed outdated 'Next Priority: WebRTC' section
-  Updated 'Last Updated' date to 2025-11-20
-  Updated Notes section with current status

All information now accurately reflects completed MVP state.
2025-11-20 22:30:18 +01:00
Radosław Gierwiało
eda7055e08 docs: mark Phase 3 (MVP Finalization) as completed
Update project status to reflect completion of all MVP features:

Phase 3 achievements:
-  Security hardening (CSRF, rate limiting, account lockout)
-  All tests passing (223/223, 71% coverage)
-  PWA features (manifest, service worker, iOS support)
-  Production deployment preparation
-  Operations scripts (backup, restore, health-check)
-  Monitoring documentation

Status: 100% MVP complete, ready for production deployment
Next: Infrastructure setup (server, domain, SSL)
2025-11-20 22:24:35 +01:00
Radosław Gierwiało
642c8f6d6f feat: add production operations scripts and monitoring guide
Add comprehensive tooling for production deployment:

Scripts (scripts/):
- backup-db.sh: Automated database backups with 7-day retention
- restore-db.sh: Safe database restore with confirmation prompts
- health-check.sh: Complete service health monitoring
- README.md: Operational scripts documentation

Monitoring (docs/MONITORING.md):
- Application health monitoring
- Docker container monitoring
- External monitoring setup (UptimeRobot, Pingdom)
- Log monitoring and rotation
- Alerting configuration
- Incident response procedures
- SLA targets and metrics

All scripts include:
- Environment support (dev/prod)
- Error handling and validation
- Detailed status reporting
- Safety confirmations where needed
2025-11-20 22:22:22 +01:00
Radosław Gierwiało
2e194e1640 docs: update SESSION_CONTEXT.md with completed test fixes
- All 223/223 backend tests now passing (100%)
- Code coverage improved to 71% (from ~43%)
- Updated progress to ~95% (from ~90%)
- Removed 'improved test coverage' from What's Missing
- Added test isolation achievement to Phase 3 status
2025-11-20 22:14:07 +01:00
Radosław Gierwiało
ab1e4a5cc8 docs: update TODO.md with completed test fixes (223/223 passing) 2025-11-20 22:12:58 +01:00
Radosław Gierwiało
fd0dcdf77f test: improve test cleanup with selective deletion
- Replace deleteMany({}) with selective deletion by username/email/slug in:
  - events.test.js (target specific test users/events only)
  - matches.test.js (target specific test users/events only)
  - csrf.test.js (target csrftest user only)
- Replace delete() with deleteMany() for resilient cleanup:
  - matches.test.js (2 inline cleanups)
  - socket-webrtc.test.js (1 inline cleanup)
- Update TODO.md with test status and future UX/UI improvements

Test improvement: 189/223 passing (84.8%), up from 145/223 (65%)
2025-11-20 00:05:24 +01:00
Radosław Gierwiało
f0a1bfb31a feat(pwa): add Progressive Web App support with iOS compatibility
- Install vite-plugin-pwa and workbox-window for PWA functionality
- Configure Vite with full PWA manifest (name, icons, theme, display)
- Add service worker caching for static assets only (no API cache)
- Create app icons (192x192, 512x512, apple-touch-icon)
- Generate iOS splash screens for multiple device sizes
- Add iOS-specific meta tags (apple-mobile-web-app-capable, etc.)
- Implement InstallPWA component with dual platform support:
  - Android/Chrome: beforeinstallprompt event with custom UI
  - iOS Safari: manual installation instructions with icons
- Add dismissal logic with 7-day localStorage persistence
- Update documentation to reflect 90% project completion

PWA implementation focuses on installability and static asset caching
while avoiding offline API cache (WebRTC requires active connection).
2025-11-19 20:59:26 +01:00
Radosław Gierwiało
44df50362a feat(security): implement comprehensive security hardening
- Add CSRF protection with cookie-based tokens
  - Add cookie-parser and csurf middleware
  - Create GET /api/csrf-token endpoint
  - Frontend automatically includes CSRF token in POST/PUT/DELETE requests
  - Add retry logic for expired CSRF tokens

