[BE-SEC-001] security: Fix ownership verification for user profile updates
- Verified RequireOwnershipOrAdmin middleware is correctly applied to PUT /users/:id - Added integration tests for ownership verification - Test: user cannot update another user's profile (403 Forbidden) - Test: admin can update any profile (200 OK) - Test: user can update own profile (200 OK) - All tests pass Phase: PHASE-1 Priority: P0 Progress: 1/267 (0.4%)
This commit is contained in:
senke
parent
37120e8dd1
commit
b9821db707
7 changed files with 12301 additions and 0 deletions
628
VEZA_COMPLETE_AUDIT_PROMPT.md
Normal file
628
VEZA_COMPLETE_AUDIT_PROMPT.md
Normal file
|
|
@ -0,0 +1,628 @@
|
||||||
|
# VEZA Complete MVP Audit & Todolist Generator
|
||||||
|
|
||||||
|
## 🎯 Mission
|
||||||
|
|
||||||
|
Tu es un agent d'audit exhaustif. Ta mission est de scanner **l'intégralité** du codebase Veza et générer une **todolist de 200+ tâches** couvrant tout ce qui est nécessaire pour atteindre un **MVP stable prêt pour la production à petite échelle**.
|
||||||
|
|
||||||
|
**RÈGLE ABSOLUE** : Ne JAMAIS ignorer, skipper ou supprimer une feature/route/fonction. Si quelque chose existe côté frontend mais pas backend (ou inversement), **AJOUTE UNE TÂCHE** pour l'implémenter. L'objectif est la **progression**, pas la régression ni la stagnation.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📁 Répertoires à Scanner
|
||||||
|
|
||||||
|
```
|
||||||
|
veza/
|
||||||
|
├── apps/web/ # Frontend React/TypeScript (SCAN COMPLET)
|
||||||
|
│ ├── src/
|
||||||
|
│ │ ├── components/ # Composants UI
|
||||||
|
│ │ ├── features/ # Features par domaine
|
||||||
|
│ │ ├── hooks/ # Custom hooks
|
||||||
|
│ │ ├── pages/ # Pages/routes
|
||||||
|
│ │ ├── services/ # Services API
|
||||||
|
│ │ ├── stores/ # State management
|
||||||
|
│ │ ├── types/ # Types TypeScript
|
||||||
|
│ │ ├── utils/ # Utilitaires
|
||||||
|
│ │ └── schemas/ # Validation Zod
|
||||||
|
│ ├── public/
|
||||||
|
│ └── tests/
|
||||||
|
│
|
||||||
|
├── veza-backend-api/ # Backend Go/Gin (SCAN COMPLET)
|
||||||
|
│ ├── cmd/ # Entry points
|
||||||
|
│ ├── internal/
|
||||||
|
│ │ ├── api/ # Routes & handlers
|
||||||
|
│ │ ├── config/ # Configuration
|
||||||
|
│ │ ├── dto/ # Data Transfer Objects
|
||||||
|
│ │ ├── middleware/ # Middlewares
|
||||||
|
│ │ ├── models/ # Database models
|
||||||
|
│ │ ├── repository/ # Data access
|
||||||
|
│ │ ├── services/ # Business logic
|
||||||
|
│ │ └── errors/ # Error handling
|
||||||
|
│ └── migrations/
|
||||||
|
│
|
||||||
|
├── veza-common/ # Shared code (SI EXISTE)
|
||||||
|
├── veza-chat-server/ # Chat server Rust (SI EXISTE)
|
||||||
|
├── veza-stream-server/ # Streaming server (SI EXISTE)
|
||||||
|
├── docker-compose*.yml # Infrastructure
|
||||||
|
└── docs/ # Documentation
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🔍 Protocole d'Audit Exhaustif
|
||||||
|
|
||||||
|
### ÉTAPE 1 : Cartographie du Frontend (apps/web/)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 1.1 Lister TOUTES les routes/pages
|
||||||
|
find apps/web/src/pages apps/web/src/features/*/pages -name "*.tsx" 2>/dev/null
|
||||||
|
|
||||||
|
# 1.2 Lister TOUS les services API
|
||||||
|
find apps/web/src/services apps/web/src/features/*/services -name "*.ts" 2>/dev/null
|
||||||
|
|
||||||
|
# 1.3 Lister TOUS les appels API
|
||||||
|
grep -rn "apiClient\.\|axios\.\|fetch(" apps/web/src/ --include="*.ts" --include="*.tsx"
|
||||||
|
|
||||||
|
# 1.4 Lister TOUS les types/interfaces
|
||||||
|
find apps/web/src/types apps/web/src/features/*/types -name "*.ts" 2>/dev/null
|
||||||
|
|
||||||
|
# 1.5 Lister TOUS les stores (state management)
|
||||||
|
find apps/web/src/stores apps/web/src/features/*/stores -name "*.ts" 2>/dev/null
|
||||||
|
|
||||||
|
# 1.6 Lister TOUS les hooks custom
|
||||||
|
find apps/web/src/hooks apps/web/src/features/*/hooks -name "*.ts" 2>/dev/null
|
||||||
|
|
||||||
|
# 1.7 Lister TOUS les composants
|
||||||
|
find apps/web/src/components apps/web/src/features/*/components -name "*.tsx" 2>/dev/null
|
||||||
|
|
||||||
|
# 1.8 Lister TOUS les schemas de validation
|
||||||
|
find apps/web/src/schemas apps/web/src/features/*/schemas -name "*.ts" 2>/dev/null
|
||||||
|
|
||||||
|
# 1.9 Lister les tests existants
|
||||||
|
find apps/web/src -name "*.test.ts" -o -name "*.test.tsx" -o -name "*.spec.ts" 2>/dev/null
|
||||||
|
```
|
||||||
|
|
||||||
|
### ÉTAPE 2 : Cartographie du Backend (veza-backend-api/)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 2.1 Lister TOUTES les routes définies
|
||||||
|
grep -rn "router\.\(GET\|POST\|PUT\|DELETE\|PATCH\)" veza-backend-api/internal/api/
|
||||||
|
|
||||||
|
# 2.2 Lister TOUS les handlers
|
||||||
|
find veza-backend-api/internal/handlers veza-backend-api/internal/api -name "*.go" 2>/dev/null
|
||||||
|
|
||||||
|
# 2.3 Lister TOUS les models
|
||||||
|
find veza-backend-api/internal/models -name "*.go" 2>/dev/null
|
||||||
|
|
||||||
|
# 2.4 Lister TOUS les DTOs
|
||||||
|
find veza-backend-api/internal/dto -name "*.go" 2>/dev/null
|
||||||
|
|
||||||
|
# 2.5 Lister TOUS les services
|
||||||
|
find veza-backend-api/internal/services -name "*.go" 2>/dev/null
|
||||||
|
|
||||||
|
# 2.6 Lister TOUS les repositories
|
||||||
|
find veza-backend-api/internal/repository -name "*.go" 2>/dev/null
|
||||||
|
|
||||||
|
# 2.7 Lister TOUS les middlewares
|
||||||
|
find veza-backend-api/internal/middleware -name "*.go" 2>/dev/null
|
||||||
|
|
||||||
|
# 2.8 Lister les migrations
|
||||||
|
find veza-backend-api/migrations -name "*.sql" 2>/dev/null
|
||||||
|
|
||||||
|
# 2.9 Lister les tests existants
|
||||||
|
find veza-backend-api -name "*_test.go" 2>/dev/null
|
||||||
|
```
|
||||||
|
|
||||||
|
### ÉTAPE 3 : Analyse de l'Intégration
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 3.1 Extraire TOUS les endpoints appelés par le frontend
|
||||||
|
grep -rohn "apiClient\.[a-z]*\s*(\s*['\"\`][^'\"\`]*" apps/web/src/ | sort | uniq
|
||||||
|
|
||||||
|
# 3.2 Extraire TOUTES les routes backend
|
||||||
|
grep -rn "router\.\(GET\|POST\|PUT\|DELETE\|PATCH\)" veza-backend-api/internal/api/ | grep -o '"[^"]*"' | sort | uniq
|
||||||
|
|
||||||
|
# 3.3 Comparer les deux listes pour trouver les gaps
|
||||||
|
|
||||||
|
# 3.4 Vérifier la cohérence des types
|
||||||
|
# Frontend types vs Backend DTOs
|
||||||
|
|
||||||
|
# 3.5 Vérifier les variables d'environnement
|
||||||
|
grep -rn "VITE_" apps/web/src/
|
||||||
|
grep -rn "os.Getenv" veza-backend-api/
|
||||||
|
```
|
||||||
|
|
||||||
|
### ÉTAPE 4 : Scanner les Autres Services (si présents)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# veza-common
|
||||||
|
ls -la veza-common/ 2>/dev/null
|
||||||
|
|
||||||
|
# veza-chat-server
|
||||||
|
ls -la veza-chat-server/ 2>/dev/null
|
||||||
|
grep -rn "route\|endpoint\|handler" veza-chat-server/src/ 2>/dev/null
|
||||||
|
|
||||||
|
# veza-stream-server
|
||||||
|
ls -la veza-stream-server/ 2>/dev/null
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📋 Catégories de Tâches à Générer
|
||||||
|
|
||||||
|
Pour chaque élément trouvé, génère des tâches dans ces catégories :
|
||||||
|
|
||||||
|
### 1. BACKEND - Routes API (BE-API-XXX)
|
||||||
|
- Routes manquantes appelées par le frontend
|
||||||
|
- Routes existantes mais incomplètes
|
||||||
|
- Validation des inputs manquante
|
||||||
|
- Gestion des erreurs insuffisante
|
||||||
|
- Documentation OpenAPI manquante
|
||||||
|
|
||||||
|
### 2. BACKEND - Models & Database (BE-DB-XXX)
|
||||||
|
- Models manquants ou incomplets
|
||||||
|
- Migrations manquantes
|
||||||
|
- Index manquants
|
||||||
|
- Relations mal définies
|
||||||
|
- Soft delete non implémenté
|
||||||
|
|
||||||
|
### 3. BACKEND - Services & Logic (BE-SVC-XXX)
|
||||||
|
- Business logic manquante
|
||||||
|
- Validation métier manquante
|
||||||
|
- Transactions non gérées
|
||||||
|
- Caching non implémenté
|
||||||
|
|
||||||
|
### 4. BACKEND - Security (BE-SEC-XXX)
|
||||||
|
- Authentication gaps
|
||||||
|
- Authorization gaps
|
||||||
|
- Rate limiting manquant
|
||||||
|
- Input sanitization
|
||||||
|
- CORS issues
|
||||||
|
|
||||||
|
### 5. BACKEND - Tests (BE-TEST-XXX)
|
||||||
|
- Tests unitaires manquants
|
||||||
|
- Tests d'intégration manquants
|
||||||
|
- Coverage insuffisante
|
||||||
|
|
||||||
|
### 6. FRONTEND - Pages & Routes (FE-PAGE-XXX)
|
||||||
|
- Pages incomplètes
|
||||||
|
- Routes mal configurées
|
||||||
|
- Layouts manquants
|
||||||
|
- Navigation broken
|
||||||
|
|
||||||
|
### 7. FRONTEND - Components (FE-COMP-XXX)
|
||||||
|
- Composants manquants
|
||||||
|
- Props non typées
|
||||||
|
- Accessibilité (a11y)
|
||||||
|
- Responsive design
|
||||||
|
- Error boundaries
|
||||||
|
|
||||||
|
### 8. FRONTEND - Services & API (FE-API-XXX)
|
||||||
|
- Services API incomplets
|
||||||
|
- Error handling manquant
|
||||||
|
- Loading states manquants
|
||||||
|
- Retry logic manquant
|
||||||
|
|
||||||
|
### 9. FRONTEND - State Management (FE-STATE-XXX)
|
||||||
|
- Stores incomplets
|
||||||
|
- State sync issues
|
||||||
|
- Cache invalidation
|
||||||
|
- Optimistic updates
|
||||||
|
|
||||||
|
### 10. FRONTEND - Types & Validation (FE-TYPE-XXX)
|
||||||
|
- Types manquants ou incorrects
|
||||||
|
- Zod schemas manquants
|
||||||
|
- Runtime validation
|
||||||
|
|
||||||
|
### 11. FRONTEND - Tests (FE-TEST-XXX)
|
||||||
|
- Tests unitaires manquants
|
||||||
|
- Tests de composants manquants
|
||||||
|
- Tests E2E manquants
|
||||||
|
|
||||||
|
### 12. INTEGRATION (INT-XXX)
|
||||||
|
- Contract mismatches
|
||||||
|
- Type inconsistencies
|
||||||
|
- Missing endpoints
|
||||||
|
- Response format issues
|
||||||
|
|
||||||
|
### 13. INFRASTRUCTURE (INFRA-XXX)
|
||||||
|
- Docker configuration
|
||||||
|
- Environment variables
|
||||||
|
- CI/CD pipeline
|
||||||
|
- Monitoring/Logging
|
||||||
|
|
||||||
|
### 14. DOCUMENTATION (DOC-XXX)
|
||||||
|
- API documentation
|
||||||
|
- README updates
|
||||||
|
- Architecture docs
|
||||||
|
- Deployment guide
|
||||||
|
|
||||||
|
### 15. SECURITY (SEC-XXX)
|
||||||
|
- Authentication issues
|
||||||
|
- Authorization issues
|
||||||
|
- Data exposure risks
|
||||||
|
- Dependency vulnerabilities
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📊 Format de Sortie JSON
|
||||||
|
|
||||||
|
Génère le fichier `VEZA_COMPLETE_MVP_TODOLIST.json` avec cette structure :
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"meta": {
|
||||||
|
"title": "Veza Complete MVP Todolist",
|
||||||
|
"description": "Exhaustive todolist for production-ready MVP",
|
||||||
|
"generated_at": "ISO_TIMESTAMP",
|
||||||
|
"total_tasks": 200,
|
||||||
|
"target": "Production-ready MVP at small scale",
|
||||||
|
"scanned_directories": [
|
||||||
|
"apps/web/",
|
||||||
|
"veza-backend-api/",
|
||||||
|
"veza-common/",
|
||||||
|
"..."
