Commit Graph

216 Commits

Author SHA1 Message Date
Radosław Gierwiało
4467c570b0 feat(matching): add schedule config for division collision groups
Allow event organizers to configure which divisions run in parallel
(same time slot) for accurate collision detection in the auto-matching
algorithm. Divisions in the same slot will collide with each other.

- Add scheduleConfig JSON field to Event model
- Add PUT /events/:slug/schedule-config API endpoint
- Update matching algorithm to use slot-based collision detection
- Add UI in EventDetailsPage for managing division slots
- Add unit tests for schedule-based collision detection
2025-11-23 19:05:25 +01:00
Radosław Gierwiało
a5a1296a4e feat(frontend): add recording matching UI
Add frontend components for auto-matching recording partners:

- RecordingTab component with suggestions list and opt-out toggle
- Tab navigation in EventChatPage (Chat, Uczestnicy, Nagrywanie)
- Matching configuration in EventDetailsPage (deadline, run matching)
- matchingAPI functions in api.js
- Return registrationDeadline and matchingRunAt in GET /events/:slug/details

UI allows users to:
- View who will record their heats
- View heats they need to record
- Accept/reject suggestions
- Opt-out from being a recorder
- Set registration deadline (admin)
- Manually trigger matching (admin)
2025-11-23 18:50:35 +01:00
Radosław Gierwiało
c18416ad6f feat(matching): add auto-matching system for recording partners
Implement algorithm to match dancers with recorders based on:
- Heat collision avoidance (division + competitionType + heatNumber)
- Buffer time (1 heat after dancing before can record)
- Location preference (same city > same country > anyone)
- Max 3 recordings per person
- Opt-out support (falls to bottom of queue)

New API endpoints:
- PUT /events/:slug/registration-deadline
- PUT /events/:slug/recorder-opt-out
- POST /events/:slug/run-matching
- GET /events/:slug/match-suggestions
- PUT /events/:slug/match-suggestions/:id/status

Database changes:
- Event: registrationDeadline, matchingRunAt
- EventParticipant: recorderOptOut
- RecordingSuggestion: new model for match suggestions
2025-11-23 18:32:14 +01:00
Radosław Gierwiało
edf68f2489 feat(events): add competitor number (bib) support
Allow participants to set their bib/competitor number per event.
Display as badge next to username in participant lists.