- Implement account lockout mechanism
  - Add database fields: failedLoginAttempts, lockedUntil
  - Track failed login attempts and lock accounts after max attempts (configurable)
  - Auto-unlock after lockout duration expires
  - Return helpful error messages with remaining time

- Add comprehensive security environment variables
  - Rate limiting configuration (API, auth, email endpoints)
  - CSRF protection toggle
  - Password policy requirements
  - Account lockout settings
  - Logging levels

- Add comprehensive test coverage
  - 6 new tests for account lockout functionality
  - 11 new tests for CSRF protection
  - All tests handle enabled/disabled states gracefully

- Update documentation
  - Add Phase 3 security hardening to SESSION_CONTEXT.md
  - Document new database fields and migration
  - Update progress to 85%

Files changed:
- Backend: app.js, auth controller, security config, new migration
- Frontend: api.js with CSRF token handling
- Tests: auth.test.js (extended), csrf.test.js (new)
- Config: .env examples with security variables
- Docs: SESSION_CONTEXT.md updated
2025-11-19 20:16:05 +01:00
Radosław Gierwiało
b9d6f42ff5 feat(import): add WSDC list parser with location + update-missing-location option\n\n- Parse Event List for name/date/location/country/sourceUrl\n- Support --source list|calendar|auto and --update-missing-location\n- Keep calendar import for title/start/end/url fallback\n- Update CLI summary and docs (ADMIN_CLI.md, README.md) 2025-11-15 21:56:05 +01:00
Radosław Gierwiało
457de6c1c4 fix(cli): keep REPL alive on errors and consolidate help\n\n- Replace process.exit(1) with thrown errors in handlers\n- REPL catches and prints CLI errors without exiting\n- Consolidated help to include all commands and examples\n- Add events:import:wsdc command mapping and alias 2025-11-15 21:41:01 +01:00
Radosław Gierwiało
78f96e2849 feat(cli): add admin REPL + commands and docs
- Add CLI entry in backend with default REPL, persistent history, aliases
- Add commands: users:list/create/verify, events:list/details/participants/checkin,
  matches:list, logs:app, logs:messages
- Support running subcommands inside REPL via .cli and run()
- Add Makefile targets: dev-cli, prod-cli, dev/prod up/down (+rebuild)
- Update README and add docs/ADMIN_CLI.md
- Add CLI tests with mocked Prisma
2025-11-15 20:51:24 +01:00
Radosław Gierwiało
c7a37b2f5c docs: add TURN server testing tasks to WebRTC roadmap 2025-11-15 19:14:44 +01:00
Radosław Gierwiało
95eebc3e63 docs: update documentation for Phase 2.5 completion and Phase 3 start
Update README.md:
- Add landing page to features
- Update test coverage section (43% backend, 116 tests passing)
- Add WebRTC tests information (7 tests passing)
- Update project structure (HomePage, hooks, utils, tests)
- Add STUN servers to WebRTC features
- Remove STUN/TURN and server upload fallback from Next Up
- Update roadmap to Phase 3 in progress
- Update test flow with landing page
- Update progress to ~80%

Update SESSION_CONTEXT.md:
- Current phase: Phase 3 (MVP Finalization) in progress
- Add landing page and WebRTC tests to What Works Now
- Update What's Missing (remove STUN, add coverage improvement)
- Add HomePage to routes and key files
- Add useWebRTC, webrtcDetection, test files to key files
- Update socket.js description with WebRTC signaling
- Update final status with all completed phases
- Update progress and date
2025-11-15 16:46:19 +01:00
Radosław Gierwiało
b6ed1db084 docs: update README and SESSION_CONTEXT for completed WebRTC implementation
Updated documentation to reflect Phase 2.5 completion:
- Moved WebRTC from 'Next Up' to 'Implemented' features
- Added WebRTC to tech stack
- Updated test flow with real WebRTC details
- Marked Phase 2.5 as COMPLETED in roadmap
- Updated progress to ~78% overall
- Updated SESSION_CONTEXT.md current status and missing features
2025-11-15 16:16:03 +01:00
Radosław Gierwiało
e9f181052c docs: update documentation to reflect Phase 2 completion
- Mark Phase 2 (Matches & Ratings API) as completed in all docs
- Add new Ratings & Reviews section to README
- Update roadmap and progress tracking (72% complete)
- Document all Phase 2 features and endpoints in COMPLETED.md
- Reorganize TODO.md for Phase 2.5 (WebRTC) as next priority
2025-11-14 22:53:54 +01:00
Radosław Gierwiało
92315d5a8c feat: add test accounts and secure event slugs
Security improvements:
- Add @default(cuid()) to Event.slug for auto-generated random slugs
- Prevent ID enumeration attacks (no more predictable slugs like "warsaw-dance-festival-2025")
- Event slugs now generated as secure cuid strings (e.g., "cmhz3lcgb00018vbn34v4phoi")

