wiggleverse/wiggleverse-ecomm
2
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity
119 Commits 8 Branches 9 Tags
f170950aec47ed6f47779cccba6b2ea7fccb5a08
Commit Graph

119 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
ben.stull f64c3fddf9 feat(products): CSV codec — file-level parse + INV-18 caps (PUC-5a) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-11 14:58:53 -07:00
ben.stull c39bbd4728 feat(products): domain skeleton — errors, column registry, canonical row model 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-11 14:55:37 -07:00
ben.stull 0ee948b34d feat(products): SD-0002 §6.3 schema — migration 0002 + nh3/multipart deps (SLICE-5) 
Also updates test_migrate_from_empty_applies_0001 → test_migrate_from_empty_applies_all
to assert both migrations apply on a fresh DB (mechanical consequence of adding 0002).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-11 14:52:18 -07:00
ben.stull 1267d4f29d docs: SLICE-5 implementation plan (SD-0002 §7.2 import spine) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-11 14:48:47 -07:00
ben.stull 6b405a0f2d Merge pull request 'fix(signin): key the resend cooldown to the address it was set for (#20)' (#22) from fix-20-signin-cooldown-keying into main
ci / check (push) Has been cancelled
Details
2026-06-11 08:22:08 +00:00
ben.stull 118e925580 fix(signin): key the resend cooldown to the address it was set for (#20)
ci / check (push) Has been cancelled
Details
ci / check (pull_request) Has been cancelled
Details 
The email-step Send button disabled on any running cooldown, so a merchant
who mistyped their address was locked out of sending to the corrected one
for the rest of the 60s window — a guard the server never had: request_code
enforces the cooldown per address (SD-0001 INV-3 -> PUC-2c).

Track which address the running cooldown belongs to (cooldownFor) and gate
the email-step button through cooldownAppliesTo(), which blocks only while
the countdown runs AND the input normalizes (strip+lowercase, mirroring
normalize_email / INV-2) to that address. Same address still shows the
honest 'Resend in Ns'; any other address sends immediately. The code-step
resend is unchanged. Verified in the live UI (wrong address -> Wrong
address? -> corrected address sends at once).

package-lock.json: sync recorded version with package.json (0.4.0).

