Macky
3e1badc2d3
docs: add FUTURE_WORK.md (deferred infra/SaaS/UX items); focus shifts to using the app as designed
2026-08-09 09:51:27 +07:00
Macky
3d5c81fbd7
feat(saas): Phase 3 — plan/seats/active model, ToS consent, signed expiring export
...
P3a: org carries plan/seats/active/created_at; create_user enforces seats + rejects
inactive org; verify blocks login for inactive orgs; PATCH /api/admin/orgs (super_admin)
updates plan/seats/active with audit. Fixed verify swallowing its AuthError.
P3b: export/token issues a 5-min HMAC one-time CSV link; export accepts ?token=.
P3c: setup requires accepted_terms (consent stored); Setup.vue consent checkbox.
All 8 backend suites pass. Rebuilt dist.
2026-08-09 09:48:55 +07:00
Macky
056753e8cb
feat(saas): multi-tenant isolation (Phase 1) + rate-limit/audit/org-scoped export (Phase 2)
...
Phase 1 (tenant isolation):
- g.org_id set on require_auth; assert_tenant()/current_org_id() choke-point helpers.
- Multi-org provisioning: POST /api/admin/users {new_org:true} (super_admin) creates a
new org + its first admin; GET /api/admin/orgs (super_admin sees all, admin own).
- Fixed latent create_org double-id bug (dict id != store key).
- test_saas_tenant.py: org2 admin blocked from org1 group (403), can't list org1
groups/users, sees only own org; super_admin sees all.
Phase 2 (hardening):
- Rate limit login (per-IP + per-username) + chat send (per-user) to protect LLM cost
and slow brute force; services/rate_limit.py (in-memory + disk, no external deps).
- Audit log data/audit/audit.jsonl on org.create, user.promote_super_admin, analytics.export.
- CSV export now org-scoped (admin exports only own org).
All 8 backend suites pass.
2026-08-09 09:35:26 +07:00
Macky
e5a59dbc5c
docs: record 3-tab UI build-out (admin dashboard + date filter, personal dashboard, training difficulty, settings)
2026-08-07 22:36:43 +07:00
Macky
aec596d1d6
docs: record real 'wrong password after logout' fix (verify resolves username OR email)
2026-08-07 21:02:23 +07:00
Macky
7d778d780d
docs: record login-after-setup root cause (deployment data persistence)
2026-08-07 20:21:00 +07:00
Macky
9c646173ca
docs: record final Docker fix (prebuilt dist, no npm in image) in engineering log
2026-08-07 19:47:15 +07:00
Macky
4827481da3
docs: record Docker 'vite: not found' fix (NODE_ENV root cause) in engineering log
2026-08-07 19:28:55 +07:00
Macky
681561c22a
docs: update account flow (username admin/1234 + forced setup) in README/HANDOFF/engineering-log
2026-08-07 18:04:18 +07:00
Macky
eadf4f727a
docs: record reviewer-drive security fixes (mask sales_kit/report, ready-gate) in engineering log
2026-08-07 16:10:02 +07:00
Macky
ff0f680090
[verified] Security hardening + UX/UI polish
...
Security (requesting-code-review pipeline + independent reviewer):
- Fix path traversal on file upload (basename sanitize + resolve-containment)
- Fix IDOR: org + owner scoping on all group/chat routes (_authorize_group/_get_owned_group),
hide other users' personal groups in listings
- Remove XSS via v-html in Chat task (text interpolation)
- Add test_security.py (traversal + cross-user denial) — all pass
UX/UI (ui-ux-pro-max + frontend-dev-verification):
- Global: focus rings, 44px touch targets, hover/press transitions, input focus glow,
prefers-reduced-motion, skeleton loaders, empty states, back links, spinner
- Login: password toggle, autocomplete, spinner, disabled-when-empty
- Cards lift on hover; dashboard skeleton + empty state; analyze button spinner
All backend tests pass (m0/m1/routes/security/e2e); frontend builds; served SPA verified via curl.
2026-08-07 16:00:43 +07:00
Macky
c3d31c06e2
Sales Trainer v0.1: corporate sales-training simulator (Flask+Vue, 15 personas, chat simulator, judge, analytics)
...
- Auth/roles (no self-reg), admin user provision, JWT
- Analyze: sales kit + initial pain-fit from form/upload
- Persona generator: 15 personas (5/tier) w/ pain variety, negotiation, init mode, channel, latent/revealable, wrong_text special
- Chat simulator: per-mode initiation, one-shot, hidden signals, judge-LLM debrief+coaching
- Trainee loop: win/lose board, weak-areas, user-generated personas
- Admin analytics; EN+TH Vue SPA served by Flask
- Deploy: Dockerfile, docker-compose, README, eng-log + HANDOFF
- Tests (mock LLM): m0/m1/routes/e2e all pass
2026-08-07 15:31:06 +07:00
