kunthawat/sales-trainer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
65 Commits 1 Branch 0 Tags
9fd748154d0006cc8c9bf4192ff2afabacd21496
Commit Graph

23 Commits

Author SHA1 Message Date
Macky
9fd748154d feat: UX/SAAS 12-point redesign 
- auth: self-registration (role=user); first-created-user becomes super_admin
- roles: super_admin may promote others; regular admin cannot see super_admin accounts
- products: user-created private groups; admin 'สินค้าขององค์กร' (shared) with hidden/public; users can create groups
- analytics: team + per-user weak areas, close-rate-by-difficulty buckets, 30-day default, weekly trend, trainee table, active users; dashboard redesigned
- files: docx + xlsx upload support (python-docx + openpyxl)
- ui: tabs การฝึก→ผลการฝึก→ภาพรวม; admin lands on ภาพรวม / user on การฝึก; guide in topbar
- consolidate: weak-areas merged into Results (10/page), my-personas merged into Training
- copy: บุคคลต้นแบบ→persona everywhere; clearer add-product form (A/B/C, upload-or-fill)
- report: remove ดูรายงาน UI entry (endpoint kept)

Backend 348 tests pass; frontend build + vitest clean.
 2026-08-21 12:28:22 +07:00
Macky
2950ffad89 docs: record successful production deploy of OAuth + website removal 2026-08-20 11:39:48 +07:00
Macky
d6e7cffc84 feat(auth): Google + Facebook OAuth login/register 
Public social signup into OAUTH_DEFAULT_ORG (role user, seat-checked);
email-match links existing active user instead of duplicating. Server-side
provider token validation via stdlib urllib only (no new dep): Google
tokeninfo (aud + email_verified) and Facebook app/debug-token/me (is_valid,
app_id, me.id==user_id). Fail-closed when creds unconfigured, rate-limited
per-IP + per-email, /oauth/config leaks no secrets. Frontend: login buttons
(only enabled providers), GSI + FB SDK on-demand, monochrome glyphs, TH/EN.

Login page shows social buttons only when backend reports provider enabled.

348 backend tests pass (337 + 11 new OAuth), frontend build + 4/4 unit
clean, manual security review PASS. Not pushed (push auto-deploys).
 2026-08-20 10:57:04 +07:00
Macky
ece187be44 docs: record successful production deploy of UX redesign + marketing site 
Verified live: backend booted (JWT_SECRET set, no crash-loop), new bundle
hashes + new Login design served, website/ in repo (not yet deployed
publicly; pricing placeholders pending).
 2026-08-19 18:34:41 +07:00
Macky
c263cc81df feat(ui): app UX/UI redesign + marketing landing site 
App (Vue SPA) — 100% presentational, global design-token rebuild in
style.css + polished App/Login/Chat/MyBoard/Personas/Setup/Training.
No logic/API/route/i18n changes (verified: build clean, 4/4 vitest,
independent review PASS 5/5).

website/ — new self-contained static marketing landing site (TH-primary
+ EN toggle, CSS chat mockup, Hallmark theme), verified responsive at
320-768 (no horizontal scroll). Pricing uses placeholders pending owner.

Docs: engineering-log 2026-08-19 + HANDOFF updated.

NOT pushed (push to main auto-deploys to EasyPanel production;
operator approval + JWT_SECRET check required before deploy).
 2026-08-19 15:46:21 +07:00
Macky
19e9fd2328 docs: record JWT_SECRET boot-crash root cause for 2026-08-18 deploy 2026-08-18 14:41:00 +07:00
Macky
5febcc83c4 docs: note deploy-not-live follow-up for 2026-08-18 UX fixes (force webhook re-trigger) 2026-08-18 12:04:11 +07:00
Macky
ffb7cdda31 [verified] fix live-QA UX: no JSON leak in chat, greeting openers (wrong_text cools off post-first-reply), auto-close+summarize on buy/walk/try, remove Finish button 2026-08-18 09:42:05 +07:00
Macky
2c40fc7502 feat(import): commit S4.4 JSON→PostgreSQL importer + API error-handler hardening 
Re-verified staged increment from a clean requirements.lock.txt venv:
- 330 backend tests pass (17/17 in new error_handlers + json_import tests)
- compileall + frontend npm build clean
- git diff --check clean; no secrets in diff
- importer CLI dry-run bootstrap works