Closes #20

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-11 01:21:23 -07:00
ben.stull 11acb3a5b1 Merge pull request 'docs: land session 0023 plan doc (stray untracked file)' (#18) from docs-archive-0023-plan into main
ci / check (push) Has been cancelled
Details
2026-06-11 07:56:34 +00:00
ben.stull efc9c8edb9 docs: land session 0023's ui-designs-collection plan in-repo (was untracked; content archive already had it)
ci / check (pull_request) Has been cancelled
Details
ci / check (push) Has been cancelled
Details 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-11 00:56:31 -07:00
ben.stull f7b76d5370 Merge pull request 'SLICE-4: record the first PPE bootstrap rehearsal (PUC-11) — green' (#17) from slice-4-rehearsal-record into main
ci / check (push) Has been cancelled
Details
2026-06-11 07:54:50 +00:00
ben.stull 4bb9763633 docs(slice-4): record the first PPE bootstrap rehearsal (PUC-11, 2026-06-11) — green
ci / check (pull_request) Has been cancelled
Details
ci / check (push) Has been cancelled
Details 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-11 00:54:47 -07:00
ben.stull a456d51f17 Merge pull request 'SLICE-4: deployment.toml — the ecomm PPE record' (#11) from slice-4-deployment-record into main
ci / check (push) Has been cancelled
Details
2026-06-11 06:45:08 +00:00
ben.stull ac3c4ffe36 feat(slice-4): deployment.toml — the ecomm PPE record (launch-app §5.1; Cloud SQL via secret ref)
ci / check (push) Has been cancelled
Details
ci / check (pull_request) Has been cancelled
Details 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 23:45:05 -07:00
ben.stull 8a2ec24d86 Merge pull request 'SLICE-4 (part 1): deploy contract — versioned health, backend-served SPA, SmtpMailer + honest 502 (SD-0001 §7.2)' (#10) from slice-4-deploy-contract into main
ci / check (push) Has been cancelled
Details
v0.4.0 		2026-06-11 06:36:26 +00:00
ben.stull acff7ac588 docs(slice-4): BOOTSTRAP.md PPE runbook, version 0.4.0, README status
ci / check (pull_request) Has been cancelled
Details
ci / check (push) Has been cancelled
Details 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 23:36:24 -07:00
ben.stull 22d738fc74 feat(slice-4): honest delivery failure — send-before-commit + 502 delivery_failed (INV-9; closes #7) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 23:35:01 -07:00
ben.stull 1b8c60fcb5 feat(slice-4): SmtpMailer — real mail over a configured relay, log-hygienic (INV-8, §6.6) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 23:33:40 -07:00
ben.stull 9f4295b77e feat(slice-4): backend serves the built SPA — the deployed nginx-proxies-all topology (launch-app §2) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 23:32:22 -07:00
ben.stull a1c5544694 feat(slice-4): VERSION file + versioned /healthz — the flotilla verify contract (§8.1) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 23:31:20 -07:00
ben.stull 0747181157 Merge pull request 'SLICE-3: storefront — create + INV-4 guard, Create/Admin screens, full entry routing (SD-0001 §7.2)' (#9) from slice-3-storefront into main
ci / check (push) Has been cancelled
Details
2026-06-11 05:47:02 +00:00
ben.stull 877be249c7 chore(slice-3): version 0.3, README status, label-input association fix (a11y §6.6)
ci / check (push) Has been cancelled
Details
ci / check (pull_request) Has been cancelled
Details 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 22:46:12 -07:00
ben.stull 25ac540171 feat(slice-3): Admin shell + complete entry routing (§5.4/§6.5, PUC-6/8/9) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 22:41:38 -07:00
ben.stull 10d22938f1 feat(slice-3): Create-storefront screen + API helper (§5.3, PUC-4/5/7) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 22:41:04 -07:00
ben.stull ddc949615e feat(slice-3): Sign-in re-skinned — code cells, cooldown countdown, honest §5.2 states 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 22:40:33 -07:00
ben.stull 0b302ea1e1 feat(slice-3): Landing re-skinned to the Claude Design export (§5.1) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 22:39:57 -07:00
ben.stull ef1498ba08 feat(slice-3): design-system foundation — Wiggleverse tokens, fonts, brand marks, UI kit (per ui/designs export) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 22:39:30 -07:00
ben.stull cc9d9dda5f test(slice-3): INV-1 whole-flow bootstrap test — empty DB to admin answer (§6.8) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 22:37:10 -07:00
ben.stull 306b5c1e5d feat(slice-3): POST /api/storefronts + storefronts-fed entry routing (§6.4/§6.5) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 22:36:50 -07:00
ben.stull e11fb032b1 test(slice-3): INV-4 invariants — concurrent-create refusal + many-capable membership schema 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 22:34:24 -07:00
ben.stull ba8b493a31 feat(slice-3): storefronts domain — create + membership + INV-4 guard (§6.5) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-10 22:33:57 -07:00
ben.stull 1b40bde4a0 Merge pull request 'SLICE-2: identity — email + one-time-code sign-up, sessions, Landing/Sign-in (SD-0001 §7.2)' (#6) from slice-2-identity into main
ci / check (push) Has been cancelled
Details
2026-06-10 17:51:18 +00:00
ben.stull 725877c5c6 docs(slice-2): implementation plan for the identity slice