|
||||||
|
],
|
||||||
|
"audit_methodology": "Full codebase scan + integration analysis"
|
||||||
|
},
|
||||||
|
"summary": {
|
||||||
|
"by_priority": {
|
||||||
|
"P0_critical": 0,
|
||||||
|
"P1_high": 0,
|
||||||
|
"P2_medium": 0,
|
||||||
|
"P3_low": 0
|
||||||
|
},
|
||||||
|
"by_category": {
|
||||||
|
"BE-API": 0,
|
||||||
|
"BE-DB": 0,
|
||||||
|
"BE-SVC": 0,
|
||||||
|
"BE-SEC": 0,
|
||||||
|
"BE-TEST": 0,
|
||||||
|
"FE-PAGE": 0,
|
||||||
|
"FE-COMP": 0,
|
||||||
|
"FE-API": 0,
|
||||||
|
"FE-STATE": 0,
|
||||||
|
"FE-TYPE": 0,
|
||||||
|
"FE-TEST": 0,
|
||||||
|
"INT": 0,
|
||||||
|
"INFRA": 0,
|
||||||
|
"DOC": 0,
|
||||||
|
"SEC": 0
|
||||||
|
},
|
||||||
|
"by_owner": {
|
||||||
|
"backend": 0,
|
||||||
|
"frontend": 0,
|
||||||
|
"fullstack": 0,
|
||||||
|
"devops": 0
|
||||||
|
},
|
||||||
|
"estimated_total_hours": 0
|
||||||
|
},
|
||||||
|
"phases": [
|
||||||
|
{
|
||||||
|
"id": "PHASE-1",
|
||||||
|
"name": "Critical Foundation",
|
||||||
|
"description": "Must fix before any other work",
|
||||||
|
"priority": "P0",
|
||||||
|
"estimated_days": 0,
|
||||||
|
"tasks": []
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "PHASE-2",
|
||||||
|
"name": "Core Features Completion",
|
||||||
|
"description": "Complete essential user-facing features",
|
||||||
|
"priority": "P1",
|
||||||
|
"estimated_days": 0,
|
||||||
|
"tasks": []
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "PHASE-3",
|
||||||
|
"name": "Integration & Consistency",
|
||||||
|
"description": "Ensure frontend/backend work seamlessly",
|
||||||
|
"priority": "P1",
|
||||||
|
"estimated_days": 0,
|
||||||
|
"tasks": []
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "PHASE-4",
|
||||||
|
"name": "Security Hardening",
|
||||||
|
"description": "Security measures for production",
|
||||||
|
"priority": "P1",
|
||||||
|
"estimated_days": 0,
|
||||||
|
"tasks": []
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "PHASE-5",
|
||||||
|
"name": "Testing & Quality",
|
||||||
|
"description": "Test coverage and code quality",
|
||||||
|
"priority": "P2",
|
||||||
|
"estimated_days": 0,
|
||||||
|
"tasks": []
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "PHASE-6",
|
||||||
|
"name": "Performance & Optimization",
|
||||||
|
"description": "Optimize for production load",
|
||||||
|
"priority": "P2",
|
||||||
|
"estimated_days": 0,
|
||||||
|
"tasks": []
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "PHASE-7",
|
||||||
|
"name": "Documentation & DevOps",
|
||||||
|
"description": "Documentation and deployment readiness",
|
||||||
|
"priority": "P2",
|
||||||
|
"estimated_days": 0,
|
||||||
|
"tasks": []
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "PHASE-8",
|
||||||
|
"name": "Polish & UX",
|
||||||
|
"description": "UI/UX improvements and polish",
|
||||||
|
"priority": "P3",
|
||||||
|
"estimated_days": 0,
|
||||||
|
"tasks": []
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"tasks": [
|
||||||
|
{
|
||||||
|
"id": "BE-API-001",
|
||||||
|
"phase": "PHASE-2",
|
||||||
|
"priority": "P1",
|
||||||
|
"priority_rank": 1,
|
||||||
|
"category": "backend-api",
|
||||||
|
"title": "Task title",
|
||||||
|
"description": "Detailed description",
|
||||||
|
"owner": "backend",
|
||||||
|
"estimated_hours": 2,
|
||||||
|
"status": "todo",
|
||||||
|
"files_involved": [
|
||||||
|
{
|
||||||
|
"path": "veza-backend-api/internal/...",
|
||||||
|
"action": "create|modify|delete",
|
||||||
|
"reason": "Why this file"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"implementation_steps": [
|
||||||
|
{
|
||||||
|
"step": 1,
|
||||||
|
"action": "What to do",
|
||||||
|
"details": "How to do it"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"acceptance_criteria": [
|
||||||
|
"Criterion 1",
|
||||||
|
"Criterion 2"
|
||||||
|
],
|
||||||
|
"dependencies": ["OTHER-TASK-ID"],
|
||||||
|
"related_frontend": "FE-XXX-YYY",
|
||||||
|
"related_backend": "BE-XXX-YYY",
|
||||||
|
"test_requirements": [
|
||||||
|
"Unit test for...",
|
||||||
|
"Integration test for..."
|
||||||
|
],
|
||||||
|
"notes": "Additional context"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"gap_analysis": {
|
||||||
|
"frontend_calls_without_backend": [
|
||||||
|
{
|
||||||
|
"frontend_location": "apps/web/src/services/xxx.ts:42",
|
||||||
|
"endpoint_called": "GET /api/v1/something",
|
||||||
|
"backend_status": "NOT_FOUND",
|
||||||
|
"task_created": "BE-API-XXX"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"backend_routes_without_frontend": [
|
||||||
|
{
|
||||||
|
"backend_location": "veza-backend-api/internal/api/router.go:123",
|
||||||
|
"endpoint_defined": "POST /api/v1/something-else",
|
||||||
|
"frontend_usage": "NOT_FOUND",
|
||||||
|
"task_created": "FE-API-XXX"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"type_mismatches": [
|
||||||
|
{
|
||||||
|
"frontend_type": "apps/web/src/types/user.ts - id: number",
|
||||||
|
"backend_type": "veza-backend-api/internal/dto/user.go - ID: uuid.UUID",
|
||||||
|
"task_created": "INT-XXX"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"risk_register": [
|
||||||
|
{
|
||||||
|
"risk": "Description of risk",
|
||||||
|
"severity": "high|medium|low",
|
||||||
|
"mitigation_tasks": ["TASK-ID-1", "TASK-ID-2"],
|
||||||
|
"owner": "backend|frontend|devops"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"mvp_definition": {
|
||||||
|
"must_have_features": [
|
||||||
|
{
|
||||||
|
"feature": "User Authentication",
|
||||||
|
"status": "complete|partial|missing",
|
||||||
|
"tasks_required": ["BE-API-001", "FE-PAGE-001"]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"nice_to_have": [
|
||||||
|
{
|
||||||
|
"feature": "Advanced Search",
|
||||||
|
"tasks_if_included": ["BE-API-050", "FE-COMP-030"]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"out_of_scope": [
|
||||||
|
"Feature X - reason"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"progress_tracking": {
|
||||||
|
"completed": 0,
|
||||||
|
"in_progress": 0,
|
||||||
|
"todo": 200,
|
||||||
|
"blocked": 0,
|
||||||
|
"last_updated": null,
|
||||||
|
"completion_percentage": 0
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🔢 Règles de Priorisation
|
||||||
|
|
||||||
|
### P0 - Critical (Blocker)
|
||||||
|
- L'app ne démarre pas
|
||||||
|
- Crash systématique
|
||||||
|
- Faille de sécurité majeure
|
||||||
|
- Perte de données possible
|
||||||
|
- Authentication cassée
|
||||||
|
|
||||||
|
### P1 - High (Core Feature)
|
||||||
|
- Feature essentielle non fonctionnelle
|
||||||
|
- Intégration frontend/backend cassée
|
||||||
|
- UX bloquante pour l'utilisateur
|
||||||
|
- Performance inacceptable
|
||||||
|
|
||||||
|
### P2 - Medium (Important)
|
||||||
|
- Feature secondaire non fonctionnelle
|
||||||
|
- Inconsistances visuelles
|
||||||
|
- Tests manquants pour code critique
|
||||||
|
- Documentation manquante
|
||||||
|
|
||||||
|
### P3 - Low (Nice to Have)
|
||||||
|
- Améliorations UX mineures
|
||||||
|
- Refactoring non urgent
|
||||||
|
- Tests pour code non critique
|
||||||
|
- Optimisations mineures
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## ⚠️ Règles Absolues
|
||||||
|
|
||||||
|
### NE JAMAIS :
|
||||||
|
- ❌ Ignorer une route/feature parce qu'elle n'est pas implémentée
|
||||||
|
- ❌ Recommander de supprimer du code qui appelle des endpoints manquants
|
||||||
|
- ❌ Sauter des fichiers "parce qu'ils semblent obsolètes"
|
||||||
|
- ❌ Limiter l'audit à certains dossiers seulement
|
||||||
|
- ❌ Générer moins de 200 tâches
|
||||||
|
|
||||||
|
### TOUJOURS :
|
||||||
|
- ✅ Créer une tâche pour implémenter ce qui manque
|
||||||
|
- ✅ Documenter les deux côtés (frontend + backend) pour chaque gap
|
||||||
|
- ✅ Lier les tâches entre elles (dependencies, related_*)
|
||||||
|
- ✅ Inclure des critères d'acceptation testables
|
||||||
|
- ✅ Estimer les heures de travail
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🚀 Séquence d'Exécution
|
||||||
|
|
||||||
|
```
|
||||||
|
1. SCAN FRONTEND
|
||||||
|
└── Lister tous les fichiers
|
||||||
|
└── Extraire tous les appels API
|
||||||
|
└── Identifier tous les types
|
||||||
|
└── Trouver tous les composants/pages
|
||||||
|
└── Détecter les tests manquants
|
||||||
|
|
||||||
|
2. SCAN BACKEND
|
||||||
|
└── Lister toutes les routes
|
||||||
|
└── Extraire tous les handlers
|
||||||
|
└── Identifier tous les models/DTOs
|
||||||
|
└── Trouver tous les services
|
||||||
|
└── Détecter les tests manquants
|
||||||
|
|
||||||
|
3. ANALYSE D'INTÉGRATION
|
||||||
|
└── Comparer endpoints frontend vs backend
|
||||||
|
└── Comparer types frontend vs DTOs backend
|
||||||
|
└── Identifier TOUS les gaps
|
||||||
|
└── Créer tâches pour chaque gap
|
||||||
|
|
||||||
|
4. SCAN SERVICES ANNEXES
|
||||||
|
└── veza-common
|
||||||
|
└── veza-chat-server
|
||||||
|
└── veza-stream-server
|
||||||
|
└── Autres...
|
||||||
|
|
||||||
|
5. ANALYSE SÉCURITÉ
|
||||||
|
└── Auth/AuthZ gaps
|
||||||
|
└── Input validation
|
||||||
|
└── CORS/CSRF
|
||||||
|
└── Secrets exposure
|
||||||
|
|
||||||
|
6. ANALYSE INFRA
|
||||||
|
└── Docker configs
|
||||||
|
└── Environment vars
|
||||||
|
└── CI/CD gaps
|
||||||
|
|
||||||
|
7. GÉNÉRATION TODOLIST
|
||||||
|
└── Créer toutes les tâches
|
||||||
|
└── Assigner les priorités
|
||||||
|
└── Calculer les estimations
|
||||||
|
└── Organiser en phases
|
||||||
|
└── Générer le JSON final
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📤 Output Attendu
|
||||||
|
|
||||||
|
À la fin de l'audit, tu dois produire :
|
||||||
|
|
||||||
|
1. **`VEZA_COMPLETE_MVP_TODOLIST.json`** — Le fichier JSON avec 200+ tâches
|
||||||
|
2. **Résumé dans la conversation** :
|
||||||
|
```
|
||||||
|
══════════════════════════════════════════════════════
|
||||||
|
📊 AUDIT COMPLET VEZA - RÉSUMÉ
|
||||||
|
══════════════════════════════════════════════════════
|
||||||
|
|
||||||
|
Total tâches générées: XXX
|
||||||
|
|
||||||
|
Par priorité:
|
||||||
|
• P0 (Critical): XX tâches
|
||||||
|
• P1 (High): XX tâches
|
||||||
|
• P2 (Medium): XX tâches
|
||||||
|
• P3 (Low): XX tâches
|
||||||
|
|
||||||
|
Par catégorie:
|
||||||
|
• Backend API: XX
|
||||||
|
• Backend DB: XX
|
||||||
|
• Backend Services: XX
|
||||||
|
• Frontend Pages: XX
|
||||||
|
• Frontend Components: XX
|
||||||
|
• Integration: XX
|
||||||
|
• Security: XX
|
||||||
|
• Tests: XX
|
||||||
|
• Infrastructure: XX
|
||||||
|
• Documentation: XX
|
||||||
|
|
||||||
|
Gaps critiques détectés:
|
||||||
|
• XX endpoints appelés par frontend mais non implémentés
|
||||||
|
• XX routes backend sans utilisation frontend
|
||||||
|
• XX type mismatches
|
||||||
|
|
||||||
|
Estimation totale: XXX heures (~XX semaines)
|
||||||
|
|
||||||
|
Fichier généré: VEZA_COMPLETE_MVP_TODOLIST.json
|
||||||
|
══════════════════════════════════════════════════════
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🎯 COMMENCE MAINTENANT
|
||||||
|
|
||||||
|
1. **Lis la structure du projet** :
|
||||||
|
```bash
|
||||||
|
ls -la
|
||||||
|
find . -type d -name "src" | head -20
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **Scanne le frontend** (apps/web/)
|
||||||
|
|
||||||
|
3. **Scanne le backend** (veza-backend-api/)
|
||||||
|
|
||||||
|
4. **Identifie les gaps d'intégration**
|
||||||
|
|
||||||
|
5. **Génère les 200+ tâches**
|
||||||
|
|
||||||
|
6. **Produis le fichier JSON final**
|
||||||
|
|
||||||
|
**Première action** : Lister la structure racine du projet et identifier tous les répertoires à scanner.
|
||||||
9831
VEZA_COMPLETE_MVP_TODOLIST.json
Normal file
9831
VEZA_COMPLETE_MVP_TODOLIST.json
Normal file
File diff suppressed because it is too large
Load diff
406
VEZA_MVP_INFINITE_AGENT.md
Normal file
406
VEZA_MVP_INFINITE_AGENT.md
Normal file
|
|
@ -0,0 +1,406 @@
|
||||||
|
# VEZA MVP Implementation Agent — Infinite Loop Protocol
|
||||||
|
|
||||||
|
## 🎯 Mission
|
||||||
|
|
||||||
|
Tu es un agent d'implémentation autonome. Ta mission est d'implémenter **toutes les 267 tâches** du fichier `VEZA_COMPLETE_MVP_TODOLIST.json` jusqu'à atteindre un MVP stable prêt pour la production.
