Macky
3c22d88bcd
feat: demo SaaS + training flow security hardening (8/8 review gate passed)
...
- Demo accounts: super_admin-only provisioning into isolated DEMO_ORG_ID tenant,
30-day UTC trial on first login, revocable, one-time credential delivery via
optional SES/webhook (never persisted). Adds boto3 dependency.
- Analytics/report/export/privacy: shared bounded scan budget across users/groups/
sessions, tenant-consistent session/user/group joins, scalar-only CSV export
(no nested persisted-value stringification).
- Ownership/tenant isolation: canonical owner-tenant predicate for list/read/chat;
client sees is_owned only, never owner_user_id.
- Lifecycle/races: status transition validation, analyzing is an in-progress gate
(no duplicate reanalysis), structured-ready publication, stale-variant revalidation.
- Auth/setup/consent/JWT/OAuth/config: fail-closed consent, bounded JWT lifetime,
provider-subject atomic OAuth identity, repeated-secret rejection, strict Persona
trait validation.
- Chat/session/privacy: pre-seller opener redaction, corrupt-session recovery,
role-aware completed-chat dashboard routing.
- Frontend: Training→product→personas→practice flow, demo/role/demo guards,
is_owned-based ownership display, 320×568 and 500×768 responsive E2E.
- 8 independent exact-five-key review scopes passed; backend 509, frontend 26,
production build 1775 modules, isolated E2E 15.
2026-08-25 06:39:06 +07:00
Macky
334ef4e00c
fix(Docker): require persistent DATA_DIR volume; add VOLUME + README data-persistence warning
...
Root cause of re-login failing after first-run setup: on EasyPanel/w/o a volume, the
container's /app/backend/data (users, incl. the changed admin password) is wiped on every
recreate, so logging back in with the new password fails. Added:
- ENV DATA_DIR=/app/backend/data (explicit) + VOLUME declaration in Dockerfile
- README 'Data persistence' section: must mount a persistent volume to /app/backend/data
Verified: backend + live server login>setup>relogin-with-new-password works (200); the
failure is deployment data persistence, not login logic.
2026-08-07 20:20:42 +07:00
Macky
c3d31c06e2
Sales Trainer v0.1: corporate sales-training simulator (Flask+Vue, 15 personas, chat simulator, judge, analytics)
...
- Auth/roles (no self-reg), admin user provision, JWT
- Analyze: sales kit + initial pain-fit from form/upload
- Persona generator: 15 personas (5/tier) w/ pain variety, negotiation, init mode, channel, latent/revealable, wrong_text special
- Chat simulator: per-mode initiation, one-shot, hidden signals, judge-LLM debrief+coaching
- Trainee loop: win/lose board, weak-areas, user-generated personas
- Admin analytics; EN+TH Vue SPA served by Flask
- Deploy: Dockerfile, docker-compose, README, eng-log + HANDOFF
- Tests (mock LLM): m0/m1/routes/e2e all pass
2026-08-07 15:31:06 +07:00
