A new member who joins via invite code now walks through an
admin-defined onboarding sequence before reaching the app.
Schema (migration 022, folded into schema.sql Section 14):
- space_onboarding_steps: step_key, step_type
(welcome|code_of_conduct|profile|payment|content), title, body,
config jsonb, is_enabled, is_required, is_system, sort_order,
unique per (space, step_key). Full RLS: members read, admin/board
write, admin delete non-system.
- space_members.onboarding_completed_at + onboarding_progress jsonb.
- Trigger seeds four default steps per space (welcome, code of
conduct [required], profile, dues). Backfill seeds existing spaces
and marks all existing members complete so the new gate never
traps them.
Flow:
- /onboarding (top-level route, outside the (app) group so no
redirect loop). Progress bar, step counter, back/continue, per-type
rendering. Profile step calls updateMyProfile; payment step is a
non-blocking nudge with optional link and "Remind me later".
- (app)/layout.tsx redirects to /onboarding while
onboarding_completed_at is null.
- createSpace marks the founder complete: founders configure the
space, they do not run the member flow (matches admin-vs-end-user
persona research).
- finishOnboarding re-checks required steps server-side so a tampered
client cannot skip a required code-of-conduct acknowledgement.
skipOnboarding only works when nothing is required.
Admin config:
- Settings -> Onboarding tab: reorder, edit title/body/payment link,
toggle enabled/required, add custom content steps, delete
non-system steps.
Safety:
- components/safe-markdown.tsx renders admin-authored markdown and a
sanitized subset of HTML (rehype-raw + rehype-sanitize). Added
those two deps.
Also:
- bio added to updateMyProfileSchema (members can self-set it; not
blocked by the migration-015 trigger).
- docs/UX_AND_PERSONAS.md: 4 personas and prioritized UX audit
findings. Onboarding was finding #1; 2-6 deferred and tracked.
266/266 unit tests pass. Production build clean, /onboarding in the
route table. Migration 022 applies idempotently on the next deploy.
The .gitignore rule `secrets/` matched any directory named secrets/
anywhere in the tree, including the new lib/secrets/ application code
that holds the AES-GCM helpers. Production build failed with
"Module not found: Can't resolve '@/lib/secrets/crypto'". Anchor the
ignore to the repo root with `/secrets/` so only the top-level
credentials directory is excluded.
Big feature batch driven by the super-audit findings and the user's
follow-up requests.
Schema migration 021 (folded into schema.sql Section 13):
- forum_threads + polymorphic comments table keyed on (entity_type,
entity_id). Entity types: forum_thread, proposal, incident, policy.
Trigger maintains forum_threads.comment_count and last_comment_at.
- space_tiers per-space with monthly_price_cents, billing_cadence,
is_system, sort_order. Trigger seeds plus/basic/associate on every
space INSERT and backfills existing spaces. space_members.tier_id FK
added and backfilled from the legacy enum value.
- space_role_labels (rename/recolor built-in roles per space).
space_custom_roles + space_member_custom_roles for non-privileged
extra labels. RLS gates by admin/board.
- space_invites: multi-code invites with expires_at, max_uses,
uses_count, is_enabled. Legacy spaces.invite_code backfilled as a
permanent enabled invite.
- secrets.encrypted_value bytea + encryption_version. Secrets RLS
tightened. New comms_channels INSERT policy: any member can create;
default channels are protected from deletion.
- knowledge_base.render_markdown boolean (default true).
Secrets encryption-at-rest:
- AES-256-GCM in lib/secrets/crypto.ts. Master key from
SECRETS_ENCRYPTION_KEY env (64 hex chars).
- New revealSecret(id) server action: only path to plaintext, writes
secret.revealed to activity_log.
- /ops/page.tsx no longer selects value or encrypted_value on the list
endpoint - the original screenshot bug where ciphertext was already
in the page bundle before "Reveal" is fixed.
UI:
- /forum index, /forum/new, /forum/[id]. Pin/lock/delete actions for
admin/board.
- CommentThread component embedded on /proposals/[id], /incidents/[id],
/policies/[slug]. Markdown rendering via react-markdown + remark-gfm.
- /comms sidebar: inline "+ New channel" form.
- /ops KB: row click opens markdown-rendering viewer modal.
- /settings: new Tiers tab and Invites tab. Inline price edit and
archive/delete on tiers; copy/enable/disable/delete on invites.