|
||||||
|
|
||||||
|
Tu travailles sur une **branche dédiée** et tu **commits après chaque tâche**.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📁 Fichier Source de Vérité
|
||||||
|
|
||||||
|
```
|
||||||
|
VEZA_COMPLETE_MVP_TODOLIST.json ← Todolist complète (267 tâches)
|
||||||
|
```
|
||||||
|
|
||||||
|
Ce fichier DOIT être maintenu à jour après chaque tâche terminée.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🌿 Gestion de Branche Git
|
||||||
|
|
||||||
|
### Au Début de la Première Session
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Vérifier la branche actuelle
|
||||||
|
git branch --show-current
|
||||||
|
|
||||||
|
# Si pas sur la branche MVP, la créer ou y aller
|
||||||
|
git checkout -b feature/mvp-complete 2>/dev/null || git checkout feature/mvp-complete
|
||||||
|
|
||||||
|
# S'assurer d'être à jour
|
||||||
|
git pull origin feature/mvp-complete 2>/dev/null || echo "Nouvelle branche"
|
||||||
|
```
|
||||||
|
|
||||||
|
### Au Début de Chaque Session Suivante
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Revenir sur la branche MVP
|
||||||
|
git checkout feature/mvp-complete
|
||||||
|
|
||||||
|
# Récupérer les derniers changements
|
||||||
|
git pull origin feature/mvp-complete 2>/dev/null || echo "OK"
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🔄 Cycle d'Implémentation (Boucle Infinie)
|
||||||
|
|
||||||
|
```
|
||||||
|
┌─────────────────────────────────────────────────────────────┐
|
||||||
|
│ 1. LOAD & FIND │
|
||||||
|
│ → Lire VEZA_COMPLETE_MVP_TODOLIST.json │
|
||||||
|
│ → Trouver la tâche avec: │
|
||||||
|
│ • status = "todo" │
|
||||||
|
│ • Le plus petit priority_rank │
|
||||||
|
│ → Si toutes complétées → MISSION ACCOMPLIE 🎉 │
|
||||||
|
├─────────────────────────────────────────────────────────────┤
|
||||||
|
│ 2. ANNOUNCE │
|
||||||
|
│ → Afficher: "🚀 [X/267] Tâche ID: TITRE" │
|
||||||
|
│ → Lister les fichiers à modifier │
|
||||||
|
│ → Vérifier les dépendances │
|
||||||
|
├─────────────────────────────────────────────────────────────┤
|
||||||
|
│ 3. IMPLEMENT │
|
||||||
|
│ → Suivre les implementation_steps │
|
||||||
|
│ → Modifier/créer les fichiers listés │
|
||||||
|
│ → Respecter les acceptance_criteria │
|
||||||
|
├─────────────────────────────────────────────────────────────┤
|
||||||
|
│ 4. VALIDATE │
|
||||||
|
│ → Compiler: TypeScript (npx tsc --noEmit) │
|
||||||
|
│ → Compiler: Go (go build ./...) │
|
||||||
|
│ → Vérifier les acceptance_criteria │
|
||||||
|
├─────────────────────────────────────────────────────────────┤
|
||||||
|
│ 5. UPDATE JSON │
|
||||||
|
│ → Mettre status = "completed" │
|
||||||
|
│ → Ajouter bloc "completion" avec détails │
|
||||||
|
│ → Mettre à jour progress_tracking │
|
||||||
|
├─────────────────────────────────────────────────────────────┤
|
||||||
|
│ 6. COMMIT │
|
||||||
|
│ → git add -A │
|
||||||
|
│ → git commit avec message formaté │
|
||||||
|
├─────────────────────────────────────────────────────────────┤
|
||||||
|
│ 7. REPORT & CONTINUE │
|
||||||
|
│ → Afficher le résumé │
|
||||||
|
│ → Retour à l'étape 1 │
|
||||||
|
└─────────────────────────────────────────────────────────────┘
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📋 Format de Mise à Jour du JSON
|
||||||
|
|
||||||
|
### Quand une Tâche est Complétée
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"id": "BE-SEC-001",
|
||||||
|
"status": "completed",
|
||||||
|
"completion": {
|
||||||
|
"completed_at": "2025-01-28T14:30:00Z",
|
||||||
|
"actual_hours": 2.5,
|
||||||
|
"commits": ["abc1234"],
|
||||||
|
"files_changed": [
|
||||||
|
"veza-backend-api/internal/api/router.go",
|
||||||
|
"veza-backend-api/internal/handlers/profile_handler.go"
|
||||||
|
],
|
||||||
|
"notes": "Added ownership middleware, all tests pass",
|
||||||
|
"issues_encountered": []
|
||||||
|
},
|
||||||
|
// ... reste inchangé
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
### Mise à Jour de progress_tracking
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"progress_tracking": {
|
||||||
|
"completed": 1,
|
||||||
|
"in_progress": 0,
|
||||||
|
"todo": 266,
|
||||||
|
"blocked": 0,
|
||||||
|
"last_updated": "2025-01-28T14:30:00Z",
|
||||||
|
"completion_percentage": 0.37
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📝 Format de Commit
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git commit -m "[TASK-ID] CATEGORY: Title
|
||||||
|
|
||||||
|
- Change 1
|
||||||
|
- Change 2
|
||||||
|
- Change 3
|
||||||
|
|
||||||
|
Phase: PHASE-X
|
||||||
|
Priority: PX
|
||||||
|
Progress: Y/267 (Z%)"
|
||||||
|
```
|
||||||
|
|
||||||
|
### Exemples
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git commit -m "[BE-SEC-001] security: Fix ownership verification for user profile updates
|
||||||
|
|
||||||
|
- Added userOwnerResolver function in router.go
|
||||||
|
- Applied RequireOwnershipOrAdmin middleware to PUT /users/:id
|
||||||
|
- Added unit tests for ownership verification
|
||||||
|
|
||||||
|
Phase: PHASE-1
|
||||||
|
Priority: P0
|
||||||
|
Progress: 1/267 (0.4%)"
|
||||||
|
```
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git commit -m "[FE-COMP-015] component: Add loading skeleton for track list
|
||||||
|
|
||||||
|
- Created TrackListSkeleton component
|
||||||
|
- Integrated with useTrackList hook
|
||||||
|
- Added storybook story
|
||||||
|
|
||||||
|
Phase: PHASE-2
|
||||||
|
Priority: P1
|
||||||
|
Progress: 45/267 (16.9%)"
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🚀 Séquence de Démarrage (À Chaque Session)
|
||||||
|
|
||||||
|
```markdown
|
||||||
|
## DÉMARRAGE SESSION
|
||||||
|
|
||||||
|
1. [ ] Vérifier/créer la branche
|
||||||
|
git checkout feature/mvp-complete 2>/dev/null || git checkout -b feature/mvp-complete
|
||||||
|
|
||||||
|
2. [ ] Lire VEZA_COMPLETE_MVP_TODOLIST.json
|
||||||
|
→ Noter progress_tracking.completed
|
||||||
|
→ Calculer: X tâches restantes
|
||||||
|
|
||||||
|
3. [ ] Trouver la prochaine tâche
|
||||||
|
→ status = "todo"
|
||||||
|
→ Plus petit priority_rank
|
||||||
|
|
||||||
|
4. [ ] Annoncer:
|
||||||
|
"📍 Session démarrée
|
||||||
|
Progression: X/267 (Y%)
|
||||||
|
Prochaine tâche: [ID] - [TITLE]
|
||||||
|
Phase: PHASE-Z (Priority: PW)"
|
||||||
|
|
||||||
|
5. [ ] Commencer l'implémentation
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📊 Format de Rapport Après Chaque Tâche
|
||||||
|
|
||||||
|
```
|
||||||
|
═══════════════════════════════════════════════════════════════
|
||||||
|
✅ COMPLÉTÉ: [TASK-ID] — [Title]
|
||||||
|
═══════════════════════════════════════════════════════════════
|
||||||
|
|
||||||
|
Phase: PHASE-X | Priorité: PY | Durée: Zh XXmin
|
||||||
|
|
||||||
|
Fichiers modifiés:
|
||||||
|
✓ path/to/file1.go
|
||||||
|
✓ path/to/file2.ts
|
||||||
|
|
||||||
|
Validation:
|
||||||
|
✓ TypeScript compile
|
||||||
|
✓ Go build OK
|
||||||
|
✓ Critères d'acceptation respectés
|
||||||
|
|
||||||
|
Commit: abc1234
|
||||||
|
|
||||||
|
───────────────────────────────────────────────────────────────
|
||||||
|
📊 PROGRESSION
|
||||||
|
───────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
Complétées: X/267 (Y%)
|
||||||
|
[████████░░░░░░░░░░░░░░░░░░░░░░] Y%
|
||||||
|
|
||||||
|
Par phase:
|
||||||
|
PHASE-1 (P0): X/12
|
||||||
|
PHASE-2 (P1): X/XX
|
||||||
|
PHASE-3 (P1): X/XX
|
||||||
|
...
|
||||||
|
|
||||||
|
Prochaine tâche: [NEXT-ID] — [Next Title]
|
||||||
|
|
||||||
|
═══════════════════════════════════════════════════════════════
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## ⚠️ Gestion des Blocages
|
||||||
|
|
||||||
|
### Si une Dépendance n'est pas Satisfaite
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"id": "TASK-ID",
|
||||||
|
"status": "blocked",
|
||||||
|
"blocked_info": {
|
||||||
|
"blocked_at": "2025-01-28T14:30:00Z",
|
||||||
|
"blocked_by": ["DEPENDENCY-ID"],
|
||||||
|
"reason": "Dependency task not completed"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
→ Passer à la tâche suivante avec priority_rank le plus bas qui n'est pas bloquée.
|
||||||
|
|
||||||
|
### Si l'Implémentation Échoue
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Annuler les changements
|
||||||
|
git checkout -- .
|
||||||
|
|
||||||
|
# Marquer comme bloquée avec raison
|
||||||
|
# Passer à la tâche suivante
|
||||||
|
```
|
||||||
|
|
||||||
|
### Si TypeScript/Go ne Compile Pas
|
||||||
|
|
||||||
|
1. Identifier l'erreur
|
||||||
|
2. Corriger si possible
|
||||||
|
3. Si non corrigeable immédiatement → marquer comme blocked avec la raison
|
||||||
|
4. Passer à la tâche suivante
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🔧 Commandes Utiles
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# === GIT ===
|
||||||
|
git checkout feature/mvp-complete
|
||||||
|
git add -A
|
||||||
|
git commit -m "MESSAGE"
|
||||||
|
git push origin feature/mvp-complete
|
||||||
|
|
||||||
|
# === VALIDATION ===
|
||||||
|
cd apps/web && npx tsc --noEmit
|
||||||
|
cd veza-backend-api && go build ./...
|
||||||
|
cd apps/web && npm test -- --watchAll=false
|
||||||
|
cd veza-backend-api && go test ./...
