Files

Macky ff0f680090 [verified] Security hardening + UX/UI polish

Security (requesting-code-review pipeline + independent reviewer):
- Fix path traversal on file upload (basename sanitize + resolve-containment)
- Fix IDOR: org + owner scoping on all group/chat routes (_authorize_group/_get_owned_group),
  hide other users' personal groups in listings
- Remove XSS via v-html in Chat task (text interpolation)
- Add test_security.py (traversal + cross-user denial) — all pass

UX/UI (ui-ux-pro-max + frontend-dev-verification):
- Global: focus rings, 44px touch targets, hover/press transitions, input focus glow,
  prefers-reduced-motion, skeleton loaders, empty states, back links, spinner
- Login: password toggle, autocomplete, spinner, disabled-when-empty
- Cards lift on hover; dashboard skeleton + empty state; analyze button spinner

All backend tests pass (m0/m1/routes/security/e2e); frontend builds; served SPA verified via curl.

2026-08-07 16:00:43 +07:00

2.0 KiB

Raw Blame History

Engineering Log — Sales Trainer

Program status table + dated entries. Append-only entries under docs/engineering-log/.

What this is

A corporate, multi-user sales-training simulator. Admins upload/describe a product → app analyzes it + generates 15 realistic customer personas (5 per intent tier A/B/C) with varied, partially product-aligned pains, negotiation levers, initiation modes (customer/seller), channels (Facebook/LINE), and latent-vs-revealable data. Trainees chat 1:1 (one-shot) to close a sale; customers resist/negotiate/refuse; a separate judge-LLM scores + coaches the result.

Informed by MiroFish (CrowdSight engine) + the hermes-brain-and-tools CrowdSight plugin.

Status table

Milestone	Status	Last verified	Evidence	Next action
M0 Scaffold + auth/roles	complete	2026-08-07	`test_m0.py`	—
M1 Input & analyze (+pain-fit)	complete	2026-08-07	`test_e2e.py`	—
M2 Persona groups + generation (15, wrong_text)	complete	2026-08-07	`test_e2e.py`	—
M3 Report	complete	2026-08-07	`test_e2e.py`	—
M4 Chat simulator (init modes, one-shot, judge, debrief)	complete	2026-08-07	`test_e2e.py`	—
M5 Trainee loop (board, weak-areas, gen-persona)	complete	2026-08-07	`test_e2e.py`	—
M6 Frontend (Vue SPA) + static serving fix	complete	2026-08-07	build + live HTTP 200	—
M7 Docker/deploy/docs	complete	2026-08-07	Dockerfile/compose/README	live-key E2E

Guardrails

No self-registration; admin provisions users. (Verified: register => 404.)
One persona = one chat per user (one-shot). Enforced in SessionStore + chat start.
Latent persona fields never leak to trainees pre-result.
LLM credentials live in .env only; never logged.

Entry index

2026-08-07-build-out.md — M0–M7 build-out, decisions, verification, current state.
2026-08-07-security-ux.md — security hardening (path traversal, IDOR, XSS) + UX/UI polish.

2.0 KiB Raw Blame History Unescape Escape