- AtlasLogo replaces the terminal icon on the landing nav and footer.
public/logo.svg wired as the favicon in app/layout.tsx metadata.
- Sidebar has a Forum nav link.
Server actions added:
- lib/actions/forum.ts, comms.ts, tiers.ts, roles.ts, invites.ts.
- lib/actions/secrets.ts rewritten with updateSecret + revealSecret.
Auth flow:
- joinSpace honors codes from space_invites first (enabled, expiry,
use cap), falls back to legacy spaces.invite_code, increments
uses_count on success.
Env:
- SECRETS_ENCRYPTION_KEY documented in .env.example and set on the
Droplet's /opt/hackerspace-ops/.env.production.
README: live site link added (https://hackerspace.sh).
266/266 unit tests pass. Production build clean. Migration 021 will be
applied on the next deploy via /opt/hackerspace-ops/deploy.sh's
idempotent migration runner.
Production deploy completed (DigitalOcean Droplet, self-hosted Supabase,
Caddy + Let's Encrypt, GitHub Actions auto-deploy on push to main, daily
pg_dumpall backups). This commit lands the work that came out of the
deep audit pass and the open-source release prep.
Audit fixes:
- Webhook signing secret is now displayed in the settings UI with
show/hide and copy-to-clipboard; the broken external docs.hackerspace.sh
link is replaced with a link to the new local docs.
- Settings updateSpaceSettings parameter type now includes
mission_statement so the field persists.
- members page enforces member_directory_visibility for non-admin viewers
(admin_only, board_visible, members_visible).
- Mobile responsiveness pass: Projects Kanban grid, Members + Payments
tables (column hiding on small screens), Proposal tally + voting
buttons (2-col on mobile).
Open-source release scaffolding:
- LICENSE (MIT).
- CONTRIBUTING.md with dev setup, conventions, PR flow.
- SECURITY.md with disclosure policy.
- CHANGELOG.md.
- docs/WEBHOOKS.md with Node and Python signature verification examples.
- README.md rewritten for an open-source audience.
Removed v0/Vercel references:
- @vercel/analytics dependency removed.
- app/layout.tsx no longer imports Analytics, drops generator: 'v0.app'.
- Canonical deployment docs (docs/DEPLOYMENT.md, docs/README.md,
docs/ARCHITECTURE.md, DATABASE.md, CLAUDE.md, README.md) now describe
the self-hosted Droplet target only.
- e2e console-error check no longer filters [v0] noise.
Landing page:
- GitHub icon link to the public repo in the nav and footer.
Workflow SSHes into the production droplet as `deploy` and runs
`/opt/hackerspace-ops/deploy.sh` which:
- git fetches and resets to origin/main
- rebuilds the app image with NEXT_PUBLIC_* baked in from .env.local
- applies any new scripts/0NN_*.sql migrations not in the
public._migrations_applied tracking table
- hot-swaps the app container with `docker compose up -d --no-deps app`
- prunes dangling images
Repo secrets DROPLET_HOST and DEPLOY_SSH_PRIVATE_KEY are configured.
Concurrency group `deploy-prod` with cancel-in-progress=false so two
pushes in quick succession queue rather than racing.
Also gitignores `secrets/` and `*.pem` so production credentials never
get committed.
The audit caught a real bug: `resources.css` declared
`font-family: 'IBM Plex Mono'` and `font-family: 'Libre Baskerville'`
as literal font names. `next/font/google` does not register the loaded
webfonts under those names — it generates hashed family names and
exposes them via `--font-ibm-plex-mono` and `--font-libre-baskerville`
CSS variables on the same element that gets the `*-module__*__variable`
class.
The shipped CSS therefore never used the downloaded webfonts; visitors
without the fonts installed locally saw the generic monospace / Georgia
fallback chain instead of the intended typography.
Switched all four font-family declarations to reference the variables
first, then the literal name, then a generic family:
font-family: var(--font-ibm-plex-mono), 'IBM Plex Mono', ui-monospace, ...
font-family: var(--font-libre-baskerville), 'Libre Baskerville', Georgia, serif
Also fixed the Wordmark SVG which had a hardcoded `fontFamily` SVG
attribute (overrides CSS); replaced with an inline `style` referencing
the same CSS variable.
Verified the CSS bundle now contains var(--font-ibm-plex-mono) and
var(--font-libre-baskerville) at the relevant rules.