|
||||||
|
|
||||||
|
# === RECHERCHE ===
|
||||||
|
grep -rn "PATTERN" apps/web/src/
|
||||||
|
grep -rn "PATTERN" veza-backend-api/
|
||||||
|
|
||||||
|
# === STRUCTURE ===
|
||||||
|
find apps/web/src -name "*.ts" -o -name "*.tsx" | head -20
|
||||||
|
find veza-backend-api/internal -name "*.go" | head -20
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🎯 Règles d'Implémentation
|
||||||
|
|
||||||
|
### DO ✅
|
||||||
|
- Suivre exactement les `implementation_steps`
|
||||||
|
- Modifier uniquement les fichiers listés dans `files_involved`
|
||||||
|
- Respecter tous les `acceptance_criteria`
|
||||||
|
- Compiler après chaque modification
|
||||||
|
- Committer après chaque tâche complète
|
||||||
|
- Mettre à jour le JSON immédiatement
|
||||||
|
|
||||||
|
### DON'T ❌
|
||||||
|
- Sauter des étapes d'implémentation
|
||||||
|
- Modifier des fichiers non listés
|
||||||
|
- Ignorer les erreurs de compilation
|
||||||
|
- Oublier de committer
|
||||||
|
- Oublier de mettre à jour le JSON
|
||||||
|
- Changer de branche sans committer
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📈 Milestones
|
||||||
|
|
||||||
|
```
|
||||||
|
PHASE-1 (P0): 12 tâches → Fondation sécurisée
|
||||||
|
PHASE-2 (P1): ~64 tâches → Features core complètes
|
||||||
|
PHASE-3 (P1): ~35 tâches → Intégration parfaite
|
||||||
|
PHASE-4 (P1): 15 tâches → Sécurité renforcée
|
||||||
|
PHASE-5 (P2): ~43 tâches → Tests complets
|
||||||
|
PHASE-6 (P2): ~34 tâches → Services optimisés
|
||||||
|
PHASE-7 (P2): 19 tâches → Docs & DevOps
|
||||||
|
PHASE-8 (P3): ~17 tâches → Polish final
|
||||||
|
|
||||||
|
TOTAL: 267 tâches → MVP Production-Ready 🚀
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🏁 Condition de Fin
|
||||||
|
|
||||||
|
La mission est terminée quand:
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"progress_tracking": {
|
||||||
|
"completed": 267,
|
||||||
|
"in_progress": 0,
|
||||||
|
"todo": 0,
|
||||||
|
"blocked": 0,
|
||||||
|
"completion_percentage": 100
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
À ce moment, afficher:
|
||||||
|
|
||||||
|
```
|
||||||
|
╔═══════════════════════════════════════════════════════════════╗
|
||||||
|
║ ║
|
||||||
|
║ 🎉 MISSION ACCOMPLIE — MVP VEZA STABLE 🎉 ║
|
||||||
|
║ ║
|
||||||
|
║ 267/267 tâches complétées (100%) ║
|
||||||
|
║ ║
|
||||||
|
║ Prochaines étapes: ║
|
||||||
|
║ 1. Merge feature/mvp-complete → main ║
|
||||||
|
║ 2. Tag version v1.0.0-mvp ║
|
||||||
|
║ 3. Déploiement production ║
|
||||||
|
║ ║
|
||||||
|
╚═══════════════════════════════════════════════════════════════╝
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🚀 COMMENCE MAINTENANT
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 1. Créer/checkout la branche
|
||||||
|
git checkout -b feature/mvp-complete 2>/dev/null || git checkout feature/mvp-complete
|
||||||
|
|
||||||
|
# 2. Lire le JSON et trouver la première tâche todo
|
||||||
|
```
|
||||||
|
|
||||||
|
**Première action**:
|
||||||
|
1. Lis `VEZA_COMPLETE_MVP_TODOLIST.json`
|
||||||
|
2. Trouve la tâche avec `status: "todo"` et le plus petit `priority_rank`
|
||||||
|
3. Annonce-la et commence l'implémentation
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 💡 PROMPT ULTRA-COURT (réutilisable)
|
||||||
|
|
||||||
|
Si tu veux relancer l'agent rapidement, utilise ce prompt minimal:
|
||||||
|
|
||||||
|
```
|
||||||
|
Continue l'implémentation du MVP Veza.
|
||||||
|
|
||||||
|
Fichier: @VEZA_COMPLETE_MVP_TODOLIST.json
|
||||||
|
Branche: feature/mvp-complete
|
||||||
|
|
||||||
|
Trouve la prochaine tâche (status: todo, plus petit priority_rank).
|
||||||
|
Implémente-la.
|
||||||
|
Mets à jour le JSON.
|
||||||
|
Commit.
|
||||||
|
Continue.
|
||||||
|
```
|
||||||
674
VEZA_MVP_VALIDATION_TODOLIST.json
Normal file
674
VEZA_MVP_VALIDATION_TODOLIST.json
Normal file
|
|
@ -0,0 +1,674 @@
|
||||||
|
{
|
||||||
|
"meta": {
|
||||||
|
"title": "Veza MVP Validation & Final Audit",
|
||||||
|
"description": "Complete validation of 15 MVP fixes + final audit to reach stable state",
|
||||||
|
"created_at": "2025-01-28T00:00:00Z",
|
||||||
|
"previous_phase": "MVP Stability Fixes (15/15 completed)",
|
||||||
|
"current_phase": "Validation & Final Audit",
|
||||||
|
"target": "Confirmed stable MVP with no regressions",
|
||||||
|
"estimated_effort": "3-5 hours"
|
||||||
|
},
|
||||||
|
"phases": [
|
||||||
|
{
|
||||||
|
"id": "PHASE-V1",
|
||||||
|
"name": "Technical Validation",
|
||||||
|
"description": "Verify all 15 MVP fixes compile and pass tests",
|
||||||
|
"priority": "CRITICAL",
|
||||||
|
"estimated_effort": "30 min",
|
||||||
|
"tasks": [
|
||||||
|
{
|
||||||
|
"id": "VAL-001",
|
||||||
|
"title": "TypeScript Compilation Check",
|
||||||
|
"type": "automated",
|
||||||
|
"status": "todo",
|
||||||
|
"command": "cd apps/web && npx tsc --noEmit",
|
||||||
|
"expected_result": "Exit code 0, no errors",
|
||||||
|
"failure_action": "List all errors, categorize by MVP fix that may have caused them",
|
||||||
|
"related_mvp_fixes": ["MVP-003", "MVP-004", "MVP-010", "MVP-011", "MVP-015"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "VAL-002",
|
||||||
|
"title": "Go Compilation Check",
|
||||||
|
"type": "automated",
|
||||||
|
"status": "todo",
|
||||||
|
"command": "cd veza-backend-api && go build ./...",
|
||||||
|
"expected_result": "Exit code 0, no errors",
|
||||||
|
"failure_action": "List all errors, identify which MVP fix caused them",
|
||||||
|
"related_mvp_fixes": ["MVP-001", "MVP-005", "MVP-009", "MVP-014"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "VAL-003",
|
||||||
|
"title": "Frontend Unit Tests",
|
||||||
|
"type": "automated",
|
||||||
|
"status": "todo",
|
||||||
|
"command": "cd apps/web && npm test -- --passWithNoTests --watchAll=false",
|
||||||
|
"expected_result": "All tests pass",
|
||||||
|
"failure_action": "List failing tests, identify regression source",
|
||||||
|
"related_mvp_fixes": ["MVP-002", "MVP-003", "MVP-004", "MVP-015"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "VAL-004",
|
||||||
|
"title": "Backend Unit Tests",
|
||||||
|
"type": "automated",
|
||||||
|
"status": "todo",
|
||||||
|
"command": "cd veza-backend-api && go test ./... -v",
|
||||||
|
"expected_result": "All tests pass",
|
||||||
|
"failure_action": "List failing tests, identify regression source",
|
||||||
|
"related_mvp_fixes": ["MVP-001", "MVP-009", "MVP-014"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "VAL-005",
|
||||||
|
"title": "CORS Production Validation",
|
||||||
|
"type": "automated",
|
||||||
|
"status": "todo",
|
||||||
|
"command": "cd veza-backend-api && APP_ENV=production CORS_ALLOWED_ORIGINS='' timeout 5 go run ./cmd/api || echo 'Expected failure'",
|
||||||
|
"expected_result": "Server fails to start with clear CORS error message",
|
||||||
|
"failure_action": "MVP-001 fix incomplete - server should not start without CORS in prod",
|
||||||
|
"related_mvp_fixes": ["MVP-001"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "VAL-006",
|
||||||
|
"title": "Legacy Code Removal - ApiService",
|
||||||
|
"type": "automated",
|
||||||
|
"status": "todo",
|
||||||
|
"command": "grep -r 'ApiService' apps/web/src/ || echo 'PASS: No ApiService found'",
|
||||||
|
"expected_result": "0 results (no ApiService references)",
|
||||||
|
"failure_action": "MVP-004 incomplete - remove remaining ApiService references",
|
||||||
|
"related_mvp_fixes": ["MVP-004"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "VAL-007",
|
||||||
|
"title": "Legacy Code Removal - Token Storage Fragmentation",
|
||||||
|
"type": "automated",
|
||||||
|
"status": "todo",
|
||||||
|
"command": "grep -r 'auth-storage' apps/web/src/services/ || echo 'PASS: No auth-storage in services'",
|
||||||
|
"expected_result": "0 results in services directory",
|
||||||
|
"failure_action": "MVP-002 incomplete - remove Zustand token storage fallback",
|
||||||
|
"related_mvp_fixes": ["MVP-002"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "VAL-008",
|
||||||
|
"title": "Environment Variable Consistency",
|
||||||
|
"type": "automated",
|
||||||
|
"status": "todo",
|
||||||
|
"command": "grep -r 'VITE_API_BASE_URL' apps/web/ || echo 'PASS: No VITE_API_BASE_URL found'",
|
||||||
|
"expected_result": "0 results (only VITE_API_URL should be used)",
|
||||||
|
"failure_action": "MVP-006 incomplete - standardize env var names",
|
||||||
|
"related_mvp_fixes": ["MVP-006"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "VAL-009",
|
||||||
|
"title": "User.id Type Consistency",
|
||||||
|
"type": "automated",
|
||||||
|
"status": "todo",
|
||||||
|
"command": "grep -rn 'id:\\s*number' apps/web/src/types/ apps/web/src/features/auth/types/ 2>/dev/null || echo 'PASS: No number id types'",
|
||||||
|
"expected_result": "0 results for User-related id: number",
|
||||||
|
"failure_action": "MVP-003 incomplete - fix remaining number types",
|
||||||
|
"related_mvp_fixes": ["MVP-003"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "VAL-010",
|
||||||
|
"title": "Remember Me Field Consistency",
|
||||||
|
"type": "automated",
|
||||||
|
"status": "todo",
|
||||||
|
"command": "grep -rn 'rememberMe' apps/web/src/ --include='*.ts' --include='*.tsx' | grep -v node_modules || echo 'PASS: No camelCase rememberMe'",
|
||||||
|
"expected_result": "0 results (should be remember_me everywhere)",
|
||||||
|
"failure_action": "MVP-015 incomplete - standardize to snake_case",
|
||||||
|
"related_mvp_fixes": ["MVP-015"]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "PHASE-V2",
|
||||||
|
"name": "Functional E2E Validation",
|
||||||
|
"description": "Manual testing of critical user flows",
|
||||||
|
"priority": "HIGH",
|
||||||
|
"estimated_effort": "1 hour",
|
||||||
|
"tasks": [
|
||||||
|
{
|
||||||
|
"id": "E2E-001",
|
||||||
|
"title": "Authentication Flow - Registration",
|
||||||
|
"type": "manual",
|
||||||
|
"status": "todo",
|
||||||
|
"steps": [
|
||||||
|
"Navigate to /register",
|
||||||
|
"Fill form with valid data (email, username, password)",
|
||||||
|
"Submit form",
|
||||||
|
"Verify redirect to dashboard or confirmation page",
|
||||||
|
"Verify user data in localStorage (TokenStorage)",
|
||||||
|
"Verify no 'auth-storage' key in localStorage"
|
||||||
|
],
|
||||||
|
"expected_result": "User registered, tokens stored via TokenStorage only",
|
||||||
|
"failure_indicators": [
|
||||||
|
"Registration form error",
|
||||||
|
"API 4xx/5xx response",
|
||||||
|
"Tokens not stored",
|
||||||
|
"Multiple storage mechanisms detected"
|
||||||
|
],
|
||||||
|
"related_mvp_fixes": ["MVP-002", "MVP-003"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "E2E-002",
|
||||||
|
"title": "Authentication Flow - Login",
|
||||||
|
"type": "manual",
|
||||||
|
"status": "todo",
|
||||||
|
"steps": [
|
||||||
|
"Logout if logged in",
|
||||||
|
"Navigate to /login",
|
||||||
|
"Enter valid credentials",
|
||||||
|
"Check 'Remember me' checkbox",
|
||||||
|
"Submit form",
|
||||||
|
"Verify login success",
|
||||||
|
"Check localStorage for veza_access_token and veza_refresh_token",
|
||||||
|
"Verify remember_me was sent correctly (check Network tab)"
|
||||||
|
],
|
||||||
|
"expected_result": "Login succeeds, tokens stored, remember_me sent as snake_case",
|
||||||
|
"failure_indicators": [
|
||||||
|
"Login rejected",
|
||||||
|
"Token not stored",
|
||||||
|
"rememberMe sent instead of remember_me"
|
||||||
|
],
|
||||||
|
"related_mvp_fixes": ["MVP-002", "MVP-015"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "E2E-003",
|
||||||
|
"title": "Authentication Flow - Persistence",
|
||||||
|
"type": "manual",
|
||||||
|
"status": "todo",
|
||||||
|
"steps": [
|
||||||
|
"Ensure logged in",
|
||||||
|