- Add competitorNumber field to EventParticipant model
- Add PUT /events/:slug/competitor-number endpoint
- Include competitorNumber in heats/me and heats/all responses
- Add input field in HeatsBanner component
- Display badge in UserListItem component
- Add unit tests for competitor number feature
2025-11-23 17:55:25 +01:00
Radosław Gierwiało
a2279662dc docs: archive DASHBOARD_PLAN.md and update task tracking
- Move completed DASHBOARD_PLAN.md to docs/archive/
- Update COMPLETED.md with dashboard implementation details
- Update TODO.md to reflect dashboard completion
- Mark remaining dashboard features as optional Phase 4
2025-11-21 21:59:51 +01:00
Radosław Gierwiało
8a369c1fc4 fix(socket): improve connection stability with heartbeat and auto-reconnect
- Backend: Add pingInterval (25s) and pingTimeout (60s) for better keep-alive
- Frontend: Increase reconnection attempts to Infinity (keep trying forever)
- Frontend: Add reconnect event handlers to rejoin rooms after reconnection
- Frontend: Check initial connection state when reusing socket instance
2025-11-21 21:53:51 +01:00
Radosław Gierwiało
78280ca8d8 feat(dashboard): add unread count for match chats
Track unread messages in match chats and display count badge:
- Schema: Add user1LastReadAt/user2LastReadAt to Match model
- Backend: Calculate unreadCount in dashboard API
- Socket: Update lastReadAt when user joins match room
- Frontend: Display red badge with unread count on match avatar
2025-11-21 21:46:00 +01:00
Radosław Gierwiało
2c0620db6a feat(dashboard): add online count for events
Show real-time count of users currently in each event chat room.
- Backend: Export getEventsOnlineCounts from socket module
- Dashboard API: Include onlineCount for each active event
- Frontend: Display online count with animated green dot indicator
2025-11-21 21:41:16 +01:00
Radosław Gierwiało
c15031db9f feat(frontend): add skeleton loading state for dashboard
Replace simple spinner with skeleton loading placeholders that match
the dashboard layout structure, providing better visual feedback during
data loading.
2025-11-21 21:37:05 +01:00
Radosław Gierwiało
87b0079b84 feat(frontend): add toast notifications for dashboard actions
- Install react-hot-toast library
- Add Toaster component to App.jsx
- Show success/error toasts for match accept/reject/cancel
- Show toasts for real-time match events
- Update tests with toast mocks
2025-11-21 21:27:03 +01:00
Radosław Gierwiało
4187157b94 feat(frontend): add Rate Partner button and dashboard tests
- Add Rate button to MatchCard (shows when video exchange complete & not rated)
- Add 15 comprehensive tests for DashboardPage component
- Tests cover: loading, empty states, events, matches, requests, navigation
2025-11-21 21:21:58 +01:00
Radosław Gierwiało
f3bd169dbf feat(frontend): implement dashboard page
- Create DashboardPage with active events, matches, and requests
- Add dashboardAPI.getData() to services/api.js
- Add /dashboard route as default landing after login
- Update Navbar with Dashboard and Events links
- Show video exchange and rating status for matches
- Handle match accept/reject/cancel actions
2025-11-21 21:12:25 +01:00
Radosław Gierwiało
901b046a34 feat(backend): implement dashboard API endpoint
- Add GET /api/dashboard endpoint for authenticated users
- Returns active events with user heats
- Returns accepted matches with partner info
- Detects video exchange status from message parsing
- Tracks rating completion status (rated by me/partner)
- Returns incoming/outgoing pending match requests
- Add comprehensive test suite (12 tests, 93% coverage)
- Add DASHBOARD_PLAN.md with full design documentation
2025-11-21 21:00:50 +01:00
Radosław Gierwiało
b945354db3 docs: move completed frontend refactoring to COMPLETED.md
Moved the entire frontend refactoring section (3 phases + bug fixes)
from TODO.md to docs/archive/COMPLETED.md for better organization.

Changes:
- TODO.md: Removed completed refactoring tasks (lines 363-728)
- COMPLETED.md: Added comprehensive refactoring summary with:
  - All 3 phases (Components, Hooks, Advanced Components)
  - Bug fixes (formatHeat, ChatRoom missing)
  - Final metrics (-559 lines, 16 new components, 3 new hooks)
  - Component structure diagram
2025-11-21 17:41:39 +01:00
Radosław Gierwiało
198c216b44 fix(backend): auto-create event ChatRoom on first check-in
Problem:
- User got "Chat room not found" error when trying to send messages
- Event ChatRooms were only created by seed script, not for manually
  created events
- Event "Another Dance Event" (ID: 420) was missing its ChatRoom

Root Cause:
- Seed script (seed.js:179-188) correctly creates ChatRooms for events
- But events created outside of seed (CLI, manual DB insert) didn't
  create ChatRooms
- Socket handler requires ChatRoom to exist before accepting messages

Solution:
1. Added defensive check in check-in handler (POST /api/events/checkin/:token)
2. Automatically creates ChatRoom if missing when first user checks in
3. Logs creation for debugging: "Created missing chat room for event: {slug}"

Impact:
- Existing events without ChatRooms will get them on next check-in
- Future manually-created events will work correctly
- No breaking changes - all 223 tests pass

Changes:
- backend/src/routes/events.js: Added ChatRoom existence check and
  auto-creation logic (lines 256-272)

Note: Manually created ChatRoom for event ID 420 to fix immediate issue
2025-11-21 17:34:17 +01:00
Radosław Gierwiało
ade5190d7b fix(frontend): resolve missing formatHeat function in EventChatPage
Bug: EventChatPage referenced formatHeat() function in header's heat display
(line 365) but the function was removed during Phase 3 refactoring when
creating the HeatBadges component.

