kunthawat/sales-trainer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
68 Commits 1 Branch 0 Tags
6a2e6a326f708990eb7bd502dcd9694c09ade2a2
Commit Graph

22 Commits

Author SHA1 Message Date
Macky
6a2e6a326f fix: restore legacy training data hidden by new visibility schema (migrate-on-read) 
Records written before the visibility field existed carry none; the new
fail-closed authorization treated missing visibility as invalid, making every
legacy group unlistable and unreadable. Add resolved_visibility(group) that
derives effective visibility for legacy records only (owner present => private,
absent => public), leaves explicit-malformed visibility fail-closed (None), and
never derives demo/hidden. Apply it at every list, authorization, chat, and
analytics boundary while keeping demo and hidden-preview paths raw and
owner_user_id-based private isolation intact. No persisted data is rewritten.

Backend full suite passes 517; frontend 26/26; production build passes.
 2026-08-25 08:59:22 +07:00
Macky
3c22d88bcd feat: demo SaaS + training flow security hardening (8/8 review gate passed) 
- Demo accounts: super_admin-only provisioning into isolated DEMO_ORG_ID tenant,
  30-day UTC trial on first login, revocable, one-time credential delivery via
  optional SES/webhook (never persisted). Adds boto3 dependency.
- Analytics/report/export/privacy: shared bounded scan budget across users/groups/
  sessions, tenant-consistent session/user/group joins, scalar-only CSV export
  (no nested persisted-value stringification).
- Ownership/tenant isolation: canonical owner-tenant predicate for list/read/chat;
  client sees is_owned only, never owner_user_id.
- Lifecycle/races: status transition validation, analyzing is an in-progress gate
  (no duplicate reanalysis), structured-ready publication, stale-variant revalidation.
- Auth/setup/consent/JWT/OAuth/config: fail-closed consent, bounded JWT lifetime,
  provider-subject atomic OAuth identity, repeated-secret rejection, strict Persona
  trait validation.
- Chat/session/privacy: pre-seller opener redaction, corrupt-session recovery,
  role-aware completed-chat dashboard routing.
- Frontend: Training→product→personas→practice flow, demo/role/demo guards,
  is_owned-based ownership display, 320×568 and 500×768 responsive E2E.
- 8 independent exact-five-key review scopes passed; backend 509, frontend 26,
  production build 1775 modules, isolated E2E 15.
 2026-08-25 06:39:06 +07:00
Macky
9fd748154d feat: UX/SAAS 12-point redesign 
- auth: self-registration (role=user); first-created-user becomes super_admin
- roles: super_admin may promote others; regular admin cannot see super_admin accounts
- products: user-created private groups; admin 'สินค้าขององค์กร' (shared) with hidden/public; users can create groups
- analytics: team + per-user weak areas, close-rate-by-difficulty buckets, 30-day default, weekly trend, trainee table, active users; dashboard redesigned
- files: docx + xlsx upload support (python-docx + openpyxl)
- ui: tabs การฝึก→ผลการฝึก→ภาพรวม; admin lands on ภาพรวม / user on การฝึก; guide in topbar
- consolidate: weak-areas merged into Results (10/page), my-personas merged into Training
- copy: บุคคลต้นแบบ→persona everywhere; clearer add-product form (A/B/C, upload-or-fill)
- report: remove ดูรายงาน UI entry (endpoint kept)

Backend 348 tests pass; frontend build + vitest clean.
 2026-08-21 12:28:22 +07:00
Macky
2950ffad89 docs: record successful production deploy of OAuth + website removal 2026-08-20 11:39:48 +07:00
Macky
d6e7cffc84 feat(auth): Google + Facebook OAuth login/register 
Public social signup into OAUTH_DEFAULT_ORG (role user, seat-checked);
email-match links existing active user instead of duplicating. Server-side
provider token validation via stdlib urllib only (no new dep): Google
tokeninfo (aud + email_verified) and Facebook app/debug-token/me (is_valid,
app_id, me.id==user_id). Fail-closed when creds unconfigured, rate-limited
per-IP + per-email, /oauth/config leaks no secrets. Frontend: login buttons
(only enabled providers), GSI + FB SDK on-demand, monochrome glyphs, TH/EN.

Login page shows social buttons only when backend reports provider enabled.

348 backend tests pass (337 + 11 new OAuth), frontend build + 4/4 unit
clean, manual security review PASS. Not pushed (push auto-deploys).
 2026-08-20 10:57:04 +07:00
Macky
ece187be44 docs: record successful production deploy of UX redesign + marketing site 
Verified live: backend booted (JWT_SECRET set, no crash-loop), new bundle
hashes + new Login design served, website/ in repo (not yet deployed
publicly; pricing placeholders pending).
 2026-08-19 18:34:41 +07:00
Macky
c263cc81df feat(ui): app UX/UI redesign + marketing landing site 
App (Vue SPA) — 100% presentational, global design-token rebuild in
style.css + polished App/Login/Chat/MyBoard/Personas/Setup/Training.
No logic/API/route/i18n changes (verified: build clean, 4/4 vitest,
independent review PASS 5/5).

website/ — new self-contained static marketing landing site (TH-primary
+ EN toggle, CSS chat mockup, Hallmark theme), verified responsive at
320-768 (no horizontal scroll). Pricing uses placeholders pending owner.

