kunthawat/sales-trainer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
d6e7cffc84942e36be09620514aebdd778b3fa27
sales-trainer/docs/engineering-log.md
Macky d6e7cffc84 feat(auth): Google + Facebook OAuth login/register 
Public social signup into OAUTH_DEFAULT_ORG (role user, seat-checked);
email-match links existing active user instead of duplicating. Server-side
provider token validation via stdlib urllib only (no new dep): Google
tokeninfo (aud + email_verified) and Facebook app/debug-token/me (is_valid,
app_id, me.id==user_id). Fail-closed when creds unconfigured, rate-limited
per-IP + per-email, /oauth/config leaks no secrets. Frontend: login buttons
(only enabled providers), GSI + FB SDK on-demand, monochrome glyphs, TH/EN.

Login page shows social buttons only when backend reports provider enabled.

348 backend tests pass (337 + 11 new OAuth), frontend build + 4/4 unit
clean, manual security review PASS. Not pushed (push auto-deploys).
2026-08-20 10:57:04 +07:00

9.9 KiB
Raw Blame History

Engineering Log — Sales Trainer

Program status table + dated entries. Append-only entries under docs/engineering-log/.

What this is

A corporate, multi-user sales-training simulator. Admins upload/describe a product → app analyzes it + generates 15 realistic customer personas (5 per intent tier A/B/C) with varied, partially product-aligned pains, negotiation levers, initiation modes (customer/seller), channels (Facebook/LINE), and latent-vs-revealable data. Trainees chat 1:1 (one-shot) to close a sale; customers resist/negotiate/refuse; a separate judge-LLM scores + coaches the result.

Informed by MiroFish (CrowdSight engine) + the hermes-brain-and-tools CrowdSight plugin.

Status table

Milestone Status Last verified Evidence Next action
M0 Scaffold + auth/roles complete 2026-08-07 test_m0.py —
M1 Input & analyze (+pain-fit) complete 2026-08-07 test_e2e.py —
M2 Persona groups + generation (15, wrong_text) complete 2026-08-07 test_e2e.py —
M3 Report complete 2026-08-07 test_e2e.py —
M4 Chat simulator (init modes, one-shot, judge, debrief) complete 2026-08-07 test_e2e.py —
M5 Trainee loop (board, weak-areas, gen-persona) complete 2026-08-07 test_e2e.py —
M6 Frontend (Vue SPA) + static serving fix complete 2026-08-07 build + live HTTP 200 —
M7 Docker/deploy/docs complete 2026-08-07 Dockerfile/compose/README live-key E2E
Idea-to-implementation audit deployment blocked 2026-08-13 docs/engineering-log/2026-08-13-idea-implementation-audit.md complete Sprint 1 live-operation checklist
Sprint 1 security hotfix local verification + exact-tree reviewer passed; live-operation gate pending 2026-08-14 docs/test-evidence/2026-08-13-sprint-1-security.md, docs/engineering-log/2026-08-14-sprint-1-current-tree.md operator-approved restricted deploy/rotation/smoke; then reassess Sprint 2 start
Sprint 2–4 final code gate S4.2/S4.3 code-schema review passed; legacy-security remediation and exact-current scoped review passed; live-operation gate pending 2026-08-15 docs/engineering-log/2026-08-15-final-security-gate.md operator-approved restricted deploy + authenticated smoke only; production readiness remains pending
S4.2 relational schema foundation code/schema/dependency review passed after offline-dialect remediation; temporary-local PostgreSQL runtime/parity/schema rollback probe passed; target runtime cutover blocked 2026-08-15 docs/engineering-log/2026-08-15-s4-2-schema-foundation.md, docs/engineering-log/2026-08-15-postgresql-runtime-gate.md, docs/test-evidence/2026-08-15-postgresql-runtime.md, backend/requirements.lock.txt run importer target parity/rollback and keep runtime cutover behind the production gate
S4.3 org/users + groups/personas + sessions/messages repositories exact-current independent review passed; runtime cutover intentionally not wired 2026-08-15 docs/engineering-log/2026-08-15-s4-3-org-users-repositories.md, docs/engineering-log/2026-08-15-s4-3-offline-dialect-remediation.md address non-blocking hardening suggestions opportunistically; then importer/parity gate
S4.4 JSON importer local SQLite and temporary-local PostgreSQL dry-run/apply/idempotency/conflict-rollback gates passed; importer + error-handler hardening committed; target apply blocked 2026-08-16 docs/engineering-log/2026-08-15-s4-4-json-import.md, docs/engineering-log/2026-08-15-postgresql-import-gate.md, docs/engineering-log/2026-08-16-s4-4-importer-errorhandler-commit.md, docs/test-evidence/2026-08-15-postgresql-import.md target snapshot checksum/count comparison, retained backup, and operator-approved rollback rehearsal
UX/UI redesign + marketing website implemented + locally verified (build clean, 4/4 unit tests, independent review PASS, responsive verified); uncommitted; deploy pending operator approval 2026-08-19 docs/engineering-log/2026-08-19-ux-redesign-and-marketing-site.md, website/, git diff operator approves push (auto-deploys); confirm production JWT_SECRET before deploy
OAuth Google + Facebook login/register implemented + locally verified (348 backend tests incl. 11 new, frontend build + 4/4 unit, manual security review PASS, no new deps); uncommitted 2026-08-20 docs/engineering-log/2026-08-20-oauth-google-facebook.md, backend/app/services/oauth.py, backend/app/api/oauth_routes.py, backend/tests/test_oauth.py operator approves push; set OAUTH_* creds + OAUTH_DEFAULT_ORG in EasyPanel env to enable (disabled by default, fail-closed)

Guardrails

  • No self-registration; admin provisions users. (Verified: register => 404.)
  • One persona = one chat per user (one-shot). Enforced in SessionStore + chat start.
  • Latent persona fields never leak to trainees pre-result.
  • LLM credentials live in .env only; never logged.