Solution:
1. Enhanced HeatBadges component with badgeClassName prop to support
   custom styling (needed for dark header background)
2. Replaced manual heat rendering in EventChatPage header with
   HeatBadges component
3. Passed custom badge styling to match the dark primary-700 header

Changes:
- HeatBadges.jsx: Added badgeClassName prop for style customization
- EventChatPage.jsx: Replaced manual heat map with HeatBadges component

Fixes: "Uncaught ReferenceError: formatHeat is not defined" error
2025-11-21 17:29:12 +01:00
Radosław Gierwiało
082105c5bf refactor(frontend): Phase 3 - create advanced composite components
Extract complex UI sections into reusable composite components

New Components Created:
1. HeatBadges (heats/HeatBadges.jsx)
   - Displays competition heats with compact notation
   - Configurable max visible badges with "+X more" overflow
   - Tooltips with full heat information

2. UserListItem (users/UserListItem.jsx)
   - Reusable user entry with avatar, username, full name
   - Optional heat badges display
   - Flexible action button slot (render props pattern)
   - Online/offline status support

3. ParticipantsSidebar (events/ParticipantsSidebar.jsx)
   - Complete sidebar component for event participants
   - Filter checkbox for hiding users from own heats
   - Participant and online counters
   - Integrated UserListItem with match actions

4. FileTransferProgress (webrtc/FileTransferProgress.jsx)
   - WebRTC P2P file transfer UI
   - Progress bar with percentage
   - Send/Cancel actions

5. LinkShareInput (webrtc/LinkShareInput.jsx)
   - Fallback link sharing when WebRTC unavailable
   - Google Drive, Dropbox link support

Pages Refactored:
- EventChatPage: 564 → 471 lines (-93 lines, -16%)
  * Replaced 90-line participants sidebar with <ParticipantsSidebar />
  * Removed duplicate formatHeat logic (now in HeatBadges)

- MatchChatPage: 446 → 369 lines (-77 lines, -17%)
  * Replaced 56-line file transfer UI with <FileTransferProgress />
  * Replaced 39-line link input form with <LinkShareInput />

Phase 3 Total: -170 lines
Grand Total (Phase 1+2+3): -559 lines (-17%)

Final Results:
- EventChatPage: 761 → 471 lines (-290 lines, -38% reduction)
- MatchChatPage: 567 → 369 lines (-198 lines, -35% reduction)

Benefits:
- Massive complexity reduction in largest components
- Composite components can be reused across pages
- Better testability - each component tested independently
- Cleaner code organization - single responsibility principle
- Easier maintenance - changes in one place propagate everywhere
2025-11-21 17:10:53 +01:00
Radosław Gierwiało
9e74343c3b refactor(frontend): Phase 2 - extract business logic into custom hooks
Separate concerns - move Socket.IO and form logic from components to reusable hooks

New Hooks:
- useForm: Generic form state management with handleChange/handleSubmit/reset
- useEventChat: Extract Socket.IO logic from EventChatPage (156 lines)
  * Manages messages, active users, connection state
  * Handles send message, load older messages with scroll preservation
  * Real-time updates via Socket.IO event listeners
- useMatchChat: Extract Socket.IO logic from MatchChatPage (115 lines)
  * Manages 1:1 chat messages and connection
  * Loads message history from API
  * Real-time message sync via Socket.IO

Pages Refactored:
- EventChatPage: 661 → 564 lines (-97 lines, -15%)
- MatchChatPage: 517 → 446 lines (-71 lines, -14%)

Benefits:
- Cleaner component code - UI separated from business logic
- Reusable hooks can be used in other components
- Easier to test - hooks can be unit tested independently
- Better code organization - single responsibility principle
- 168 lines eliminated from pages, moved to 271 lines of reusable hooks

