9fd748154d
- auth: self-registration (role=user); first-created-user becomes super_admin - roles: super_admin may promote others; regular admin cannot see super_admin accounts - products: user-created private groups; admin 'สินค้าขององค์กร' (shared) with hidden/public; users can create groups - analytics: team + per-user weak areas, close-rate-by-difficulty buckets, 30-day default, weekly trend, trainee table, active users; dashboard redesigned - files: docx + xlsx upload support (python-docx + openpyxl) - ui: tabs การฝึก→ผลการฝึก→ภาพรวม; admin lands on ภาพรวม / user on การฝึก; guide in topbar - consolidate: weak-areas merged into Results (10/page), my-personas merged into Training - copy: บุคคลต้นแบบ→persona everywhere; clearer add-product form (A/B/C, upload-or-fill) - report: remove ดูรายงาน UI entry (endpoint kept) Backend 348 tests pass; frontend build + vitest clean.
75 lines
11 KiB
Markdown
75 lines
11 KiB
Markdown
# Engineering Log — Sales Trainer
|
||
|
||
Program status table + dated entries. Append-only entries under `docs/engineering-log/`.
|
||
|
||
## What this is
|
||
|
||
A corporate, multi-user **sales-training simulator**. Admins upload/describe a product → app
|
||
analyzes it + generates 15 realistic customer personas (5 per intent tier A/B/C) with varied,
|
||
partially product-aligned pains, negotiation levers, initiation modes (customer/seller),
|
||
channels (Facebook/LINE), and latent-vs-revealable data. Trainees chat 1:1 (one-shot) to close
|
||
a sale; customers resist/negotiate/refuse; a separate judge-LLM scores + coaches the result.
|
||
|
||
Informed by MiroFish (CrowdSight engine) + the hermes-brain-and-tools CrowdSight plugin.
|
||
|
||
## Status table
|
||
|
||
| Milestone | Status | Last verified | Evidence | Next action |
|
||
|-----------|--------|---------------|----------|-------------|
|
||
| M0 Scaffold + auth/roles | complete | 2026-08-07 | `test_m0.py` | — |
|
||
| M1 Input & analyze (+pain-fit) | complete | 2026-08-07 | `test_e2e.py` | — |
|
||
| M2 Persona groups + generation (15, wrong_text) | complete | 2026-08-07 | `test_e2e.py` | — |
|
||
| M3 Report | complete | 2026-08-07 | `test_e2e.py` | — |
|
||
| M4 Chat simulator (init modes, one-shot, judge, debrief) | complete | 2026-08-07 | `test_e2e.py` | — |
|
||
| M5 Trainee loop (board, weak-areas, gen-persona) | complete | 2026-08-07 | `test_e2e.py` | — |
|
||
| M6 Frontend (Vue SPA) + static serving fix | complete | 2026-08-07 | build + live HTTP 200 | — |
|
||
| M7 Docker/deploy/docs | complete | 2026-08-07 | Dockerfile/compose/README | live-key E2E |
|
||
| Idea-to-implementation audit | deployment blocked | 2026-08-13 | `docs/engineering-log/2026-08-13-idea-implementation-audit.md` | complete Sprint 1 live-operation checklist |
|
||
| Sprint 1 security hotfix | local verification + exact-tree reviewer passed; live-operation gate pending | 2026-08-14 | `docs/test-evidence/2026-08-13-sprint-1-security.md`, `docs/engineering-log/2026-08-14-sprint-1-current-tree.md` | operator-approved restricted deploy/rotation/smoke; then reassess Sprint 2 start |
|
||
| Sprint 2–4 final code gate | S4.2/S4.3 code-schema review passed; legacy-security remediation and exact-current scoped review passed; live-operation gate pending | 2026-08-15 | `docs/engineering-log/2026-08-15-final-security-gate.md` | operator-approved restricted deploy + authenticated smoke only; production readiness remains pending |
|
||
| S4.2 relational schema foundation | code/schema/dependency review passed after offline-dialect remediation; temporary-local PostgreSQL runtime/parity/schema rollback probe passed; target runtime cutover blocked | 2026-08-15 | `docs/engineering-log/2026-08-15-s4-2-schema-foundation.md`, `docs/engineering-log/2026-08-15-postgresql-runtime-gate.md`, `docs/test-evidence/2026-08-15-postgresql-runtime.md`, `backend/requirements.lock.txt` | run importer target parity/rollback and keep runtime cutover behind the production gate |