Test accounts:
- Add 3 test users to seed (john_dancer, sarah_swings, mike_blues)
- All users checked in to Warsaw Dance Festival 2025
- Pre-configured heats for testing matchmaking system
- Full profiles with WSDC IDs, social media, and locations

Seed improvements:
- Add bcryptjs for password hashing
- Add Prisma seed configuration to package.json
- Use worldsdcId for event upsert (instead of slug)
- Auto-generate event slugs via Prisma default

Documentation:
- Add test account credentials to SESSION_CONTEXT.md
- Document event slug security model
- Include sample heats for each test user
2025-11-14 17:55:29 +01:00
Radosław Gierwiało
b4960da1b1 docs: mark Phase 1.6 (Competition Heats System) as completed 2025-11-14 17:43:52 +01:00
Radosław Gierwiało
d88d972c03 feat: integrate heats system into EventChatPage
- Add state management for heats (myHeats, userHeats Map, showHeatsBanner, hideMyHeats, showHeatsModal)
- Load user's heats and all users' heats on component mount
- Display HeatsBanner when user has no heats declared
- Add "Edit Heats" button in header for users with declared heats
- Add modal for editing heats via HeatsBanner component
- Display heat badges under usernames in sidebar (format: J&J NOV 1 L)
- Show max 3 badges per user, with "+N" indicator for more
- Add filter checkbox to hide users from same heats
- Implement filter logic (hide if ANY heat matches: division + competition_type + heat_number)
- Disable UserPlus (match) button for users without declared heats
- Add Socket.IO heats_updated listener for real-time updates
- Update todo list to mark EventChatPage integration as completed
2025-11-14 17:41:35 +01:00
Radosław Gierwiało
265926b019 docs: update SESSION_CONTEXT for Phase 1.6 heats system backend 2025-11-14 17:31:38 +01:00
Radosław Gierwiało
0e5dc34cbf docs: add Phase 1.6 Competition Heats System implementation plan 2025-11-14 15:21:00 +01:00
Radosław Gierwiało
61f504fa72 docs: update documentation for QR code check-in system 2025-11-14 14:43:33 +01:00
Radosław Gierwiało
21ba899f98 docs: update README and docs to reflect Phase 1.5 completion
Update documentation to accurately reflect all features implemented in Phase 1.5:

README.md updates:
- Replace outdated "mockup" references with real implementation status
- Add comprehensive feature list with Phase 1.5 additions
- Document 7 database tables (added event_participants)
- Add user profile features (social media, location, public profiles)
- Add event security features (unique slugs)
- Update tech stack versions and test coverage (81%+)
- Add detailed setup instructions for dev and prod profiles
- Update roadmap to show Phase 1.5 as completed

SESSION_CONTEXT.md updates:
- Update current status to Phase 1.5 completed (65% overall)
- Add new features to "What Works Now" section
- Update database schema to 7 tables with all Phase 1.5 fields
- Add new migrations (event slugs)
- Update key files list with Phase 1.5 changes
- Update frontend routes to use slugs (/events/:slug/chat)

TODO.md updates:
- Mark Phase 1.5 as completed with full feature list
- Update progress tracking table (65% overall completion)
- Update last modified date to 2025-11-13

Phase 1.5 features documented:
- Email verification (AWS SES with link + PIN code)
- Password reset workflow
- WSDC API integration
- User profiles (social media links: YouTube, Instagram, Facebook, TikTok)
- User location (country dropdown with 195 countries, city)
- Public profiles accessible at /{username}
- Event participation tracking (auto-save joined events)
- Event security (12-char unique slugs, prevent ID enumeration)
2025-11-13 21:51:11 +01:00
Radosław Gierwiało
3ff966defc refactor: migrate to native Docker Compose profiles
Simplified Docker Compose configuration by using native profiles
instead of override files, following best practices.