Phase 2 Total: -168 lines
Grand Total (Phase 1+2): -389 lines (-12%)
2025-11-21 17:02:04 +01:00
Radosław Gierwiało
dea9d70bb9 refactor(frontend): integrate reusable components across all pages
Phase 1 refactoring - eliminate code duplication and improve maintainability

Changes:
- LoginPage: Integrate FormInput and LoadingButton components (-9 lines)
- RegisterPage: Replace inline forms with FormInput/LoadingButton/Alert (-62 lines)
- EventChatPage: Integrate ChatMessageList/ChatInput and Modal components (-100 lines)
- MatchChatPage: Integrate ChatMessageList/ChatInput components (-50 lines)
- ProfilePage: Already using reusable components (no changes)

Total reduction: 221 lines (-11.6%)

Benefits:
- Eliminated ~40% code duplication in chat UI
- Unified form inputs across authentication pages
- Consistent modal dialogs with ConfirmationModal
- Improved maintainability - changes propagate to all uses
- Faster feature development with component library

Components used:
- Alert, FormInput, FormSelect, LoadingButton, LoadingSpinner
- ChatMessageList, ChatMessage, ChatInput
- Modal, ConfirmationModal
2025-11-21 16:50:46 +01:00
Radosław Gierwiało
1772fc522e feat(frontend): create reusable components for Phase 1 refactoring
- Add Alert component with 4 variants (success/error/warning/info)
- Add LoadingSpinner and LoadingButton components
- Add FormInput and FormSelect components with icon support
- Add Modal and ConfirmationModal components
- Add ChatMessage, ChatMessageList, and ChatInput components
- Add EventCard component

These components will eliminate ~450 lines of duplicated code across pages.
Part of Phase 1 (Quick Wins) frontend refactoring.
2025-11-20 23:22:05 +01:00
Radosław Gierwiało
c1b5ae2ad3 docs: add comprehensive frontend refactoring analysis and Phase 1 roadmap to TODO.md 2025-11-20 23:15:24 +01:00
Radosław Gierwiało
5cc11242ef docs: add comprehensive security audit findings to TODO.md 2025-11-20 23:02:59 +01:00
Radosław Gierwiało
c14d99d1b8 docs: update README.md to reflect current project state (Phase 3 completed, 11 tables, 223 tests passing) 2025-11-20 22:47:25 +01:00
Radosław Gierwiało
23e5382aa7 docs: update README.md documentation links after reorganization 2025-11-20 22:44:24 +01:00
Radosław Gierwiało
975d258497 docs: reorganize documentation structure for better context efficiency
Reorganization changes:
1. Moved from root → docs/:
   - QUICKSTART.md
   - QUICK_TEST.md
   - WEBRTC_TESTING_GUIDE.md

2. Created docs/archive/ and moved archival files:
   - COMPLETED.md (completed tasks archive)
   - PHASE_1.5.md (historical phase documentation)
   - RESOURCES.md (learning resources)
   - SECURITY_AUDIT.md (security audit)
   - ADMIN_CLI.md (CLI documentation)

3. Updated all references in:
   - README.md
   - docs/CONTEXT.md
   - docs/TODO.md
   - docs/SESSION_CONTEXT.md
   - docs/DEPLOYMENT.md
   - docs/QUICK_TEST.md

Active docs/ now contains only essential files:
- SESSION_CONTEXT.md (primary for context restoration)
- TODO.md
- CONTEXT.md
- ARCHITECTURE.md
- DEPLOYMENT.md
- MONITORING.md
- QUICKSTART.md
- QUICK_TEST.md
- WEBRTC_TESTING_GUIDE.md

Benefits:
- Reduced token usage when reading docs/ for context
- Clear separation between active and archived documentation
- Better organization for future maintenance
2025-11-20 22:42:06 +01:00
Radosław Gierwiało
1463b83882 docs: add Phase 2.5 (WebRTC) and Phase 3 (MVP Finalization) to COMPLETED.md
Added comprehensive completion documentation for:

Phase 2.5 (WebRTC P2P File Transfer):
- WebRTC signaling implementation
- File transfer with 16KB chunking
- Tested up to 700MB files
- E2E encryption (DTLS)
- NAT traversal (STUN servers)
- 7 backend tests passing

Phase 3 (MVP Finalization):
- Security hardening (CSRF, rate limiting, account lockout)
- 223/223 tests passing (100%), 71% coverage
- PWA features (manifest, service worker, iOS support)
- Production Docker configs
- Operations scripts (backup, restore, health-check)
- Monitoring documentation

Updated Last Updated date to 2025-11-20
Added MVP completion status
2025-11-20 22:35:41 +01:00
Radosław Gierwiało
63d528367e docs: update CONTEXT.md and ARCHITECTURE.md to reflect completed MVP
CONTEXT.md updates:
- Changed 'Planned' to 'Implemented' for backend, db, and WebRTC
- Updated Docker Compose components - all services now implemented
- Updated database models section with actual schema
- Updated tech stack - removed 'Planned' labels
- Added test coverage stats (223/223 tests passing)
- Updated Last Updated date to 2025-11-20
- Added MVP complete status

ARCHITECTURE.md updates:
- Updated architecture diagram - marked backend and db as  IMPL
- Changed 'Planned Services' to 'Implemented Services'
- Added production Dockerfile info
- Added test coverage (223/223 passing, 71%)
- Added Prisma ORM details
- Updated Last Updated date to 2025-11-20
- Added production-ready status

Both files now accurately reflect the completed MVP state.
2025-11-20 22:34:05 +01:00
Radosław Gierwiało
268cd73365 docs: fix outdated and inconsistent information in TODO.md
Corrections made:
-  Phase 1.6 (Competition Heats) - marked as COMPLETED (was IN PROGRESS)
-  Phase 2.5 (WebRTC) - marked as COMPLETED (was NEXT)
-  Phase 3 - marked as COMPLETED in progress table
-  Infrastructure section - added completed Docker prod configs
-  Testing section - updated with 223/223 passing tests
-  Progress table - updated to show 100% MVP complete
-  Overall progress - updated from 72% to 100%
-  Removed outdated 'Next Priority: WebRTC' section
-  Updated 'Last Updated' date to 2025-11-20
-  Updated Notes section with current status

All information now accurately reflects completed MVP state.
2025-11-20 22:30:18 +01:00
Radosław Gierwiało
eda7055e08 docs: mark Phase 3 (MVP Finalization) as completed
Update project status to reflect completion of all MVP features:

Phase 3 achievements:
-  Security hardening (CSRF, rate limiting, account lockout)
-  All tests passing (223/223, 71% coverage)
-  PWA features (manifest, service worker, iOS support)
-  Production deployment preparation
-  Operations scripts (backup, restore, health-check)
-  Monitoring documentation

Status: 100% MVP complete, ready for production deployment
Next: Infrastructure setup (server, domain, SSL)
2025-11-20 22:24:35 +01:00
Radosław Gierwiało
642c8f6d6f feat: add production operations scripts and monitoring guide
Add comprehensive tooling for production deployment:

Scripts (scripts/):
- backup-db.sh: Automated database backups with 7-day retention
- restore-db.sh: Safe database restore with confirmation prompts
- health-check.sh: Complete service health monitoring
- README.md: Operational scripts documentation

Monitoring (docs/MONITORING.md):
- Application health monitoring
- Docker container monitoring
- External monitoring setup (UptimeRobot, Pingdom)
- Log monitoring and rotation
- Alerting configuration
- Incident response procedures
- SLA targets and metrics