Ports the existing hackerspace.sh Vue site (sibling repo) into this
codebase as a route group `app/(resources)/` so a single domain serves
both the public research / games subsite and the authenticated
management app.
Routes added (all public, all prerendered):
/resources landing page (the original HomePage.vue)
/zine iframe to the printable hackerspace zine
/governance iframe to Governance in a Box
/space-after-dark iframe to the isometric exploration game
/proposal-duel iframe to the proposal-debate game
/atlas iframe to the bundled atlas.html (2.2 MB)
The individual resource paths match the originals exactly so existing
deep links and bookmarks survive the domain switch-over.
Ports six Vue components to React: Wordmark, SpaceIcon, TraceIcon,
CubeIcon, KeyIcon, GridIcon, PromptIcon, AtlasLogo, ProjectCard,
IframeWrapper. CSS scoped under `.resources-root` so the dark IBM Plex
Mono / Libre Baskerville theme cannot bleed into the management app's
shadcn design system. Fonts loaded via next/font/google. The 2.2 MB
atlas.html lives in /public.
proxy.ts adds the six routes plus /atlas.html to PUBLIC_ROUTES so
anonymous visitors can reach them without redirecting to /login.
The management landing page links to /resources twice: a "Resources"
nav link, and a callout under the CTA buttons ("Not running a space?
Read the hackerspace research and games").
Adds proposals + proposal_votes + policies + incidents + incident_updates
tables with full RLS, async voting flow, dismissal-appeal pathway,
versioned policies with provenance, and an anonymous-incident token mode.
Adds per-space configurable areas, financial visibility settings, member
self-profile + COI disclosure, and a mission statement that renders in
the app footer.
Reorganises lib/actions.ts into per-domain files (tasks, projects,
members, payments, contacts, knowledge-base, secrets, area-leads,
settings, imports, proposals, incidents, policies, areas) plus a barrel.
Adds lib/permissions.ts and lib/auth-helpers.ts so action bodies stop
duplicating the user-to-member-to-role check. Wires every action that has
a Zod schema; introduces a flexibleDateTime preprocessor so HTML date
pickers no longer hit "Invalid datetime".
Hardens RLS: drops NOT NULL on space_members.user_id for offline members,
adds a privilege-escalation trigger that blocks self-edits to role / tier
/ status / approved / has_card_access / space_id, closes four
cross-tenant holes in the governance kernel, and adds a partial unique
index so two admins cannot concurrently activate two drafts of the same
policy slug.
Ships every deployment artifact: Dockerfile, docker-compose,
.do/app.yaml, .env.example, /api/health, plus a managed-Supabase guide
(docs/DEPLOYMENT.md), an end-to-end self-hosted Droplet guide
(docs/DEPLOY_DO_SELFHOSTED.md), and a Supabase-CLI local-dev quickstart
(docs/LOCAL_DEV.md). Replaces middleware.ts with proxy.ts for Next.js 16.
Adds scripts/schema.sql as the canonical idempotent full deploy plus
fourteen numbered incremental migrations.
Adds scripts/seed.sql so a fresh local DB renders something instead of
empty pages: a demo space, five members across all roles, a v1 code of
conduct, three proposals in different states with seven votes already
cast, an open incident, a project, three tasks, a KB entry, and matching
activity-log rows.
Replaces v0-generated test scaffolding with 266 real tests across
__tests__/{actions,auth-helpers,components,governance,permissions,
security,utils,validations}.test.ts. Adds react-markdown + remark-gfm
for proposal / incident / policy body rendering. Deletes four dead v0
fix-* scripts, the unused components/app-shell.tsx, and the duplicate
app/auth/login/page.tsx.
Routes (31 total): /api/health, /api/paypal/sync, /auth/callback, /,
/login, /signup, /signup/confirm, /dashboard, /tasks, /projects,
/members, /payments, /financials, /contacts, /ops, /ops/[id], /ops/new,
/proposals, /proposals/[id], /proposals/new, /incidents, /incidents/[id],
/incidents/new, /policies, /policies/[slug], /policies/new, /profile,
/recruitment, /settings, /comms, /import.
Full pass-by-pass history is in docs/HANDOFF.md; the roadmap is in
docs/GOVERNANCE_FEATURES.md.
Set up Vitest for unit/integration tests and Playwright for E2E tests; add configs, tests, and documentation
Co-authored-by: Moheeb Zara <[email protected]>
Moheeb Zara
vercel[bot]
v0andMoheeb Zara