Entry index

  • 2026-08-07-build-out.md — M0–M7 build-out, decisions, verification, current state.
  • 2026-08-07-security-ux.md — security hardening (path traversal, IDOR, XSS) + UX/UI polish.
  • 2026-08-07-auth-gitea.md — username login + first-time admin setup + Gitea push.
  • 2026-08-07-docker-final.md — historical prebuilt-frontend/dist fix; superseded on 2026-08-15 by the source-built Docker/CI contract in the current Dockerfile.
  • 2026-08-07-login-after-setup.md — can't-login-after-setup = deployment data non-persistence, not login logic (verified).
  • 2026-08-07-login-email-fix.md — REAL fix: verify() resolves username OR email; "wrong password" after logout→login was email-login not resolving a user.
  • 2026-08-07-ui-tablayout.md — 3-tab UI per spec: admin dashboard + date filter, personal dashboard, training w/ difficulty, settings profile.
  • 2026-08-09-idea-flow-qa-deploy.md — idea-flow UX cleanups, 2-scenario model + recontact-as-trait, live QA on EasyPanel + auto-deploy, per-turn LLM judge for win/loss, persona variant, 15-persona auto-gen (this session).
  • 2026-08-13-idea-implementation-audit.md — source-to-runtime audit; core flow verified, but independent probes reproduced arbitrary account takeover, two tenant bypasses, and additional product/runtime gaps.
  • 2026-08-13-sprint-1-security-hotfix.md — S1.1–S1.6 implementation, verification, and deployment warning.
  • 2026-08-14-sprint-1-current-tree.md — latest response-boundary and organization-update race fixes, exact verification evidence, and pending reviewer/live gates.
  • 2026-08-14-final-review.md — final exact-tree reviewer approval, regression evidence, and explicit operational limits.
  • 2026-08-15-auth-version-review-reconciliation.md — stale async auth-version finding, current lock-path verification, and pending fresh exact-tree review.
  • 2026-08-15-s4-2-schema-foundation.md — test-first SQLAlchemy/Alembic schema foundation, tenant constraints, dependency lock, and generated-dist cleanup.
  • 2026-08-15-s4-3-org-users-repositories.md — org/user repository contracts and SQLAlchemy adapters, with no runtime cutover.
  • 2026-08-15-s4-3-offline-dialect-remediation.md — exact-current reviewer finding, test-first offline Alembic guard remediation, and fresh-review status.
  • 2026-08-15-legacy-security-review.md — timed-out independent reviews and fail-closed gate handling.
  • 2026-08-15-legacy-security-review-retries.md — repeated bounded retry timeouts and final pending reviewer.
  • 2026-08-15-legacy-security-remediation-verification.md — historical 247-test verification, timeout handling, and prior scoped-review gate.
  • 2026-08-15-legacy-rate-limit-migration.md — current legacy rate-limit migration remediation, 280/4 local evidence, and fresh pending review gates.
  • 2026-08-15-final-security-gate.md — 319/166/4 local verification, dependency/tooling blocker, and three clean exact-current scoped reviewer verdicts; production-operation gate remains pending.
  • 2026-08-15-postgresql-runtime-gate.md — temporary-local PostgreSQL upgrade, tenant/uniqueness probe, ORM/migration parity, offline DDL, and schema downgrade evidence; target cutover remains pending.
  • 2026-08-15-postgresql-import-gate.md — temporary-local PostgreSQL importer dry-run, apply, idempotency, conflict rejection, transaction rollback, and cleanup evidence; target apply remains pending.
  • docs/test-evidence/2026-08-15-legacy-security-remediation.md — test-first remediation, local verification, and independent-review boundary.
  • docs/test-evidence/2026-08-15-postgresql-runtime.md — automated PostgreSQL gate evidence separated from Docker, Redis, importer, and production blockers.
  • docs/test-evidence/2026-08-15-postgresql-import.md — temporary-local PostgreSQL importer evidence and target-operation boundary.
  • 2026-08-15-s4-4-json-import.md — fail-closed dry-run/apply importer, idempotency, backup, and parity blockers.
  • 2026-08-16-s4-4-importer-errorhandler-commit.md — re-verified from clean lock env (330 tests) and committed the staged S4.4 importer + error-handler hardening increment.
  • 2026-08-18-live-qa-ux-fixes.md — live-QA UX fixes: persona JSON never leaks into bubble, natural greeting openers (wrong_text cools off only after first reply), auto-close + auto-summarize on buy/walk/try, no manual "สรุปผล" button (336 tests).
  • 2026-08-19-ux-redesign-and-marketing-site.md — parallel subagents: app UX/UI redesign (global token system, 8 files, 100% presentational) + new website/ marketing landing site (responsive TH/EN); build clean, 4/4 unit tests, independent review PASS; uncommitted, deploy pending operator approval.
  • 2026-08-20-oauth-google-facebook.md — OAuth login/register (Google + FB): public signup into OAUTH_DEFAULT_ORG, email-match linking, stdlib server-side token validation (no new dep), fail-closed, rate-limited; 348 backend tests (11 new), frontend clean; manual security review PASS; deploy pending operator push.
Reference in New Issue View Git Blame Copy Permalink