All scripts include:
- Environment support (dev/prod)
- Error handling and validation
- Detailed status reporting
- Safety confirmations where needed
2025-11-20 22:22:22 +01:00
Radosław Gierwiało
2e194e1640 docs: update SESSION_CONTEXT.md with completed test fixes
- All 223/223 backend tests now passing (100%)
- Code coverage improved to 71% (from ~43%)
- Updated progress to ~95% (from ~90%)
- Removed 'improved test coverage' from What's Missing
- Added test isolation achievement to Phase 3 status
2025-11-20 22:14:07 +01:00
Radosław Gierwiało
ab1e4a5cc8 docs: update TODO.md with completed test fixes (223/223 passing) 2025-11-20 22:12:58 +01:00
Radosław Gierwiało
688f71343d test: fix test isolation by using unique test data per suite
- Add unique prefixes to test usernames (users_, matches_, events_)
- Add unique prefixes to test emails to prevent conflicts
- Add unique prefixes to event slugs and worldsdc_id values
- This prevents race conditions when Jest runs tests in parallel

Results:
- All 223 tests now passing (was 145/223)
- 14/14 test suites passing (was 11/14)
- Code coverage improved to 71.31% (from ~45%)

Fixes:
- users.test.js: Changed john_dancer → users_john_dancer
- matches.test.js: Changed to matches_ prefix
- events.test.js: Changed to events_ prefix + unique worldsdc_id
2025-11-20 22:12:09 +01:00
Radosław Gierwiało
fd0dcdf77f test: improve test cleanup with selective deletion
- Replace deleteMany({}) with selective deletion by username/email/slug in:
  - events.test.js (target specific test users/events only)
  - matches.test.js (target specific test users/events only)
  - csrf.test.js (target csrftest user only)
- Replace delete() with deleteMany() for resilient cleanup:
  - matches.test.js (2 inline cleanups)
  - socket-webrtc.test.js (1 inline cleanup)
- Update TODO.md with test status and future UX/UI improvements

Test improvement: 189/223 passing (84.8%), up from 145/223 (65%)
2025-11-20 00:05:24 +01:00
Radosław Gierwiało
d6f3eafeb2 fix(tests): improve socket.test.js cleanup to avoid test interaction issues
- Replace delete() with deleteMany() in all afterAll hooks (more resilient)
- Add checks for testUser existence before creating EventParticipant
- Add .catch() handlers to ignore duplicate or foreign key errors
- Add conditional checks with ?. before cleanup operations

Changes improve test isolation and prevent foreign key constraint
violations when tests run together. All socket tests now pass
individually (12/12 socket.test.js, 7/7 socket-webrtc.test.js).
2025-11-19 22:22:49 +01:00
Radosław Gierwiało
93c0943bfa fix(tests): fix backend test failures and improve test isolation
- Fixed CORS test in app.test.js to use allowed origin
- Updated auth-phase1.5.test.js to match actual error messages
- Fixed socket.test.js to use slug parameter instead of eventId
- Added EventParticipant records for socket event room tests
- Updated security config to allow both frontend origins in dev

All socket tests now passing (12/12). Test changes ensure proper
cleanup and prevent database conflicts by using selective deletion
instead of wiping entire tables.
2025-11-19 22:10:36 +01:00
Radosław Gierwiało
85a47f4e8e test: fix backend test cleanup to preserve production data
Replace deleteMany({}) with selective cleanup targeting only test data:

- events.test.js: Delete only test users (john_dancer, sarah_swings, mike_blues)
  and test events (test-dance-festival-2025) before creating new ones
- matches.test.js: Clean up john_dancer, sarah_swings, mike_moves and
  test-dance-festival slug specifically
- users.test.js: Remove only john_dancer and sarah_swings test users
  in both beforeAll and afterAll hooks
- auth.test.js: Target specific test usernames/emails (testuser, newuser,
  lockouttest, etc.) instead of all users
- auth-phase1.5.test.js: Clean up 12 specific test users by username/email
- socket.test.js: Add beforeAll cleanup for sockettest user to prevent
  conflicts from previous test runs
- socket-webrtc.test.js: Clean up webrtc_user1 and webrtc_user2 before
  creating them

