From 8ddc8b7b88ba58487c2bf602a0f58ae74907f56c Mon Sep 17 00:00:00 2001 From: Moheeb Zara Date: Tue, 4 Aug 2026 19:12:28 -0700 Subject: [PATCH] docs: record the SoC pass + browser smoke test; update known limitations Co-Authored-By: Claude Opus 4.8 (1M context) --- ARCHITECTURE.md | 11 +++++++---- docs/AUDIT-2026-08.md | 28 +++++++++++++++++++++++----- 2 files changed, 30 insertions(+), 9 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index dce7cf7..face067 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -123,9 +123,12 @@ A correct feature touches **one file per layer** and imports cross-feature code explicit active-space selector before that changes. - **Regenerate `types/database.ts`** to drop the hand-added RPC entries and the `// TODO(types)` join casts, and to de-duplicate the governance row types in `types/domain/governance.ts` into `Tables<>`. -- **Ops area-lead writes** still go directly to the DB from the browser (RLS-protected). They can't reuse - `upsertAreaLead` (a different `area_code`-keyed interface), so migrating them needs a small dedicated - server-action trio reconciled with that interface. - **`markOnboardingStepDone`** read-modify-writes a JSON column; a concurrent double-submit can drop a step. A DB-side atomic append (RPC / jsonb operator) is the fix. -- Integration + e2e suites need a DB service wired into CI. +- Integration + e2e suites need a DB service wired into CI (only unit tests + typecheck + lint run today). +- **Full authenticated UI testing** hasn't run in this environment (no local Docker/Supabase). The public + surface + routing were browser-smoke-tested; the authed screens are verified by `next build` + tsc + tests. + +All client-component DB writes now go through server actions (the ops area-lead and comms message writes +were the last direct-browser-write holdouts). The only browser-client usage that remains is auth +(login/signup) and the comms realtime read, which the postgres_changes subscription requires. diff --git a/docs/AUDIT-2026-08.md b/docs/AUDIT-2026-08.md index 715c39a..b3e4815 100644 --- a/docs/AUDIT-2026-08.md +++ b/docs/AUDIT-2026-08.md @@ -286,11 +286,29 @@ Nothing is committed yet beyond this document. **No pushes to `main` without you - `ARCHITECTURE.md` at repo root: layers, the server-action contract + space-scope invariant, the feature-folder conventions, and a step-by-step add-a-feature guide. -### Follow-ups (documented in ARCHITECTURE.md "Known limitations") +### Re-audit + separation-of-concerns pass ✅ (post-refactor) +A fresh 8-agent re-audit (SoC + refactor-regression + security/correctness) found **zero refactor +regressions** (every authz gate + `space_id` scope + handler independently verified across the split +action files and decomposed components). It surfaced the remaining SoC gaps + a few correctness misses, +all now fixed with tests: +- **SoC — direct browser writes eliminated**: the ops **area-lead** roster (create/update/delete) and the + **comms** message send now go through server actions (admin/member gate, validation, space-scoping, + audit). The comms send also **derives identity server-side** (was trusting client `user_id`/ + `display_name`/`handle` — impersonation). **No client component writes to the DB directly anymore.** +- **Payments IDOR**: `logCashPayment`/`linkPaymentToMember` now verify the `member_id` is in the caller's + space (same class as L1). +- **Stale revalidate**: the invites/onboarding/areas/roles/tiers actions revalidated `/settings` after + their panels moved to `/customize` — corrected. +- **Invite CAS**: `claimInviteUse` now distinguishes contention (retry) from a real cap (reject). + +### Browser smoke test (this environment) +No local Docker → no Supabase, so authenticated screens couldn't be driven with data. Verified on the +real dev server: landing + login render with no console/runtime errors; the decomposed authed routes +(`/ops`, `/settings`, `/members`) correctly redirect to `/login` (middleware + server compile OK). All +routes compile via `next build`. + +### Remaining follow-ups - Regenerate `types/database.ts` (drops the `// TODO(types)` join casts + hand-added RPCs; lets the governance rows in `types/domain/governance.ts` become `Tables<>`/`Enums<>`). -- Migrate the ops **area-lead** browser writes to server actions (needs reconciling with - `upsertAreaLead`'s `area_code` interface). RLS-protected today. - Deferred **L3** onboarding-race RPC; DB-backed CI integration run. -- **UI smoke-test** the decomposed ops/settings/members screens before merging (structural refactor, - verified by tsc + build + tests, but not by an automated UI test). +- **Manual UI smoke-test** the decomposed ops/settings/members screens against a real backend before merge.