Includes JSON HTTPException handler under /api/* and parse-safe static 404
via abort. JSON stores remain runtime-authoritative; production operation
still gated behind operator approval.
 2026-08-16 07:42:32 +07:00
Macky
dbfce9aa54 [verified] harden Sales Trainer and add PostgreSQL foundation 2026-08-16 02:41:10 +07:00
Macky
6811dc1db9 docs: refresh HANDOFF + add 2026-08-09 engineering-log entry (idea-flow, live QA, LLM-judge decisions, persona variant) 2026-08-09 19:18:10 +07:00
Macky
3e1badc2d3 docs: add FUTURE_WORK.md (deferred infra/SaaS/UX items); focus shifts to using the app as designed 2026-08-09 09:51:27 +07:00
Macky
3d5c81fbd7 feat(saas): Phase 3 — plan/seats/active model, ToS consent, signed expiring export 
P3a: org carries plan/seats/active/created_at; create_user enforces seats + rejects
inactive org; verify blocks login for inactive orgs; PATCH /api/admin/orgs (super_admin)
updates plan/seats/active with audit. Fixed verify swallowing its AuthError.
P3b: export/token issues a 5-min HMAC one-time CSV link; export accepts ?token=.
P3c: setup requires accepted_terms (consent stored); Setup.vue consent checkbox.
All 8 backend suites pass. Rebuilt dist.
 2026-08-09 09:48:55 +07:00
Macky
056753e8cb feat(saas): multi-tenant isolation (Phase 1) + rate-limit/audit/org-scoped export (Phase 2) 
Phase 1 (tenant isolation):
- g.org_id set on require_auth; assert_tenant()/current_org_id() choke-point helpers.
- Multi-org provisioning: POST /api/admin/users {new_org:true} (super_admin) creates a
  new org + its first admin; GET /api/admin/orgs (super_admin sees all, admin own).
- Fixed latent create_org double-id bug (dict id != store key).
- test_saas_tenant.py: org2 admin blocked from org1 group (403), can't list org1
  groups/users, sees only own org; super_admin sees all.

Phase 2 (hardening):
- Rate limit login (per-IP + per-username) + chat send (per-user) to protect LLM cost
  and slow brute force; services/rate_limit.py (in-memory + disk, no external deps).
- Audit log data/audit/audit.jsonl on org.create, user.promote_super_admin, analytics.export.
- CSV export now org-scoped (admin exports only own org).
All 8 backend suites pass.
 2026-08-09 09:35:26 +07:00
Macky
e5a59dbc5c docs: record 3-tab UI build-out (admin dashboard + date filter, personal dashboard, training difficulty, settings) 2026-08-07 22:36:43 +07:00
Macky
aec596d1d6 docs: record real 'wrong password after logout' fix (verify resolves username OR email) 2026-08-07 21:02:23 +07:00
Macky
7d778d780d docs: record login-after-setup root cause (deployment data persistence) 2026-08-07 20:21:00 +07:00
Macky
9c646173ca docs: record final Docker fix (prebuilt dist, no npm in image) in engineering log 2026-08-07 19:47:15 +07:00
Macky
4827481da3 docs: record Docker 'vite: not found' fix (NODE_ENV root cause) in engineering log 2026-08-07 19:28:55 +07:00
Macky
681561c22a docs: update account flow (username admin/1234 + forced setup) in README/HANDOFF/engineering-log 2026-08-07 18:04:18 +07:00
Macky
eadf4f727a docs: record reviewer-drive security fixes (mask sales_kit/report, ready-gate) in engineering log 2026-08-07 16:10:02 +07:00
Macky
ff0f680090 [verified] Security hardening + UX/UI polish 
Security (requesting-code-review pipeline + independent reviewer):
- Fix path traversal on file upload (basename sanitize + resolve-containment)
- Fix IDOR: org + owner scoping on all group/chat routes (_authorize_group/_get_owned_group),
  hide other users' personal groups in listings
- Remove XSS via v-html in Chat task (text interpolation)
- Add test_security.py (traversal + cross-user denial) — all pass

UX/UI (ui-ux-pro-max + frontend-dev-verification):
- Global: focus rings, 44px touch targets, hover/press transitions, input focus glow,
  prefers-reduced-motion, skeleton loaders, empty states, back links, spinner
- Login: password toggle, autocomplete, spinner, disabled-when-empty
- Cards lift on hover; dashboard skeleton + empty state; analyze button spinner

All backend tests pass (m0/m1/routes/security/e2e); frontend builds; served SPA verified via curl.
 2026-08-07 16:00:43 +07:00
Macky
c3d31c06e2 Sales Trainer v0.1: corporate sales-training simulator (Flask+Vue, 15 personas, chat simulator, judge, analytics) 
- Auth/roles (no self-reg), admin user provision, JWT
- Analyze: sales kit + initial pain-fit from form/upload
- Persona generator: 15 personas (5/tier) w/ pain variety, negotiation, init mode, channel, latent/revealable, wrong_text special
- Chat simulator: per-mode initiation, one-shot, hidden signals, judge-LLM debrief+coaching
- Trainee loop: win/lose board, weak-areas, user-generated personas
- Admin analytics; EN+TH Vue SPA served by Flask
- Deploy: Dockerfile, docker-compose, README, eng-log + HANDOFF
- Tests (mock LLM): m0/m1/routes/e2e all pass
 2026-08-07 15:31:06 +07:00