Fix CORS configuration for tests:
- security.js: Add http://localhost:3000 to allowed origins in development
  mode to fix app.test.js CORS test (was failing with 500 error)

Results: Improved from 125/223 passing to 137/223 passing (12 more tests fixed)
All test data cleanup now uses WHERE clauses with specific usernames/emails/slugs
instead of wiping entire tables with deleteMany({})
2025-11-19 21:46:04 +01:00
Radosław Gierwiało
9d1af60f30 test(pwa): add comprehensive PWA and Vitest test suite
- Install Vitest and React Testing Library for frontend tests
- Configure Vitest with jsdom environment and coverage
- Add test setup file with global mocks (matchMedia, IntersectionObserver)
- Write InstallPWA component tests (14 tests):
  - iOS detection and manual installation instructions
  - Android/Chrome beforeinstallprompt event handling
  - Install and dismiss functionality
  - 7-day dismissal persistence (localStorage)
  - Installed state detection (standalone mode)
- Write PWA configuration tests (28 tests):
  - App icons existence (PNG and SVG)
  - iOS splash screens for multiple devices
  - Vite PWA plugin configuration
  - index.html meta tags (iOS PWA support)
  - Manifest schema validation
  - Service worker configuration (Workbox)
- Write service worker tests (24 tests):
  - Service worker registration and lifecycle
  - Workbox integration
  - Cache Storage API operations
- Migrate existing WebRTC tests from Jest to Vitest (25 tests):
  - Update imports to use Vitest (vi.fn, describe, it, expect)
  - Fix WebRTCWarning and webrtcDetection test expectations
- Add test scripts to package.json (test, test:watch, test:ui, test:coverage)

All 91 tests passing (InstallPWA: 14, PWA config: 28, Service Worker: 24,
WebRTC: 25 total across 2 files)
2025-11-19 21:24:34 +01:00
Radosław Gierwiało
f0a1bfb31a feat(pwa): add Progressive Web App support with iOS compatibility
- Install vite-plugin-pwa and workbox-window for PWA functionality
- Configure Vite with full PWA manifest (name, icons, theme, display)
- Add service worker caching for static assets only (no API cache)
- Create app icons (192x192, 512x512, apple-touch-icon)
- Generate iOS splash screens for multiple device sizes
- Add iOS-specific meta tags (apple-mobile-web-app-capable, etc.)
- Implement InstallPWA component with dual platform support:
  - Android/Chrome: beforeinstallprompt event with custom UI
  - iOS Safari: manual installation instructions with icons
- Add dismissal logic with 7-day localStorage persistence
- Update documentation to reflect 90% project completion

PWA implementation focuses on installability and static asset caching
while avoiding offline API cache (WebRTC requires active connection).
2025-11-19 20:59:26 +01:00
Radosław Gierwiało
bfbfd0e729 test: fix auth test expectations and add test commands to Makefile
- Update auth.test.js to match current API error messages
  - Registration success message includes email verification notice
  - Duplicate credentials use generic message to prevent user enumeration

- Add test commands to Makefile
  - make test: run all backend tests
  - make test-watch: run tests in watch mode
  - make test-coverage: run tests with coverage report

All auth tests now pass (19/19 ✓)
2025-11-19 20:23:25 +01:00
Radosław Gierwiało
44df50362a feat(security): implement comprehensive security hardening
- Add CSRF protection with cookie-based tokens
  - Add cookie-parser and csurf middleware
  - Create GET /api/csrf-token endpoint
  - Frontend automatically includes CSRF token in POST/PUT/DELETE requests
  - Add retry logic for expired CSRF tokens

- Implement account lockout mechanism
  - Add database fields: failedLoginAttempts, lockedUntil
  - Track failed login attempts and lock accounts after max attempts (configurable)
  - Auto-unlock after lockout duration expires
  - Return helpful error messages with remaining time

- Add comprehensive security environment variables
  - Rate limiting configuration (API, auth, email endpoints)
  - CSRF protection toggle
  - Password policy requirements
  - Account lockout settings
  - Logging levels