"Hard refresh the page (Ctrl+Shift+R / Cmd+Shift+R)",
|
||||||
|
"Verify still logged in",
|
||||||
|
"Open new tab, navigate to app",
|
||||||
|
"Verify logged in in new tab",
|
||||||
|
"Close all tabs, reopen app",
|
||||||
|
"Verify still logged in (if remember_me was checked)"
|
||||||
|
],
|
||||||
|
"expected_result": "Session persists across refresh, tabs, and browser restart",
|
||||||
|
"failure_indicators": [
|
||||||
|
"Logged out after refresh",
|
||||||
|
"Different auth state across tabs",
|
||||||
|
"Token lost"
|
||||||
|
],
|
||||||
|
"related_mvp_fixes": ["MVP-002", "MVP-011"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "E2E-004",
|
||||||
|
"title": "Authentication Flow - Token Refresh",
|
||||||
|
"type": "manual",
|
||||||
|
"status": "todo",
|
||||||
|
"steps": [
|
||||||
|
"Login with short-lived token (or manually expire token in localStorage)",
|
||||||
|
"Make API request (e.g., load profile)",
|
||||||
|
"Check Network tab for refresh token request",
|
||||||
|
"Verify new tokens stored",
|
||||||
|
"Verify original request succeeded after refresh"
|
||||||
|
],
|
||||||
|
"expected_result": "Token auto-refreshes, request succeeds transparently",
|
||||||
|
"failure_indicators": [
|
||||||
|
"401 error shown to user",
|
||||||
|
"Logged out unexpectedly",
|
||||||
|
"Multiple refresh requests (race condition)"
|
||||||
|
],
|
||||||
|
"related_mvp_fixes": ["MVP-002", "MVP-011"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "E2E-005",
|
||||||
|
"title": "Authentication Flow - Logout",
|
||||||
|
"type": "manual",
|
||||||
|
"status": "todo",
|
||||||
|
"steps": [
|
||||||
|
"Ensure logged in",
|
||||||
|
"Click logout",
|
||||||
|
"Verify redirect to login page",
|
||||||
|
"Check localStorage - tokens should be cleared",
|
||||||
|
"Try to access protected route",
|
||||||
|
"Verify redirected to login"
|
||||||
|
],
|
||||||
|
"expected_result": "Clean logout, all tokens cleared, protected routes inaccessible",
|
||||||
|
"failure_indicators": [
|
||||||
|
"Tokens remain in localStorage",
|
||||||
|
"Can still access protected routes",
|
||||||
|
"Partial state remains"
|
||||||
|
],
|
||||||
|
"related_mvp_fixes": ["MVP-002"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "E2E-006",
|
||||||
|
"title": "Profile - View and Edit",
|
||||||
|
"type": "manual",
|
||||||
|
"status": "todo",
|
||||||
|
"steps": [
|
||||||
|
"Navigate to profile page",
|
||||||
|
"Verify all user fields displayed (id, email, username, avatar, etc.)",
|
||||||
|
"Edit a field (e.g., username)",
|
||||||
|
"Save changes",
|
||||||
|
"Refresh page",
|
||||||
|
"Verify changes persisted"
|
||||||
|
],
|
||||||
|
"expected_result": "Profile loads with full user data, edits persist",
|
||||||
|
"failure_indicators": [
|
||||||
|
"Missing fields (only id, email, role)",
|
||||||
|
"404 on profile endpoint",
|
||||||
|
"Edits not saved"
|
||||||
|
],
|
||||||
|
"related_mvp_fixes": ["MVP-007", "MVP-009"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "E2E-007",
|
||||||
|
"title": "API Error Handling - Request ID Correlation",
|
||||||
|
"type": "manual",
|
||||||
|
"status": "todo",
|
||||||
|
"steps": [
|
||||||
|
"Open browser DevTools Console",
|
||||||
|
"Trigger an API error (e.g., invalid request, 404)",
|
||||||
|
"Check console for error log",
|
||||||
|
"Verify request_id is included in log",
|
||||||
|
"Check Network tab for same request_id in response"
|
||||||
|
],
|
||||||
|
"expected_result": "Error logs include request_id matching backend response",
|
||||||
|
"failure_indicators": [
|
||||||
|
"No request_id in console",
|
||||||
|
"request_id mismatch",
|
||||||
|
"Error not logged"
|
||||||
|
],
|
||||||
|
"related_mvp_fixes": ["MVP-013"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "E2E-008",
|
||||||
|
"title": "API Error Handling - Retry Logic",
|
||||||
|
"type": "manual",
|
||||||
|
"status": "todo",
|
||||||
|
"steps": [
|
||||||
|
"If possible: Stop backend temporarily",
|
||||||
|
"Or: Use browser DevTools to throttle/block requests",
|
||||||
|
"Trigger API request",
|
||||||
|
"Check Network tab for retry attempts",
|
||||||
|
"Verify exponential backoff timing (1s, 2s, 4s)",
|
||||||
|
"Restart backend / remove throttle",
|
||||||
|
"Verify request eventually succeeds or fails gracefully after max retries"
|
||||||
|
],
|
||||||
|
"expected_result": "Transient errors (502/503) are retried with backoff",
|
||||||
|
"failure_indicators": [
|
||||||
|
"No retry attempts",
|
||||||
|
"Immediate failure on first error",
|
||||||
|
"No backoff between retries"
|
||||||
|
],
|
||||||
|
"related_mvp_fixes": ["MVP-012"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "E2E-009",
|
||||||
|
"title": "CORS - Cross-Origin Request",
|
||||||
|
"type": "manual",
|
||||||
|
"status": "todo",
|
||||||
|
"steps": [
|
||||||
|
"Run frontend on localhost:3000",
|
||||||
|
"Run backend on localhost:8080",
|
||||||
|
"Make API request from frontend",
|
||||||
|
"Check Network tab for CORS headers",
|
||||||
|
"Verify Access-Control-Allow-Origin matches frontend origin",
|
||||||
|
"Verify Access-Control-Allow-Credentials: true"
|
||||||
|
],
|
||||||
|
"expected_result": "CORS headers present and correct, requests succeed",
|
||||||
|
"failure_indicators": [
|
||||||
|
"CORS error in console",
|
||||||
|
"Missing Access-Control headers",
|
||||||
|
"Preflight (OPTIONS) fails"
|
||||||
|
],
|
||||||
|
"related_mvp_fixes": ["MVP-001", "MVP-014"]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "E2E-010",
|
||||||
|
"title": "Console Error Check",
|
||||||
|
"type": "manual",
|
||||||
|
"status": "todo",
|
||||||
|
"steps": [
|
||||||
|
"Open DevTools Console",
|
||||||
|
"Clear console",
|
||||||
|
"Navigate through: Login → Dashboard → Profile → Tracks → Playlists → Logout",
|
||||||
|
"Note any errors or warnings",
|
||||||
|
"Specifically check for: 404 errors, CORS errors, TypeScript runtime errors"
|
||||||
|
],
|
||||||
|
"expected_result": "No unexpected errors in console during normal navigation",
|
||||||
|
"failure_indicators": [
|
||||||
|
"404 errors (missing endpoints)",
|
||||||
|
"CORS errors",
|
||||||
|
"Uncaught exceptions",
|
||||||
|
"Type errors"
|
||||||
|
],
|
||||||
|
"related_mvp_fixes": ["MVP-008"]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "PHASE-V3",
|
||||||
|
"name": "Remaining Issues Audit",
|
||||||
|
"description": "Review issues INT-000016 to INT-000030 from original audit",
|
||||||
|
"priority": "MEDIUM",
|
||||||
|
"estimated_effort": "1 hour",
|
||||||
|
"tasks": [
|
||||||
|
{
|
||||||
|
"id": "AUDIT-001",
|
||||||
|
"title": "Review P2 Issues (INT-000016 to INT-000023)",
|
||||||
|
"type": "audit",
|
||||||
|
"status": "todo",
|
||||||
|
"issues_to_review": [
|
||||||
|
{
|
||||||
|
"id": "INT-000016",
|
||||||
|
"title": "Field Name Mismatch: cover_art_path vs cover_art_url",
|
||||||
|
"severity": "P2",
|
||||||
|
"check": "Verify if cover_art naming is consistent",
|
||||||
|
"action_if_found": "Add to next sprint backlog"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "INT-000017",
|
||||||
|
"title": "Inconsistent Pagination Response Format",
|
||||||
|
"severity": "P2",
|
||||||
|
"check": "Verify pagination format across list endpoints",
|
||||||
|
"action_if_found": "Document and add to backlog"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "INT-000018",
|
||||||
|
"title": "Missing Rate Limit Feedback to User",
|
||||||
|
"severity": "P2",
|
||||||
|
"check": "Verify 429 responses show user-friendly message",
|
||||||
|
"action_if_found": "Add to backlog"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "INT-000019",
|
||||||
|
"title": "WebSocket Connection Error Handling",
|
||||||
|
"severity": "P2",
|
||||||
|
"check": "Verify chat/real-time features handle disconnects",
|
||||||
|
"action_if_found": "Add to backlog"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "INT-000020",
|
||||||
|
"title": "File Upload Progress Accuracy",
|
||||||
|
"severity": "P2",
|
||||||
|
"check": "Verify upload progress is accurate",
|
||||||
|
"action_if_found": "Add to backlog"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "INT-000021",
|
||||||
|
"title": "Search Debounce Missing",
|
||||||
|
"severity": "P2",
|
||||||
|
"check": "Verify search inputs have debounce",
|
||||||
|
"action_if_found": "Add to backlog"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "INT-000022",
|
||||||
|
"title": "Optimistic UI Updates Not Rolled Back on Error",
|
||||||
|
"severity": "P2",
|
||||||
|
"check": "Verify failed mutations roll back UI state",
|
||||||
|
"action_if_found": "Add to backlog"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "INT-000023",
|
||||||
|
"title": "Date/Time Timezone Handling",
|
||||||
|
"severity": "P2",
|
||||||
|
"check": "Verify dates display in user's timezone",
|
||||||
|
"action_if_found": "Add to backlog"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"output": "List of P2 issues still present with severity assessment"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "AUDIT-002",
|
||||||
|
"title": "Review P3 Issues (INT-000024 to INT-000030)",
|
||||||
|
"type": "audit",
|
||||||
|
"status": "todo",
|
||||||
|
"issues_to_review": [
|
||||||
|
{
|
||||||
|
"id": "INT-000024",
|
||||||
|
"title": "No API Versioning Strategy",
|
||||||
|
"severity": "P3",
|
||||||
|
"check": "Verify /api/v1 is used consistently",
|
||||||
|
"action_if_found": "Document for future"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "INT-000025",
|
||||||
|
"title": "Missing OpenAPI/Swagger Documentation",
|
||||||
|
"severity": "P3",
|
||||||
|
"check": "Check if API docs exist",
|
||||||
|
"action_if_found": "Add to tech debt backlog"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "INT-000026",
|
||||||
|
"title": "Inconsistent Error Message Formatting",
|
||||||
|
"severity": "P3",
|
||||||
|
"check": "Spot check error responses for consistency",
|
||||||
|
"action_if_found": "Add to tech debt"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "INT-000027",
|
||||||
|
"title": "No Rate Limit Headers in Responses",
|
||||||
|
"severity": "P3",
|
||||||
|
"check": "Check for X-RateLimit-* headers",
|
||||||
|
"action_if_found": "Add to tech debt"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "INT-000028",
|
||||||
|
"title": "Missing API Documentation Updates",
|
||||||
|
"severity": "P3",
|
||||||
|
"check": "Verify FRONTEND_INTEGRATION.md is current",
|
||||||
|
"action_if_found": "Update docs"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "INT-000029",
|
||||||
|
"title": "No Vite Proxy Configuration for Development",
|
||||||
|
"severity": "P3",
|
||||||
|
"check": "Verify dev setup works without proxy",
|
||||||
|
"action_if_found": "Optional improvement"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "INT-000030",
|
||||||
|
"title": "Missing HLS Endpoints",
|
||||||
|
"severity": "P3",
|
||||||
|
"check": "Verify HLS features are disabled or stubbed",
|
||||||
|
"action_if_found": "Already handled in MVP-008"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"output": "List of P3 issues with tech debt assessment"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "AUDIT-003",
|
||||||
|
"title": "Regression Detection Scan",
|
||||||
|
"type": "audit",
|
||||||
|
"status": "todo",
|
||||||
|
"checks": [
|
||||||
|
{
|
||||||
|
"name": "New TypeScript Errors",
|
||||||
|
"command": "cd apps/web && npx tsc --noEmit 2>&1 | head -50",
|
||||||
|
"check": "Any errors introduced by MVP fixes?"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "New Console Warnings",
|
||||||
|
"command": "Manual: Check browser console during app usage",
|
||||||
|