Docs: engineering-log 2026-08-19 + HANDOFF updated.

NOT pushed (push to main auto-deploys to EasyPanel production;
operator approval + JWT_SECRET check required before deploy).
 2026-08-19 15:46:21 +07:00
Macky
19e9fd2328 docs: record JWT_SECRET boot-crash root cause for 2026-08-18 deploy 2026-08-18 14:41:00 +07:00
Macky
5febcc83c4 docs: note deploy-not-live follow-up for 2026-08-18 UX fixes (force webhook re-trigger) 2026-08-18 12:04:11 +07:00
Macky
ffb7cdda31 [verified] fix live-QA UX: no JSON leak in chat, greeting openers (wrong_text cools off post-first-reply), auto-close+summarize on buy/walk/try, remove Finish button 2026-08-18 09:42:05 +07:00
Macky
2c40fc7502 feat(import): commit S4.4 JSON→PostgreSQL importer + API error-handler hardening 
Re-verified staged increment from a clean requirements.lock.txt venv:
- 330 backend tests pass (17/17 in new error_handlers + json_import tests)
- compileall + frontend npm build clean
- git diff --check clean; no secrets in diff
- importer CLI dry-run bootstrap works

Includes JSON HTTPException handler under /api/* and parse-safe static 404
via abort. JSON stores remain runtime-authoritative; production operation
still gated behind operator approval.
 2026-08-16 07:42:32 +07:00
Macky
dbfce9aa54 [verified] harden Sales Trainer and add PostgreSQL foundation 2026-08-16 02:41:10 +07:00
Macky
6811dc1db9 docs: refresh HANDOFF + add 2026-08-09 engineering-log entry (idea-flow, live QA, LLM-judge decisions, persona variant) 2026-08-09 19:18:10 +07:00
Macky
e5a59dbc5c docs: record 3-tab UI build-out (admin dashboard + date filter, personal dashboard, training difficulty, settings) 2026-08-07 22:36:43 +07:00
Macky
aec596d1d6 docs: record real 'wrong password after logout' fix (verify resolves username OR email) 2026-08-07 21:02:23 +07:00
Macky
7d778d780d docs: record login-after-setup root cause (deployment data persistence) 2026-08-07 20:21:00 +07:00
Macky
9c646173ca docs: record final Docker fix (prebuilt dist, no npm in image) in engineering log 2026-08-07 19:47:15 +07:00
Macky
4827481da3 docs: record Docker 'vite: not found' fix (NODE_ENV root cause) in engineering log 2026-08-07 19:28:55 +07:00
Macky
681561c22a docs: update account flow (username admin/1234 + forced setup) in README/HANDOFF/engineering-log 2026-08-07 18:04:18 +07:00
Macky
eadf4f727a docs: record reviewer-drive security fixes (mask sales_kit/report, ready-gate) in engineering log 2026-08-07 16:10:02 +07:00
Macky
ff0f680090 [verified] Security hardening + UX/UI polish 
Security (requesting-code-review pipeline + independent reviewer):
- Fix path traversal on file upload (basename sanitize + resolve-containment)
- Fix IDOR: org + owner scoping on all group/chat routes (_authorize_group/_get_owned_group),
  hide other users' personal groups in listings
- Remove XSS via v-html in Chat task (text interpolation)
- Add test_security.py (traversal + cross-user denial) — all pass

UX/UI (ui-ux-pro-max + frontend-dev-verification):
- Global: focus rings, 44px touch targets, hover/press transitions, input focus glow,
  prefers-reduced-motion, skeleton loaders, empty states, back links, spinner
- Login: password toggle, autocomplete, spinner, disabled-when-empty
- Cards lift on hover; dashboard skeleton + empty state; analyze button spinner

All backend tests pass (m0/m1/routes/security/e2e); frontend builds; served SPA verified via curl.
 2026-08-07 16:00:43 +07:00
Macky
c3d31c06e2 Sales Trainer v0.1: corporate sales-training simulator (Flask+Vue, 15 personas, chat simulator, judge, analytics) 
- Auth/roles (no self-reg), admin user provision, JWT
- Analyze: sales kit + initial pain-fit from form/upload
- Persona generator: 15 personas (5/tier) w/ pain variety, negotiation, init mode, channel, latent/revealable, wrong_text special
- Chat simulator: per-mode initiation, one-shot, hidden signals, judge-LLM debrief+coaching
- Trainee loop: win/lose board, weak-areas, user-generated personas
- Admin analytics; EN+TH Vue SPA served by Flask
- Deploy: Dockerfile, docker-compose, README, eng-log + HANDOFF
- Tests (mock LLM): m0/m1/routes/e2e all pass
 2026-08-07 15:31:06 +07:00