- Add comprehensive test coverage
  - 6 new tests for account lockout functionality
  - 11 new tests for CSRF protection
  - All tests handle enabled/disabled states gracefully

- Update documentation
  - Add Phase 3 security hardening to SESSION_CONTEXT.md
  - Document new database fields and migration
  - Update progress to 85%

Files changed:
- Backend: app.js, auth controller, security config, new migration
- Frontend: api.js with CSRF token handling
- Tests: auth.test.js (extended), csrf.test.js (new)
- Config: .env examples with security variables
- Docs: SESSION_CONTEXT.md updated
2025-11-19 20:16:05 +01:00
Radosław Gierwiało
cbc970f60b feat(nav): add responsive mobile dropdown menu with avatar and counters
- Hide desktop items on small screens, add Menu/X toggle
- Include Matches badge, History, Profile, and Logout
- Keep real-time pending matches counter
2025-11-15 23:09:45 +01:00
Radosław Gierwiało
38adf1e5a5 feat(ui): unify avatars across navbar, profiles, event/match chat
- Add reusable Avatar with fallback, status dot, ring
- Replace <img> uses in Navbar, Profile, PublicProfile
- Use Avatar in MatchChatPage and EventChatPage messages and sidebars
- Fix own-message detection for snake_case payloads
2025-11-15 23:08:00 +01:00
Radosław Gierwiało
6a17143ce1 feat(events): add client-side pagination and animations on /events\n\n- Show 5 nearest events (>= today-3d) by default\n- Add Load previous/Load later with smooth fade-slide-in for new items\n- Prevent animating existing items; preserve scroll on prepend\n- Show check-in prompt only for initial 5 events\n- Add keyframes utility in index.css 2025-11-15 22:44:21 +01:00
Radosław Gierwiało
b9d6f42ff5 feat(import): add WSDC list parser with location + update-missing-location option\n\n- Parse Event List for name/date/location/country/sourceUrl\n- Support --source list|calendar|auto and --update-missing-location\n- Keep calendar import for title/start/end/url fallback\n- Update CLI summary and docs (ADMIN_CLI.md, README.md) 2025-11-15 21:56:05 +01:00
Radosław Gierwiało
457de6c1c4 fix(cli): keep REPL alive on errors and consolidate help\n\n- Replace process.exit(1) with thrown errors in handlers\n- REPL catches and prints CLI errors without exiting\n- Consolidated help to include all commands and examples\n- Add events:import:wsdc command mapping and alias 2025-11-15 21:41:01 +01:00
Radosław Gierwiało
78f96e2849 feat(cli): add admin REPL + commands and docs
- Add CLI entry in backend with default REPL, persistent history, aliases
- Add commands: users:list/create/verify, events:list/details/participants/checkin,
  matches:list, logs:app, logs:messages
- Support running subcommands inside REPL via .cli and run()
- Add Makefile targets: dev-cli, prod-cli, dev/prod up/down (+rebuild)
- Update README and add docs/ADMIN_CLI.md
- Add CLI tests with mocked Prisma
2025-11-15 20:51:24 +01:00
Radosław Gierwiało
c7a37b2f5c docs: add TURN server testing tasks to WebRTC roadmap 2025-11-15 19:14:44 +01:00
Radosław Gierwiało
4d52c9f5d2 feat: add TURN servers for symmetric NAT traversal
- Add openrelay.metered.ca TURN servers for testing
- Support connections through symmetric NAT (mobile networks)
- Add TCP transport fallback for strict firewalls
- Enables P2P file transfer across different networks
2025-11-15 19:00:24 +01:00
Radosław Gierwiało
6bfc9b04d2 fix: add nginx config for SPA routing in production
- Create nginx.conf with try_files directive for React Router
- Update Dockerfile.prod to copy nginx configuration
- Fixes 404 errors on direct navigation to /login, /register, etc.
- Add gzip compression and static asset caching
2025-11-15 18:20:04 +01:00