"check": "Any new React warnings, deprecation notices?"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "New Go Lint Issues",
|
||||||
|
"command": "cd veza-backend-api && golangci-lint run 2>&1 | head -50",
|
||||||
|
"check": "Any new lint issues from MVP fixes?"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "Dead Code Detection",
|
||||||
|
"command": "grep -r 'TODO.*MVP\\|FIXME.*MVP' apps/web/src/ veza-backend-api/",
|
||||||
|
"check": "Any incomplete TODOs from MVP work?"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "Duplicate Code",
|
||||||
|
"command": "Manual: Review for copy-paste code in MVP fixes",
|
||||||
|
"check": "Any obvious duplication introduced?"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"output": "List of regressions or new issues introduced"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "AUDIT-004",
|
||||||
|
"title": "Security Quick Scan",
|
||||||
|
"type": "audit",
|
||||||
|
"status": "todo",
|
||||||
|
"checks": [
|
||||||
|
{
|
||||||
|
"name": "CSRF Token Implementation",
|
||||||
|
"check": "Is CSRF actually preventing attacks? (was deferred in MVP-005)",
|
||||||
|
"status": "Review if MVP-005 was fully implemented or stubbed"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "Token Storage Security",
|
||||||
|
"check": "Tokens in localStorage are XSS-vulnerable",
|
||||||
|
"status": "Accepted risk for MVP, document for future httpOnly cookie migration"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "CORS Wildcard Check",
|
||||||
|
"check": "No wildcards in production CORS origins",
|
||||||
|
"command": "grep -r 'AllowOrigins.*\\*' veza-backend-api/"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "Sensitive Data in Logs",
|
||||||
|
"check": "Tokens/passwords not logged",
|
||||||
|
"command": "grep -rn 'console.log.*token\\|console.log.*password' apps/web/src/"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"output": "Security assessment with accepted risks documented"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "PHASE-V4",
|
||||||
|
"name": "Final Report Generation",
|
||||||
|
"description": "Generate comprehensive integration health report",
|
||||||
|
"priority": "HIGH",
|
||||||
|
"estimated_effort": "30 min",
|
||||||
|
"tasks": [
|
||||||
|
{
|
||||||
|
"id": "REPORT-001",
|
||||||
|
"title": "Calculate New Health Score",
|
||||||
|
"type": "analysis",
|
||||||
|
"status": "todo",
|
||||||
|
"scoring_criteria": {
|
||||||
|
"compilation": {
|
||||||
|
"weight": 20,
|
||||||
|
"checks": ["TypeScript compiles", "Go compiles"],
|
||||||
|
"score_if_pass": 20,
|
||||||
|
"score_if_fail": 0
|
||||||
|
},
|
||||||
|
"tests": {
|
||||||
|
"weight": 15,
|
||||||
|
"checks": ["Frontend tests pass", "Backend tests pass"],
|
||||||
|
"score_if_pass": 15,
|
||||||
|
"score_if_fail": 0
|
||||||
|
},
|
||||||
|
"auth_flow": {
|
||||||
|
"weight": 20,
|
||||||
|
"checks": ["Login", "Logout", "Token refresh", "Persistence"],
|
||||||
|
"score_if_pass": 20,
|
||||||
|
"score_if_fail": 5
|
||||||
|
},
|
||||||
|
"api_contract": {
|
||||||
|
"weight": 15,
|
||||||
|
"checks": ["No 404s", "Consistent response format", "Type safety"],
|
||||||
|
"score_if_pass": 15,
|
||||||
|
"score_if_fail": 5
|
||||||
|
},
|
||||||
|
"error_handling": {
|
||||||
|
"weight": 10,
|
||||||
|
"checks": ["Retry logic", "Error correlation", "User feedback"],
|
||||||
|
"score_if_pass": 10,
|
||||||
|
"score_if_fail": 3
|
||||||
|
},
|
||||||
|
"security": {
|
||||||
|
"weight": 10,
|
||||||
|
"checks": ["CORS configured", "No wildcards in prod", "CSRF exists"],
|
||||||
|
"score_if_pass": 10,
|
||||||
|
"score_if_fail": 2
|
||||||
|
},
|
||||||
|
"code_quality": {
|
||||||
|
"weight": 10,
|
||||||
|
"checks": ["No legacy code", "Consistent naming", "No dead code"],
|
||||||
|
"score_if_pass": 10,
|
||||||
|
"score_if_fail": 5
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"output": "Health score X/100 (converted to X/10)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "REPORT-002",
|
||||||
|
"title": "Generate Final Integration Report",
|
||||||
|
"type": "documentation",
|
||||||
|
"status": "todo",
|
||||||
|
"sections": [
|
||||||
|
"Executive Summary",
|
||||||
|
"Health Score Breakdown",
|
||||||
|
"MVP Fixes Verification (15/15)",
|
||||||
|
"E2E Test Results",
|
||||||
|
"Remaining Issues (P2/P3)",
|
||||||
|
"Security Assessment",
|
||||||
|
"Regressions Detected",
|
||||||
|
"Recommendations for Next Phase",
|
||||||
|
"Deployment Readiness Checklist"
|
||||||
|
],
|
||||||
|
"output_file": "VEZA_INTEGRATION_FINAL_REPORT.md"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "REPORT-003",
|
||||||
|
"title": "Generate Next Phase Todolist (if needed)",
|
||||||
|
"type": "planning",
|
||||||
|
"status": "todo",
|
||||||
|
"condition": "If health score < 8/10 or critical issues found",
|
||||||
|
"output_file": "VEZA_POST_MVP_TODOLIST.json"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"summary": {
|
||||||
|
"total_tasks": 27,
|
||||||
|
"by_phase": {
|
||||||
|
"PHASE-V1 (Technical)": 10,
|
||||||
|
"PHASE-V2 (E2E)": 10,
|
||||||
|
"PHASE-V3 (Audit)": 4,
|
||||||
|
"PHASE-V4 (Report)": 3
|
||||||
|
},
|
||||||
|
"by_type": {
|
||||||
|
"automated": 10,
|
||||||
|
"manual": 10,
|
||||||
|
"audit": 4,
|
||||||
|
"analysis": 1,
|
||||||
|
"documentation": 1,
|
||||||
|
"planning": 1
|
||||||
|
},
|
||||||
|
"estimated_total_hours": "3-5 hours"
|
||||||
|
},
|
||||||
|
"progress_tracking": {
|
||||||
|
"completed": 0,
|
||||||
|
"in_progress": 0,
|
||||||
|
"todo": 27,
|
||||||
|
"failed": 0,
|
||||||
|
"last_updated": null,
|
||||||
|
"completion_percentage": 0
|
||||||
|
},
|
||||||
|
"validation_results": {
|
||||||
|
"technical": {
|
||||||
|
"typescript_compiles": null,
|
||||||
|
"go_compiles": null,
|
||||||
|
"frontend_tests_pass": null,
|
||||||
|
"backend_tests_pass": null,
|
||||||
|
"legacy_code_removed": null
|
||||||
|
},
|
||||||
|
"functional": {
|
||||||
|
"auth_flow_works": null,
|
||||||
|
"profile_works": null,
|
||||||
|
"error_handling_works": null,
|
||||||
|
"cors_works": null
|
||||||
|
},
|
||||||
|
"audit": {
|
||||||
|
"p2_issues_remaining": null,
|
||||||
|
"p3_issues_remaining": null,
|
||||||
|
"regressions_found": null,
|
||||||
|
"security_issues": null
|
||||||
|
},
|
||||||
|
"final_health_score": null,
|
||||||
|
"mvp_stable": null
|
||||||
|
}
|
||||||
|
}
|
||||||
495
VEZA_VALIDATION_AGENT_PROMPT.md
Normal file
495
VEZA_VALIDATION_AGENT_PROMPT.md
Normal file
|
|
@ -0,0 +1,495 @@
|
||||||
|
# VEZA MVP Validation & Final Audit Agent
|
||||||
|
|
||||||
|
## 🎯 Mission
|
||||||
|
|
||||||
|
Tu es un agent de validation et d'audit. Les 15 tâches MVP ont été implémentées. Ta mission est de :
|
||||||
|
|
||||||
|
1. **VALIDER** que les 15 fixes fonctionnent réellement
|
||||||
|
2. **TESTER** les flows critiques E2E
|
||||||
|
3. **AUDITER** les problèmes restants
|
||||||
|
4. **GÉNÉRER** un rapport final avec score de santé
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📁 Fichiers de Référence
|
||||||
|
|
||||||
|
```
|
||||||
|
VEZA_MVP_VALIDATION_TODOLIST.json ← Source de vérité pour cette phase
|
||||||
|
VEZA_MVP_STABILITY_TODOLIST.json ← Référence des 15 fixes implémentés
|
||||||
|
VEZA_MVP_TODOLIST_TRACKING.md ← Journal des implémentations
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🔄 Cycle d'Exécution
|
||||||
|
|
||||||
|
```
|
||||||
|
┌─────────────────────────────────────────────────────────────┐
|
||||||
|
│ PHASE-V1: VALIDATION TECHNIQUE (10 checks automatiques) │
|
||||||
|
│ → Exécuter chaque commande │
|
||||||
|
│ → Noter PASS/FAIL │
|
||||||
|
│ → Si FAIL: identifier la cause et documenter │
|
||||||
|
├─────────────────────────────────────────────────────────────┤
|
||||||
|
│ PHASE-V2: TESTS E2E (10 tests manuels) │
|
||||||
|
│ → Guider l'utilisateur à travers chaque test │
|
||||||
|
│ → Collecter les résultats │
|
||||||
|
│ → Documenter les échecs │
|
||||||
|
├─────────────────────────────────────────────────────────────┤
|
||||||
|
│ PHASE-V3: AUDIT DES ISSUES RESTANTES │
|
||||||
|
│ → Vérifier INT-000016 à INT-000030 │
|
||||||
|
│ → Détecter les régressions │
|
||||||
|
│ → Scan de sécurité │
|
||||||
|
├─────────────────────────────────────────────────────────────┤
|
||||||
|
│ PHASE-V4: RAPPORT FINAL │
|
||||||
|
│ → Calculer le score de santé │
|
||||||
|
│ → Générer VEZA_INTEGRATION_FINAL_REPORT.md │
|
||||||
|
│ → Décider si MVP est stable │
|
||||||
|
└─────────────────────────────────────────────────────────────┘
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📋 PHASE-V1 : Validation Technique
|
||||||
|
|
||||||
|
Exécute ces 10 commandes et enregistre les résultats :
|
||||||
|
|
||||||
|
### VAL-001: TypeScript Compilation
|
||||||
|
```bash
|
||||||
|
cd apps/web && npx tsc --noEmit
|
||||||
|
```
|
||||||
|
**Attendu**: Exit 0, aucune erreur
|
||||||
|
**Si échec**: Lister les erreurs, identifier le MVP fix responsable
|
||||||
|
|
||||||
|
### VAL-002: Go Compilation
|
||||||
|
```bash
|
||||||
|
cd veza-backend-api && go build ./...
|
||||||
|
```
|
||||||
|
**Attendu**: Exit 0, aucune erreur
|
||||||
|
**Si échec**: Lister les erreurs, identifier le MVP fix responsable
|
||||||
|
|
||||||
|
### VAL-003: Frontend Tests
|
||||||
|
```bash
|
||||||
|
cd apps/web && npm test -- --passWithNoTests --watchAll=false
|
||||||
|
```
|
||||||
|
**Attendu**: Tous les tests passent
|
||||||
|
**Si échec**: Noter les tests qui échouent
|
||||||
|
|
||||||
|
### VAL-004: Backend Tests
|
||||||
|
```bash
|
||||||
|
cd veza-backend-api && go test ./... -v
|
||||||
|
```
|
||||||
|
**Attendu**: Tous les tests passent
|
||||||
|
**Si échec**: Noter les tests qui échouent
|
||||||
|
|
||||||
|
### VAL-005: CORS Production Check
|
||||||
|
```bash
|
||||||
|
cd veza-backend-api && APP_ENV=production CORS_ALLOWED_ORIGINS='' timeout 5 go run ./cmd/api 2>&1 || echo "Expected failure - check output above"
|
||||||
|
```
|
||||||
|
**Attendu**: Serveur refuse de démarrer avec message d'erreur CORS clair
|
||||||
|
**Si échec**: MVP-001 incomplet
|
||||||
|
|
||||||
|
### VAL-006: ApiService Removed
|
||||||
|
```bash
|
||||||
|
grep -r 'ApiService' apps/web/src/ 2>/dev/null || echo "PASS: No ApiService found"
|
||||||
|
```
|
||||||
|
**Attendu**: 0 résultats
|
||||||
|
**Si échec**: MVP-004 incomplet, lister les fichiers
|
||||||
|
|
||||||
|
### VAL-007: Token Storage Unified
|
||||||
|
```bash
|
||||||
|
grep -r 'auth-storage' apps/web/src/services/ 2>/dev/null || echo "PASS: No auth-storage in services"
|
||||||
|
```
|
||||||
|
**Attendu**: 0 résultats dans services/
|
||||||
|
**Si échec**: MVP-002 incomplet
|
||||||
|
|
||||||
|
### VAL-008: Env Vars Standardized
|
||||||
|
```bash
|
||||||
|
grep -r 'VITE_API_BASE_URL' apps/web/ 2>/dev/null || echo "PASS: No VITE_API_BASE_URL"
|
||||||
|
```
|
||||||
|
**Attendu**: 0 résultats
|
||||||
|
**Si échec**: MVP-006 incomplet
|
||||||
|
|
||||||
|
### VAL-009: User.id Type Fixed
|
||||||
|
```bash
|
||||||
|
grep -rn 'id:\s*number' apps/web/src/types/ apps/web/src/features/auth/types/ 2>/dev/null || echo "PASS: No number id types"
|
||||||
|
```
|
||||||
|
**Attendu**: 0 résultats pour User id
|
||||||
|
**Si échec**: MVP-003 incomplet
|
||||||
|
|
||||||
|
### VAL-010: remember_me Standardized
|
||||||
|
```bash
|
||||||
|
grep -rn 'rememberMe' apps/web/src/ --include='*.ts' --include='*.tsx' 2>/dev/null | grep -v node_modules || echo "PASS: No camelCase rememberMe"
|
||||||
|
```
|
||||||
|
**Attendu**: 0 résultats
|
||||||
|
**Si échec**: MVP-015 incomplet
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📋 PHASE-V2 : Tests E2E
|
||||||
|
|
||||||
|
Guide l'utilisateur à travers ces tests. Demande confirmation après chaque test.