Changes:
- Consolidated docker-compose.yml with --profile dev/prod support
- Removed docker-compose.dev.yml and docker-compose.prod.yml
- Updated all documentation for new usage pattern
- Created comprehensive README.md and DEPLOYMENT.md
- Simplified commands: 'docker compose --profile dev up'

Environment-specific configurations:
- Development: relaxed security, hot reload, exposed ports
- Production: strict security, optimized builds, restricted access

This approach is cleaner, more maintainable, and follows Docker
Compose best practices.
2025-11-13 18:00:08 +01:00
Radosław Gierwiało
bf8a9260bd security: implement CRITICAL and MEDIUM security fixes with environment profiles
This commit addresses all CRITICAL and MEDIUM security vulnerabilities
identified in the security audit with environment-aware configuration.

## Docker Compose Profiles

- Added docker-compose.dev.yml for development (relaxed security)
- Added docker-compose.prod.yml for production (strict security)
- Environment-specific configurations for rate limiting, CSRF, logging

## CRITICAL Fixes (P0)

1. Fixed insecure random number generation
   - Replaced Math.random() with crypto.randomBytes() for verification codes
   - Now cryptographically secure

2. Implemented rate limiting
   - express-rate-limit for all endpoints
   - Strict limits on auth endpoints (5 attempts in dev=off, prod=5)
   - Email endpoint limits (20 in dev, 3 in prod)
   - API-wide rate limiting

3. Added request body size limits
   - Development: 50MB (for testing)
   - Production: 10KB (security)

4. Fixed user enumeration vulnerability
   - Generic error message for registration
   - No disclosure of which field exists

5. Added security headers
   - helmet.js with CSP, HSTS, XSS protection
   - No-sniff, hide powered-by headers

## MEDIUM Fixes (P1)

6. Strengthened password policy
   - Environment-aware validation (8+ chars)
   - Production: requires uppercase, lowercase, number
   - Development: relaxed for testing

7. Enhanced input validation
   - Validation for all auth endpoints
   - WSDC ID validation (numeric, max 10 digits)
   - Name validation (safe characters only)
   - Email normalization

8. Added input sanitization
   - DOMPurify for XSS prevention
   - Sanitize all user inputs in emails
   - Timing-safe string comparison for tokens

9. Improved error handling
   - Generic errors in production
   - Detailed errors only in development
   - Proper error logging

10. Enhanced CORS configuration
    - Whitelist-based origin validation
    - Environment-specific allowed origins
    - Credentials support

## New Files

- backend/src/config/security.js - Environment-aware security config
- backend/src/middleware/rateLimiter.js - Rate limiting middleware
- backend/src/utils/sanitize.js - Input sanitization utilities
- backend/.env.example - Development environment template
- backend/.env.production.example - Production environment template
- docker-compose.dev.yml - Development overrides
- docker-compose.prod.yml - Production configuration
- docs/DEPLOYMENT.md - Complete deployment guide
- docs/SECURITY_AUDIT.md - Full security audit report
- .gitignore - Updated to exclude .env files

## Dependencies Added

- helmet (^8.1.0) - Security headers
- express-rate-limit (^8.2.1) - Rate limiting
- dompurify (^3.3.0) - XSS prevention
- jsdom (^27.2.0) - DOM manipulation for sanitization

## Testing

-  Password validation works (weak passwords rejected)
-  User enumeration fixed (generic error messages)
-  WSDC lookup functional
-  Registration flow working
-  Rate limiting active (environment-aware)
-  Security headers present