ci / check (push) Has been cancelled
Details
ci / check (pull_request) Has been cancelled
Details 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 10:43:09 -07:00
ben.stull bf62f413d7 docs(slice-2): README status — identity slice in place 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 10:42:49 -07:00
ben.stull cfc28d7002 fix(slice-2): surface ecomm.* INFO logs so the one-time code reaches the dev log 
uvicorn configures only its own loggers, so the LogMailer INFO line — PUC-10's local dev
channel (the code in the backend log) — was swallowed. Add an idempotent dedicated handler
for the 'ecomm' logger (propagate=False) in create_app so dev.sh/uvicorn runs show the code.
Caught by the SLICE-2 end-to-end walk; unit tests read the in-memory outbox and didn't.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 10:42:30 -07:00
ben.stull b3ffb2d4b6 feat(slice-2): Landing + Sign-in screens, entry routing, API client (§5.1/5.2/6.5) 
Two-step email + one-time-code sign-in behind both doors; pure entry-routing rule unit-
tested with Vitest (§6.8); storefront routing reaches a SLICE-2 signed-in placeholder with
sign-out (PUC-9). check.sh now runs the frontend unit tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 10:39:48 -07:00
ben.stull cfd2b4ecc7 feat(slice-2): BFF /api/auth/* — request-code, verify, me, logout (§6.4) 
Screen-shaped JSON endpoints; signed-cookie session on verify; §6.4 error envelope;
storefront hard-wired null behind the _storefront_for seam (SLICE-3 fills it). No
enumeration: uniform 204. PUC-9 logout clears the cookie.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 10:35:01 -07:00
ben.stull d2eceac272 feat(slice-2): deps — mailer + session dependencies; build mailer at startup 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 10:34:13 -07:00
ben.stull 95680c9960 feat(slice-2): accounts domain — request_code/verify/get_account (INV-2/INV-3/INV-6) 
Email-canonical get-or-create, peppered-hash one-time codes with 10-min TTL, single-use,
5-attempt cap, and 60s resend cooldown; uniform new-or-known (no enumeration, §6.6). All
identity rules in the domain layer once (INV-6); scenario + invariant tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 10:31:32 -07:00
ben.stull 2d15f1a2cb feat(slice-2): platform/session — stdlib HMAC signed cookie tokens (§6.2) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 10:27:35 -07:00
ben.stull 446c13211a feat(slice-2): platform/mailer port + LogMailer (dev channel, §6.2/PUC-10) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 10:26:58 -07:00
ben.stull 7a6b396f65 feat(slice-2): config — session secret, cookie_secure, mailer_kind (INV-8) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 10:26:15 -07:00
ben.stull 9373177ed3 Merge pull request 'SLICE-1: walking skeleton (SD-0001 §7.2) — scaffold, dev Postgres, migration runner, /healthz' (#5) from claude/agitated-heyrovsky-1a1f47 into main
ci / check (push) Has been cancelled
Details
2026-06-10 15:50:42 +00:00
ben.stull f184802f1f docs(slice-1): README status — walking skeleton in place
ci / check (push) Has been cancelled
Details
ci / check (pull_request) Has been cancelled
Details 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 08:47:28 -07:00
ben.stull 4d1c957f42 fix(slice-1): dev.sh portable on bash 3.2 — drop wait -n, reap process subtree 
macOS ships bash 3.2 (no wait -n): poll with kill -0 instead. npm spawns vite as a
grandchild, so cleanup now recurses pgrep -P to reap the whole subtree — Ctrl-C frees
both :8000 and :5173 cleanly. Verified clean-checkout -> dev.sh -> empty self-migrated
Postgres -> /healthz 200, and trap teardown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 08:46:41 -07:00
ben.stull cd951cca2c docs(slice-1): BOOTSTRAP.md localhost bring-up runbook (BUC-5) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 08:42:00 -07:00
ben.stull 886da73eb6 ci(slice-1): Gitea workflow runs scripts/check.sh against a Postgres service 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 08:41:32 -07:00
ben.stull 6744a6ae0d feat(slice-1): Vite/React shell + /api proxy; scripts/check.sh now fully green 
Single tsconfig (no project-references split — avoids composite/noEmit friction for
the minimal shell); tsc typechecks src, vite loads its config via esbuild.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 08:41:10 -07:00
ben.stull 36046304da feat(slice-1): scripts/dev.sh — owns dev Postgres lifecycle + backend + Vite 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 08:39:37 -07:00
ben.stull d7b9f81e53 feat(slice-1): scripts/check.sh — the single gate (lint-imports, pytest, frontend build) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 08:39:14 -07:00
ben.stull ef385340e8 feat(slice-1): FastAPI factory + /healthz; self-migrate at startup (INV-1/§6.4) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 08:38:42 -07:00
ben.stull 9462423642 feat(slice-1): platform/db migration runner + migration 0001 (INV-7, §6.3 schema) 
Forward-only, fail-stop, advisory-lock-guarded psycopg runner; migration 0001 lays
the account/auth_code/storefront/membership schema. Tests prove migrate-from-empty
and idempotent re-migrate (INV-1 partial) and the INV-4 many-capable shape.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 08:37:09 -07:00