|
||
| S4.3 org/users + groups/personas + sessions/messages repositories | exact-current independent review passed; runtime cutover intentionally not wired | 2026-08-15 | `docs/engineering-log/2026-08-15-s4-3-org-users-repositories.md`, `docs/engineering-log/2026-08-15-s4-3-offline-dialect-remediation.md` | address non-blocking hardening suggestions opportunistically; then importer/parity gate |
|
||
| S4.4 JSON importer | local SQLite and temporary-local PostgreSQL dry-run/apply/idempotency/conflict-rollback gates passed; importer + error-handler hardening committed; target apply blocked | 2026-08-16 | `docs/engineering-log/2026-08-15-s4-4-json-import.md`, `docs/engineering-log/2026-08-15-postgresql-import-gate.md`, `docs/engineering-log/2026-08-16-s4-4-importer-errorhandler-commit.md`, `docs/test-evidence/2026-08-15-postgresql-import.md` | target snapshot checksum/count comparison, retained backup, and operator-approved rollback rehearsal |
|
||
| UX/UI redesign + marketing website | implemented + locally verified (build clean, 4/4 unit tests, independent review PASS, responsive verified); uncommitted; deploy pending operator approval | 2026-08-19 | `docs/engineering-log/2026-08-19-ux-redesign-and-marketing-site.md`, `website/`, `git diff` | operator approves push (auto-deploys); confirm production `JWT_SECRET` before deploy |
|
||
| OAuth Google + Facebook login/register | implemented + locally verified (348 backend tests incl. 11 new, frontend build + 4/4 unit, manual security review PASS, no new deps); uncommitted | 2026-08-20 | `docs/engineering-log/2026-08-20-oauth-google-facebook.md`, `backend/app/services/oauth.py`, `backend/app/api/oauth_routes.py`, `backend/tests/test_oauth.py` | operator approves push; set OAUTH_* creds + OAUTH_DEFAULT_ORG in EasyPanel env to enable (disabled by default, fail-closed) |
|
||
|
||
## Guardrails
|
||
- No self-registration; admin provisions users. (Verified: register => 404.)
|
||
- One persona = one chat per user (one-shot). Enforced in SessionStore + chat start.
|
||
- Latent persona fields never leak to trainees pre-result.
|
||
- LLM credentials live in `.env` only; never logged.
|
||
|
||
## Entry index
|
||
- `2026-08-07-build-out.md` — M0–M7 build-out, decisions, verification, current state.
|
||
- `2026-08-07-security-ux.md` — security hardening (path traversal, IDOR, XSS) + UX/UI polish.
|
||
- `2026-08-07-auth-gitea.md` — username login + first-time admin setup + Gitea push.
|
||
- `2026-08-07-docker-final.md` — historical prebuilt-`frontend/dist` fix; superseded on 2026-08-15 by the source-built Docker/CI contract in the current Dockerfile.
|
||
- `2026-08-07-login-after-setup.md` — can't-login-after-setup = deployment data non-persistence, not login logic (verified).
|
||
- `2026-08-07-login-email-fix.md` — REAL fix: verify() resolves username OR email; "wrong password" after logout→login was email-login not resolving a user.
|
||
- `2026-08-07-ui-tablayout.md` — 3-tab UI per spec: admin dashboard + date filter, personal dashboard, training w/ difficulty, settings profile.
|
||
- `2026-08-09-idea-flow-qa-deploy.md` — idea-flow UX cleanups, 2-scenario model + recontact-as-trait, live QA on EasyPanel + auto-deploy, per-turn LLM judge for win/loss, persona variant, 15-persona auto-gen (this session).
|
||
- `2026-08-13-idea-implementation-audit.md` — source-to-runtime audit; core flow verified, but independent probes reproduced arbitrary account takeover, two tenant bypasses, and additional product/runtime gaps.
|
||
- `2026-08-13-sprint-1-security-hotfix.md` — S1.1–S1.6 implementation, verification, and deployment warning.
|
||
- `2026-08-14-sprint-1-current-tree.md` — latest response-boundary and organization-update race fixes, exact verification evidence, and pending reviewer/live gates.