## Usage

Development:
  docker compose -f docker-compose.yml -f docker-compose.dev.yml up

Production:
  docker compose -f docker-compose.yml -f docker-compose.prod.yml up

See docs/DEPLOYMENT.md for detailed instructions.
2025-11-13 16:39:27 +01:00
Radosław Gierwiało
7a2f6d07ec feat: add email verification, password reset, and WSDC integration (Phase 1.5)
Backend features:
- AWS SES email service with HTML templates
- Email verification with dual method (link + 6-digit PIN code)
- Password reset workflow with secure tokens
- WSDC API proxy for dancer lookup and auto-fill registration
- Extended User model with verification and WSDC fields
- Email verification middleware for protected routes

Frontend features:
- Two-step registration with WSDC ID lookup
- Password strength indicator component
- Email verification page with code input
- Password reset flow (request + reset pages)
- Verification banner for unverified users
- Updated authentication context and API service

Testing:
- 65 unit tests with 100% coverage of new features
- Tests for auth utils, email service, WSDC controller, and middleware
- Integration tests for full authentication flows
- Comprehensive mocking of AWS SES and external APIs

Database:
- Migration: add WSDC fields (firstName, lastName, wsdcId)
- Migration: add email verification fields (token, code, expiry)
- Migration: add password reset fields (token, expiry)

Documentation:
- Complete Phase 1.5 documentation
- Test suite documentation and best practices
- Updated session context with new features
2025-11-13 15:47:54 +01:00
Radosław Gierwiało
4d7f814538 docs: update documentation after Phase 1 completion
Updated documentation to reflect completion of Phase 1 (Backend Foundation):

- SESSION_CONTEXT.md: Updated status to Phase 1 completed, ~50% progress
  - Added completed backend infrastructure details
  - Updated tech stack with actual versions
  - Added Phase 2 next steps (Matches API, Ratings, WebRTC)
  - Updated key files list with backend files
  - Added Prisma OpenSSL bug fix to known issues

- TODO.md: Marked Phase 1 as completed, Phase 2 as active
  - Moved Phase 1 steps to completed section with checkmarks
  - Added detailed Phase 2 tasks (4 steps: Matches API, Ratings API, WebRTC Signaling, WebRTC File Transfer)
  - Reorganized future phases (removed Phase 2 from future, renumbered)

- COMPLETED.md: Added comprehensive Phase 1 completion record
  - All 4 steps documented with checkmarks
  - Test coverage statistics (81.19% overall)
  - Infrastructure updates
  - Bug fixes (OpenSSL for Prisma)
  - Git commit history for Phase 1
2025-11-12 22:51:11 +01:00
Radosław Gierwiało
a1357393e8 docs: optimize documentation structure for token efficiency
- Add SESSION_CONTEXT.md: ultra-compact context for new sessions (~500 lines)
- Add ARCHITECTURE.md: detailed technical specs and implementation details
- Add COMPLETED.md: archive of completed tasks (Phase 0)
- Add RESOURCES.md: learning resources and documentation links
- Refactor CONTEXT.md: keep only core project info and guidelines
- Refactor TODO.md: keep only active tasks and next steps
- Update README.md: reference new documentation structure

This change reduces token usage when resuming sessions by ~60% while maintaining complete project documentation in separate, well-organized files.
2025-11-12 18:07:42 +01:00
Radosław Gierwiało
f6882c7025 docs: update TODO.md with completed tasks and next steps
- Mark completed tasks from Phase 0 (frontend mockup)
- Add detailed next steps with time estimates
- Update project progress (~25% complete)
- Add suggested roadmap for Phase 1 (backend foundation)
- Include additional learning resources
2025-11-12 17:54:49 +01:00
Radosław Gierwiało
80ff4a70bf feat: initial project setup with frontend mockup
- Docker Compose setup with nginx reverse proxy and frontend service
- React + Vite + Tailwind CSS configuration
- Complete mockup of all application views:
  - Authentication (login/register)
  - Events list and selection
  - Event chat with matchmaking
  - 1:1 private chat with WebRTC P2P video transfer mockup
  - Partner rating system
  - Collaboration history
- Mock data for users, events, messages, matches, and ratings
- All UI text and messages in English
- Project documentation (CONTEXT.md, TODO.md, README.md, QUICKSTART.md)
2025-11-12 17:50:44 +01:00