|
||||||
|
|
||||||
|
### E2E-001: Registration Flow
|
||||||
|
```
|
||||||
|
Instructions pour l'utilisateur:
|
||||||
|
1. Navigue vers /register
|
||||||
|
2. Remplis le formulaire (email, username, password)
|
||||||
|
3. Soumets
|
||||||
|
4. Vérifie la redirection
|
||||||
|
5. Ouvre DevTools > Application > localStorage
|
||||||
|
6. Vérifie que veza_access_token existe
|
||||||
|
7. Vérifie qu'il n'y a PAS de clé 'auth-storage'
|
||||||
|
|
||||||
|
Questions à poser:
|
||||||
|
- Registration réussie? (oui/non)
|
||||||
|
- Tokens dans localStorage? (oui/non)
|
||||||
|
- Clé 'auth-storage' absente? (oui/non)
|
||||||
|
```
|
||||||
|
|
||||||
|
### E2E-002: Login Flow
|
||||||
|
```
|
||||||
|
Instructions:
|
||||||
|
1. Déconnecte-toi si connecté
|
||||||
|
2. Va sur /login
|
||||||
|
3. Entre des credentials valides
|
||||||
|
4. Coche "Remember me"
|
||||||
|
5. Soumets
|
||||||
|
6. Ouvre DevTools > Network
|
||||||
|
7. Trouve la requête POST /auth/login
|
||||||
|
8. Vérifie le body: remember_me (snake_case) et non rememberMe
|
||||||
|
|
||||||
|
Questions:
|
||||||
|
- Login réussi? (oui/non)
|
||||||
|
- remember_me envoyé en snake_case? (oui/non)
|
||||||
|
```
|
||||||
|
|
||||||
|
### E2E-003: Session Persistence
|
||||||
|
```
|
||||||
|
Instructions:
|
||||||
|
1. Assure-toi d'être connecté
|
||||||
|
2. Fais un hard refresh (Ctrl+Shift+R)
|
||||||
|
3. Es-tu toujours connecté?
|
||||||
|
4. Ouvre un nouvel onglet sur l'app
|
||||||
|
5. Es-tu connecté dans le nouvel onglet?
|
||||||
|
|
||||||
|
Questions:
|
||||||
|
- Session persiste après refresh? (oui/non)
|
||||||
|
- Session partagée entre onglets? (oui/non)
|
||||||
|
```
|
||||||
|
|
||||||
|
### E2E-004: Token Refresh
|
||||||
|
```
|
||||||
|
Instructions:
|
||||||
|
1. Connecte-toi
|
||||||
|
2. Dans DevTools > Application > localStorage
|
||||||
|
3. Modifie veza_access_token (ajoute des caractères pour l'invalider)
|
||||||
|
4. Fais une action qui appelle l'API (ex: charger le profil)
|
||||||
|
5. Observe Network tab
|
||||||
|
6. Y a-t-il une requête vers /auth/refresh?
|
||||||
|
7. Le token a-t-il été renouvelé dans localStorage?
|
||||||
|
|
||||||
|
Questions:
|
||||||
|
- Token refresh automatique? (oui/non)
|
||||||
|
- Nouveaux tokens stockés? (oui/non)
|
||||||
|
```
|
||||||
|
|
||||||
|
### E2E-005: Logout Flow
|
||||||
|
```
|
||||||
|
Instructions:
|
||||||
|
1. Assure-toi d'être connecté
|
||||||
|
2. Clique sur Logout
|
||||||
|
3. Vérifie la redirection vers /login
|
||||||
|
4. Vérifie localStorage - tokens effacés?
|
||||||
|
5. Essaie d'accéder à une route protégée
|
||||||
|
6. Es-tu redirigé vers login?
|
||||||
|
|
||||||
|
Questions:
|
||||||
|
- Logout réussi? (oui/non)
|
||||||
|
- Tokens effacés de localStorage? (oui/non)
|
||||||
|
- Routes protégées inaccessibles? (oui/non)
|
||||||
|
```
|
||||||
|
|
||||||
|
### E2E-006: Profile View/Edit
|
||||||
|
```
|
||||||
|
Instructions:
|
||||||
|
1. Va sur la page profil
|
||||||
|
2. Tous les champs sont-ils affichés? (id, email, username, avatar, etc.)
|
||||||
|
3. Modifie un champ (ex: username)
|
||||||
|
4. Sauvegarde
|
||||||
|
5. Refresh la page
|
||||||
|
6. Le changement est-il persisté?
|
||||||
|
|
||||||
|
Questions:
|
||||||
|
- Tous les champs user affichés? (oui/non)
|
||||||
|
- Modifications sauvegardées? (oui/non)
|
||||||
|
```
|
||||||
|
|
||||||
|
### E2E-007: Error Request ID
|
||||||
|
```
|
||||||
|
Instructions:
|
||||||
|
1. Ouvre DevTools > Console
|
||||||
|
2. Provoque une erreur API (ex: accède à une ressource inexistante)
|
||||||
|
3. Regarde le log d'erreur dans la console
|
||||||
|
4. Contient-il un request_id?
|
||||||
|
5. Vérifie dans Network si le même request_id est dans la réponse
|
||||||
|
|
||||||
|
Questions:
|
||||||
|
- request_id présent dans les logs? (oui/non)
|
||||||
|
- request_id correspond à la réponse backend? (oui/non)
|
||||||
|
```
|
||||||
|
|
||||||
|
### E2E-008: Retry Logic (si testable)
|
||||||
|
```
|
||||||
|
Instructions:
|
||||||
|
1. Si possible: arrête le backend temporairement
|
||||||
|
2. Ou: utilise DevTools > Network > Throttling > Offline
|
||||||
|
3. Déclenche une requête API
|
||||||
|
4. Observe Network - y a-t-il des retry?
|
||||||
|
5. Remets la connexion
|
||||||
|
6. La requête finit-elle par réussir?
|
||||||
|
|
||||||
|
Questions:
|
||||||
|
- Retry automatique observé? (oui/non/non testable)
|
||||||
|
- Backoff exponentiel? (oui/non/non testable)
|
||||||
|
```
|
||||||
|
|
||||||
|
### E2E-009: CORS Headers
|
||||||
|
```
|
||||||
|
Instructions:
|
||||||
|
1. Frontend sur localhost:3000, Backend sur localhost:8080
|
||||||
|
2. Fais une requête API
|
||||||
|
3. Ouvre Network > trouve la requête
|
||||||
|
4. Regarde les Response Headers
|
||||||
|
5. Access-Control-Allow-Origin présent?
|
||||||
|
6. Access-Control-Allow-Credentials: true?
|
||||||
|
|
||||||
|
Questions:
|
||||||
|
- Headers CORS présents? (oui/non)
|
||||||
|
- Pas d'erreur CORS dans console? (oui/non)
|
||||||
|
```
|
||||||
|
|
||||||
|
### E2E-010: Console Error Scan
|
||||||
|
```
|
||||||
|
Instructions:
|
||||||
|
1. Ouvre DevTools > Console
|
||||||
|
2. Clear console
|
||||||
|
3. Navigue: Login → Dashboard → Profile → Tracks → Playlists → Logout
|
||||||
|
4. Note toutes les erreurs/warnings
|
||||||
|
|
||||||
|
Questions:
|
||||||
|
- Erreurs 404? (oui/non, lesquelles?)
|
||||||
|
- Erreurs CORS? (oui/non)
|
||||||
|
- Exceptions JavaScript? (oui/non, lesquelles?)
|
||||||
|
- Warnings React? (oui/non, lesquels?)
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📋 PHASE-V3 : Audit Issues Restantes
|
||||||
|
|
||||||
|
### Vérifier les issues P2 (INT-000016 à INT-000023)
|
||||||
|
|
||||||
|
Pour chaque issue, vérifie si elle existe encore et note la sévérité actuelle:
|
||||||
|
|
||||||
|
| ID | Issue | Commande/Check | Statut |
|
||||||
|
|----|-------|----------------|--------|
|
||||||
|
| INT-000016 | cover_art_path vs cover_art_url | `grep -rn 'cover_art' apps/web/src/types/` | |
|
||||||
|
| INT-000017 | Pagination inconsistante | Spot check des endpoints de liste | |
|
||||||
|
| INT-000018 | Rate limit feedback | Vérifier gestion du 429 | |
|
||||||
|
| INT-000019 | WebSocket error handling | Si chat existe, tester déconnexion | |
|
||||||
|
| INT-000020 | Upload progress accuracy | Tester upload de fichier | |
|
||||||
|
| INT-000021 | Search debounce | Tester champs de recherche | |
|
||||||
|
| INT-000022 | Optimistic UI rollback | Tester échec de mutation | |
|
||||||
|
| INT-000023 | Timezone handling | Vérifier affichage des dates | |
|
||||||
|
|
||||||
|
### Vérifier les issues P3 (INT-000024 à INT-000030)
|
||||||
|
|
||||||
|
| ID | Issue | Statut |
|
||||||
|
|----|-------|--------|
|
||||||
|
| INT-000024 | API versioning | /api/v1 utilisé partout? |
|
||||||
|
| INT-000025 | OpenAPI docs | Swagger existe? |
|
||||||
|
| INT-000026 | Error message format | Cohérent? |
|
||||||
|
| INT-000027 | Rate limit headers | X-RateLimit-* présents? |
|
||||||
|
| INT-000028 | API docs à jour | FRONTEND_INTEGRATION.md actuel? |
|
||||||
|
| INT-000029 | Vite proxy | Fonctionne sans? |
|
||||||
|
| INT-000030 | HLS endpoints | Désactivés dans MVP-008? |
|
||||||
|
|
||||||
|
### Détection de Régressions
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# TODOs/FIXMEs liés au MVP
|
||||||
|
grep -rn 'TODO.*MVP\|FIXME.*MVP' apps/web/src/ veza-backend-api/
|
||||||
|
|
||||||
|
# Code mort potentiel
|
||||||
|
grep -rn 'ApiService\|apiService' apps/web/src/
|
||||||
|
|
||||||
|
# Sensitive data in logs
|
||||||
|
grep -rn 'console.log.*token\|console.log.*password' apps/web/src/
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📋 PHASE-V4 : Rapport Final
|
||||||
|
|
||||||
|
### Calcul du Score de Santé
|
||||||
|
|
||||||
|
```
|
||||||
|
SCORING (sur 100 points, converti en /10):
|
||||||
|
|
||||||
|
Compilation (20 pts)
|
||||||
|
├── TypeScript compile: 10 pts
|
||||||
|
└── Go compile: 10 pts
|
||||||
|
|
||||||
|
Tests (15 pts)
|
||||||
|
├── Frontend tests pass: 7 pts
|
||||||
|
└── Backend tests pass: 8 pts
|
||||||
|
|
||||||
|
Auth Flow (20 pts)
|
||||||
|
├── Login works: 5 pts
|
||||||
|
├── Logout works: 5 pts
|
||||||
|
├── Token refresh works: 5 pts
|
||||||
|
└── Session persists: 5 pts
|
||||||
|
|
||||||
|
API Contract (15 pts)
|
||||||
|
├── No 404 errors: 5 pts
|
||||||
|
├── Consistent format: 5 pts
|
||||||
|
└── Type safety: 5 pts
|
||||||
|
|
||||||
|
Error Handling (10 pts)
|
||||||
|
├── Retry logic: 4 pts
|
||||||
|
├── Error correlation: 3 pts
|
||||||
|
└── User feedback: 3 pts
|
||||||
|
|
||||||
|
Security (10 pts)
|
||||||
|
├── CORS configured: 4 pts
|
||||||
|
├── No wildcards prod: 3 pts
|
||||||
|
└── CSRF exists: 3 pts
|
||||||
|
|
||||||
|
Code Quality (10 pts)
|
||||||
|
├── No legacy code: 4 pts
|
||||||
|
├── Consistent naming: 3 pts
|
||||||
|
└── No dead code: 3 pts
|
||||||
|
|
||||||
|
TOTAL: ___ / 100 = ___ / 10
|
||||||
|
```
|
||||||
|
|
||||||
|
### Template du Rapport Final
|
||||||
|
|
||||||
|
Génère ce fichier: `VEZA_INTEGRATION_FINAL_REPORT.md`
|
||||||
|
|
||||||
|
```markdown
|
||||||
|
# Veza Integration Final Report
|
||||||
|
|
||||||
|
**Date**: [DATE]
|
||||||
|
**Auditeur**: [Agent]
|
||||||
|
**Phase précédente**: MVP Stability Fixes (15/15)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Executive Summary
|
||||||
|
|
||||||
|
**Health Score**: X/10 (était 4/10 avant MVP fixes)
|
||||||
|
**MVP Stable**: OUI/NON
|
||||||
|
**Prêt pour Production**: OUI/NON/AVEC RÉSERVES
|
||||||
|
|
||||||
|
[Résumé en 3-4 phrases]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## MVP Fixes Verification
|
||||||
|
|
||||||
|
| ID | Fix | Validation | Statut |
|
||||||
|
|----|-----|------------|--------|
|
||||||
|
| MVP-001 | CORS Config | VAL-005 | ✅/❌ |
|
||||||
|
| MVP-002 | Token Storage | VAL-007 | ✅/❌ |
|
||||||
|
| ... | ... | ... | ... |
|
||||||
|
|
||||||
|
**Résultat**: X/15 fixes vérifiés fonctionnels
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## E2E Test Results
|
||||||
|
|
||||||
|
| Test | Résultat | Notes |
|
||||||
|
|------|----------|-------|
|
||||||
|
| E2E-001 Registration | ✅/❌ | |
|
||||||
|
| E2E-002 Login | ✅/❌ | |
|
||||||
|
| ... | ... | ... |
|
||||||
|
|
||||||
|
**Résultat**: X/10 tests passent
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Issues Restantes
|
||||||
|
|
||||||
|
### P2 (Medium - à traiter prochainement)
|
||||||
|
- [ ] INT-000016: ...
|
||||||
|
- [ ] INT-000017: ...
|
||||||
|
|
||||||
|
### P3 (Low - tech debt)
|
||||||
|
- [ ] INT-000024: ...
|
||||||
|
- [ ] INT-000025: ...
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Régressions Détectées
|
||||||
|
|
||||||
|
[Liste des régressions trouvées, ou "Aucune régression détectée"]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Security Assessment
|
||||||
|
|
||||||
|
| Check | Statut | Risque Accepté? |
|
||||||
|
|-------|--------|-----------------|
|
||||||
|
| CORS configuré | ✅/❌ | |
|
||||||
|
| Pas de wildcards | ✅/❌ | |
|
||||||
|
| CSRF implémenté | ✅/❌ | |
|
||||||
|
| Tokens en localStorage | ⚠️ | Oui (MVP) |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Recommandations
|
||||||
|
|
||||||
|
### Immédiat (avant déploiement)
|
||||||
|
1. ...
|
||||||
|
2. ...
|
||||||
|
|
||||||
|
### Court terme (sprint suivant)
|
||||||
|
1. ...
|
||||||
|
2. ...
|
||||||
|
|
||||||
|
### Moyen terme (backlog)
|
||||||
|
1. ...
|
||||||
|
2. ...