|
||
- `2026-08-14-final-review.md` — final exact-tree reviewer approval, regression evidence, and explicit operational limits.
|
||
- `2026-08-15-auth-version-review-reconciliation.md` — stale async auth-version finding, current lock-path verification, and pending fresh exact-tree review.
|
||
- `2026-08-15-s4-2-schema-foundation.md` — test-first SQLAlchemy/Alembic schema foundation, tenant constraints, dependency lock, and generated-dist cleanup.
|
||
- `2026-08-15-s4-3-org-users-repositories.md` — org/user repository contracts and SQLAlchemy adapters, with no runtime cutover.
|
||
- `2026-08-15-s4-3-offline-dialect-remediation.md` — exact-current reviewer finding, test-first offline Alembic guard remediation, and fresh-review status.
|
||
- `2026-08-15-legacy-security-review.md` — timed-out independent reviews and fail-closed gate handling.
|
||
- `2026-08-15-legacy-security-review-retries.md` — repeated bounded retry timeouts and final pending reviewer.
|
||
- `2026-08-15-legacy-security-remediation-verification.md` — historical 247-test verification, timeout handling, and prior scoped-review gate.
|
||
- `2026-08-15-legacy-rate-limit-migration.md` — current legacy rate-limit migration remediation, 280/4 local evidence, and fresh pending review gates.
|
||
- `2026-08-15-final-security-gate.md` — 319/166/4 local verification, dependency/tooling blocker, and three clean exact-current scoped reviewer verdicts; production-operation gate remains pending.
|
||
- `2026-08-15-postgresql-runtime-gate.md` — temporary-local PostgreSQL upgrade, tenant/uniqueness probe, ORM/migration parity, offline DDL, and schema downgrade evidence; target cutover remains pending.
|
||
- `2026-08-15-postgresql-import-gate.md` — temporary-local PostgreSQL importer dry-run, apply, idempotency, conflict rejection, transaction rollback, and cleanup evidence; target apply remains pending.
|
||
- `docs/test-evidence/2026-08-15-legacy-security-remediation.md` — test-first remediation, local verification, and independent-review boundary.
|
||
- `docs/test-evidence/2026-08-15-postgresql-runtime.md` — automated PostgreSQL gate evidence separated from Docker, Redis, importer, and production blockers.
|
||
- `docs/test-evidence/2026-08-15-postgresql-import.md` — temporary-local PostgreSQL importer evidence and target-operation boundary.
|
||
- `2026-08-15-s4-4-json-import.md` — fail-closed dry-run/apply importer, idempotency, backup, and parity blockers.
|
||
- `2026-08-16-s4-4-importer-errorhandler-commit.md` — re-verified from clean lock env (330 tests) and committed the staged S4.4 importer + error-handler hardening increment.
|
||
- `2026-08-18-live-qa-ux-fixes.md` — live-QA UX fixes: persona JSON never leaks into bubble, natural greeting openers (wrong_text cools off only after first reply), auto-close + auto-summarize on buy/walk/try, no manual "สรุปผล" button (336 tests).
|
||
- `2026-08-19-ux-redesign-and-marketing-site.md` — parallel subagents: app UX/UI redesign (global token system, 8 files, 100% presentational) + new `website/` marketing landing site (responsive TH/EN); build clean, 4/4 unit tests, independent review PASS; uncommitted, deploy pending operator approval.
|
||
- `2026-08-20-oauth-google-facebook.md` — OAuth login/register (Google + FB): public signup into OAUTH_DEFAULT_ORG, email-match linking, stdlib server-side token validation (no new dep), fail-closed, rate-limited; 348 backend tests (11 new), frontend clean; manual security review PASS; deploy pending operator push.
|
||
- `2026-08-21-ux-saas-redesign.md` — **UX/SAAS 12-point redesign** (this session): self-registration (role=user, first-user=super_admin), super_admin promotion + invisible-to-admin, user private groups + admin สินค้าขององค์กร + hidden/public, analytics (team/per-user weak areas, close-rate-by-difficulty, 30-day default, trainee table, weekly trend, active users), docx/xlsx parser, persona→persona copy, tab reorder + role landing + guide-in-topbar, page consolidation (weak-areas→Results, my-personas→Training), report UI removal, Analytics dashboard rewrite. 348 backend tests pass; frontend build + vitest clean; deploy pending operator approval.
|