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Deployment Readiness Checklist
|
||||||
|
|
||||||
|
- [ ] Tous les tests passent
|
||||||
|
- [ ] CORS_ALLOWED_ORIGINS configuré pour prod
|
||||||
|
- [ ] Variables d'environnement documentées
|
||||||
|
- [ ] Pas de secrets dans le code
|
||||||
|
- [ ] Docker build fonctionne
|
||||||
|
- [ ] Rollback plan en place
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Conclusion
|
||||||
|
|
||||||
|
[Score final, décision MVP stable ou non, prochaines étapes]
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🚀 COMMENCE
|
||||||
|
|
||||||
|
1. Lis `VEZA_MVP_VALIDATION_TODOLIST.json`
|
||||||
|
2. Annonce: "🔍 Démarrage de la validation MVP Veza"
|
||||||
|
3. Exécute PHASE-V1 (commandes automatiques)
|
||||||
|
4. Guide l'utilisateur pour PHASE-V2 (tests manuels)
|
||||||
|
5. Effectue PHASE-V3 (audit)
|
||||||
|
6. Génère PHASE-V4 (rapport final)
|
||||||
|
|
||||||
|
**Première action**: Exécuter VAL-001 (TypeScript compilation)
|
||||||
|
|
@ -108,3 +108,4 @@ export default globalSetup;
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,266 @@
|
||||||
|
//go:build integration
|
||||||
|
// +build integration
|
||||||
|
|
||||||
|
package handlers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"encoding/json"
|
||||||
|
"net/http"
|
||||||
|
"net/http/httptest"
|
||||||
|
"testing"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"veza-backend-api/internal/models"
|
||||||
|
"veza-backend-api/internal/repositories"
|
||||||
|
"veza-backend-api/internal/services"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
"github.com/google/uuid"
|
||||||
|
"github.com/stretchr/testify/assert"
|
||||||
|
"github.com/stretchr/testify/require"
|
||||||
|
"go.uber.org/zap"
|
||||||
|
"gorm.io/driver/sqlite"
|
||||||
|
"gorm.io/gorm"
|
||||||
|
)
|
||||||
|
|
||||||
|
// setupProfileIntegrationTestRouter crée un router de test pour les tests de profile
|
||||||
|
// BE-SEC-001: Tests d'intégration pour vérification ownership
|
||||||
|
func setupProfileIntegrationTestRouter(t *testing.T) (*gin.Engine, *gorm.DB, func()) {
|
||||||
|
gin.SetMode(gin.TestMode)
|
||||||
|
|
||||||
|
// Setup in-memory SQLite database
|
||||||
|
db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
// Enable foreign keys for SQLite
|
||||||
|
db.Exec("PRAGMA foreign_keys = ON")
|
||||||
|
|
||||||
|
// Auto-migrate - include all models needed for PermissionService
|
||||||
|
err = db.AutoMigrate(
|
||||||
|
&models.User{},
|
||||||
|
&models.Role{},
|
||||||
|
&models.Permission{},
|
||||||
|
&models.UserRole{},
|
||||||
|
&models.RolePermission{},
|
||||||
|
)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
// Setup logger
|
||||||
|
logger := zap.NewNop()
|
||||||
|
|
||||||
|
// Setup services
|
||||||
|
userRepo := repositories.NewGormUserRepository(db)
|
||||||
|
userService := services.NewUserServiceWithDB(userRepo, db)
|
||||||
|
profileHandler := NewProfileHandler(userService, logger)
|
||||||
|
|
||||||
|
// Setup PermissionService for admin checks
|
||||||
|
permissionService := services.NewPermissionService(db)
|
||||||
|
profileHandler.SetPermissionService(permissionService)
|
||||||
|
|
||||||
|
// Create router
|
||||||
|
router := gin.New()
|
||||||
|
v1 := router.Group("/api/v1")
|
||||||
|
{
|
||||||
|
// Protected routes with mock auth middleware
|
||||||
|
protected := v1.Group("/users")
|
||||||
|
protected.Use(func(c *gin.Context) {
|
||||||
|
// Mock auth middleware - set user_id from header
|
||||||
|
// This simulates RequireAuth() middleware
|
||||||
|
userIDStr := c.GetHeader("X-User-ID")
|
||||||
|
if userIDStr == "" {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
||||||
|
c.Abort()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
uid, err := uuid.Parse(userIDStr)
|
||||||
|
if err != nil {
|
||||||
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid user id"})
|
||||||
|
c.Abort()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
c.Set("user_id", uid)
|
||||||
|
c.Next()
|
||||||
|
})
|
||||||
|
{
|
||||||
|
// Note: In real router, RequireOwnershipOrAdmin middleware would be here
|
||||||
|
// For this test, we're testing the handler's ownership check directly
|
||||||
|
protected.PUT("/:id", profileHandler.UpdateProfile)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
cleanup := func() {
|
||||||
|
// Database will be closed automatically
|
||||||
|
}
|
||||||
|
|
||||||
|
return router, db, cleanup
|
||||||
|
}
|
||||||
|
|
||||||
|
// createTestUser crée un utilisateur de test
|
||||||
|
func createTestUserForProfile(t *testing.T, db *gorm.DB, userID uuid.UUID, username string, isAdmin bool) *models.User {
|
||||||
|
user := &models.User{
|
||||||
|
ID: userID,
|
||||||
|
Username: username,
|
||||||
|
Slug: username,
|
||||||
|
Email: username + "@example.com",
|
||||||
|
PasswordHash: "hashed_password",
|
||||||
|
IsActive: true,
|
||||||
|
CreatedAt: time.Now(),
|
||||||
|
}
|
||||||
|
if isAdmin {
|
||||||
|
user.Role = "admin"
|
||||||
|
user.IsAdmin = true
|
||||||
|
} else {
|
||||||
|
user.Role = "user"
|
||||||
|
}
|
||||||
|
// Create user first
|
||||||
|
err := db.Create(user).Error
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
// Then create admin role and assign it if admin
|
||||||
|
if isAdmin {
|
||||||
|
// Create admin role and assign it to user
|
||||||
|
adminRole := &models.Role{
|
||||||
|
Name: "admin",
|
||||||
|
DisplayName: "Administrator",
|
||||||
|
IsSystem: true,
|
||||||
|
IsActive: true,
|
||||||
|
}
|
||||||
|
err = db.FirstOrCreate(adminRole, models.Role{Name: "admin"}).Error
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
userRole := &models.UserRole{
|
||||||
|
UserID: userID,
|
||||||
|
RoleID: adminRole.ID,
|
||||||
|
RoleName: "admin",
|
||||||
|
IsActive: true,
|
||||||
|
}
|
||||||
|
err = db.Create(userRole).Error
|
||||||
|
require.NoError(t, err)
|
||||||
|
}
|
||||||
|
return user
|
||||||
|
}
|
||||||
|
|
||||||
|
// BE-SEC-001: Test that user cannot update another user's profile
|
||||||
|
func TestUpdateProfile_UserCannotUpdateOtherUserProfile(t *testing.T) {
|
||||||
|
if testing.Short() {
|
||||||
|
t.Skip("Skipping integration test in short mode")
|
||||||
|
}
|
||||||
|
|
||||||
|
router, db, cleanup := setupProfileIntegrationTestRouter(t)
|
||||||
|
defer cleanup()
|
||||||
|
|
||||||
|
// Create two users
|
||||||
|
ownerID := uuid.New()
|
||||||
|
otherUserID := uuid.New()
|
||||||
|
createTestUserForProfile(t, db, ownerID, "owner", false)
|
||||||
|
createTestUserForProfile(t, db, otherUserID, "otheruser", false)
|
||||||
|
|
||||||
|
// Try to update owner's profile as otherUser
|
||||||
|
updateReq := UpdateProfileRequest{
|
||||||
|
FirstName: "Hacked",
|
||||||
|
Bio: "I shouldn't be able to do this",
|
||||||
|
}
|
||||||
|
body, _ := json.Marshal(updateReq)
|
||||||
|
|
||||||
|
req := httptest.NewRequest(http.MethodPut, "/api/v1/users/"+ownerID.String(), bytes.NewBuffer(body))
|
||||||
|
req.Header.Set("Content-Type", "application/json")
|
||||||
|
req.Header.Set("X-User-ID", otherUserID.String()) // otherUser is authenticated
|
||||||
|
|
||||||
|
w := httptest.NewRecorder()
|
||||||
|
router.ServeHTTP(w, req)
|
||||||
|
|
||||||
|
// Should return 403 Forbidden
|
||||||
|
assert.Equal(t, http.StatusForbidden, w.Code)
|
||||||
|
|
||||||
|
var response map[string]interface{}
|
||||||
|
err := json.Unmarshal(w.Body.Bytes(), &response)
|
||||||
|
assert.NoError(t, err)
|
||||||
|
// Error can be a string or a map, check both
|
||||||
|
if errorStr, ok := response["error"].(string); ok {
|
||||||
|
assert.Contains(t, errorStr, "cannot update other user's profile")
|
||||||
|
} else if errorMap, ok := response["error"].(map[string]interface{}); ok {
|
||||||
|
if message, ok := errorMap["message"].(string); ok {
|
||||||
|
assert.Contains(t, message, "cannot update other user's profile")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// BE-SEC-001: Test that admin can update any profile
|
||||||
|
func TestUpdateProfile_AdminCanUpdateAnyProfile(t *testing.T) {
|
||||||
|
if testing.Short() {
|
||||||
|
t.Skip("Skipping integration test in short mode")
|
||||||
|
}
|
||||||
|
|
||||||
|
router, db, cleanup := setupProfileIntegrationTestRouter(t)
|
||||||
|
defer cleanup()
|
||||||
|
|
||||||
|
// Create two users: owner and admin
|
||||||
|
ownerID := uuid.New()
|
||||||
|
adminID := uuid.New()
|
||||||
|
createTestUserForProfile(t, db, ownerID, "owner", false)
|
||||||
|
createTestUserForProfile(t, db, adminID, "admin", true)
|
||||||
|
|
||||||
|
// Admin tries to update owner's profile
|
||||||
|
updateReq := UpdateProfileRequest{
|
||||||
|
FirstName: "Updated by Admin",
|
||||||
|
Bio: "Admin updated this profile",
|
||||||
|
}
|
||||||
|
body, _ := json.Marshal(updateReq)
|
||||||
|
|
||||||
|
req := httptest.NewRequest(http.MethodPut, "/api/v1/users/"+ownerID.String(), bytes.NewBuffer(body))
|
||||||
|
req.Header.Set("Content-Type", "application/json")
|
||||||
|
req.Header.Set("X-User-ID", adminID.String()) // admin is authenticated
|
||||||
|
|
||||||
|
w := httptest.NewRecorder()
|
||||||
|
router.ServeHTTP(w, req)
|
||||||
|
|
||||||
|
// Admin should be able to update
|
||||||
|
assert.Equal(t, http.StatusOK, w.Code)
|
||||||
|
|
||||||
|
var response map[string]interface{}
|
||||||
|
err := json.Unmarshal(w.Body.Bytes(), &response)
|
||||||
|
assert.NoError(t, err)
|
||||||
|
assert.NotNil(t, response["data"])
|
||||||
|
}
|
||||||
|
|
||||||
|
// BE-SEC-001: Test that user can update their own profile
|
||||||
|
func TestUpdateProfile_UserCanUpdateOwnProfile(t *testing.T) {
|
||||||
|
if testing.Short() {
|
||||||
|
t.Skip("Skipping integration test in short mode")
|
||||||
|
}
|
||||||
|
|
||||||
|
router, db, cleanup := setupProfileIntegrationTestRouter(t)
|
||||||
|
defer cleanup()
|
||||||
|
|
||||||
|
// Create a user
|
||||||
|
userID := uuid.New()
|
||||||
|
createTestUserForProfile(t, db, userID, "testuser", false)
|
||||||
|
|
||||||
|
// User tries to update their own profile
|
||||||
|
updateReq := UpdateProfileRequest{
|
||||||
|
FirstName: "Updated First Name",
|
||||||
|
Bio: "Updated bio",
|
||||||
|
}
|
||||||
|
body, _ := json.Marshal(updateReq)
|
||||||
|
|
||||||
|
req := httptest.NewRequest(http.MethodPut, "/api/v1/users/"+userID.String(), bytes.NewBuffer(body))
|
||||||
|
req.Header.Set("Content-Type", "application/json")
|
||||||
|
req.Header.Set("X-User-ID", userID.String()) // user is authenticated
|
||||||
|
|
||||||
|
w := httptest.NewRecorder()
|
||||||
|
router.ServeHTTP(w, req)
|
||||||
|
|
||||||
|
// User should be able to update their own profile
|
||||||
|
assert.Equal(t, http.StatusOK, w.Code)
|
||||||
|
|
||||||
|
var response map[string]interface{}
|
||||||
|
err := json.Unmarshal(w.Body.Bytes(), &response)
|
||||||
|
assert.NoError(t, err)
|
||||||
|
assert.NotNil(t, response["data"])
|
||||||
|
|
||||||
|
// Verify the profile was actually updated
|
||||||
|
profileData := response["data"].(map[string]interface{})
|
||||||
|
profile := profileData["profile"].(map[string]interface{})
|
||||||
|
assert.Equal(t, "Updated First Name", profile["first_name"])
|
||||||
|
}
|
||||||
Loading…
Reference in a new issue