Triple cleanup, landed together because they share the same cleanup
branch intent and touch non-overlapping trees.
1. 38× tracked .playwright-mcp/*.yml stage-deleted
MCP session recordings that had been inadvertently committed.
.gitignore already covers .playwright-mcp/ (post-audit J2 block
added in d12b901de). Working tree copies removed separately.
2. 19× disabled CI workflows moved to docs/archive/workflows/
Legacy .yml.disabled files in .github/workflows/ were 1676 LOC of
dead config (backend-ci, cd, staging-validation, accessibility,
chromatic, visual-regression, storybook-audit, contract-testing,
zap-dast, container-scan, semgrep, sast, mutation-testing,
rust-mutation, load-test-nightly, flaky-report, openapi-lint,
commitlint, performance). Preserved in docs/archive/workflows/
for historical reference; `.github/workflows/` now only lists the
5 actually-running pipelines.
3. Orphan code removed (0 consumers confirmed via grep)
- veza-backend-api/internal/repository/user_repository.go
In-memory UserRepository mock, never imported anywhere.
- proto/chat/chat.proto
Chat server Rust deleted 2026-02-22 (commit 279a10d31); proto
file was orphan spec. Chat lives 100% in Go backend now.
- veza-common/src/types/chat.rs (Conversation, Message, MessageType,
Attachment, Reaction)
- veza-common/src/types/websocket.rs (WebSocketMessage,
PresenceStatus, CallType — depended on chat::MessageType)
- veza-common/src/types/mod.rs updated: removed `pub mod chat;`,
`pub mod websocket;`, and their re-exports.
Only `veza_common::logging` is consumed by veza-stream-server
(verified with `grep -r "veza_common::"`). `cargo check` on
veza-common passes post-removal.
Refs: AUDIT_REPORT.md §8.2 "Code mort / orphelin" + §9.1.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add SumiButton and SumiCanvas components with lavis ink wash aesthetic.
Add useSeason and useTimeOfDay hooks for time-aware UI tinting.
Update storybook config, UI components, locales (en/es/fr), and dependencies.
Add Chromatic CI workflow.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Wrap password state setters to auto-clear passwordError on input change,
so stale validation errors don't persist after user corrects the fields
- Add clearable prop to Select component (default true for back-compat)
- Pass clearable={false} to audio quality dropdown so users cannot clear
it to an empty/invalid state
Fixes: Settings bugs #17, #20
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add autoComplete attrs to password inputs (current-password, new-password)
to fix browser autofill warnings
- Add autoComplete="new-password" to delete dialog password input to
prevent browser from pre-filling password and leaking email to search bar
- Replace VAPID key env var name in user-facing error with generic message
- Remove hardcoded 'Checkbox' aria-label fallback from checkbox component;
let native label association provide accessible name instead
Fixes: Settings bugs #7, #8, #10, #11, #12, #13
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Fix toast calls in useTwoFactorSetup.ts: use toast.success() instead
of direct toast() which crashes because the Proxy target is not callable
- Add playback field to settingsSchema.ts so Save Config validates correctly
- Refactor RadioGroup to use React Context instead of Children.map,
fixing mutual exclusion when items are wrapped in divs. Add name attr.
- Fix Delete Account dialog auto-closing without validation by using
custom footer with disabled confirm button when DELETE not typed
Fixes: Settings bugs #3, #5, #6, #9
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fix mocking issues, add missing test cases, and align tests with
current component APIs for analytics, chat, marketplace, player,
playlists, settings, tracks, and auth features.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add wrapperClassName prop to Tooltip for full-width layout in sidebar.
Hide scrollbar when sidebar is collapsed, show custom scrollbar when open.
Fix logout button gap in collapsed sidebar.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
MEDIUM-002: Remove manual X-Forwarded-For parsing in metrics_protection.go,
use c.ClientIP() only (respects SetTrustedProxies)
MEDIUM-003: Pin ClamAV Docker image to 1.4 across all compose files
MEDIUM-004: Add clampLimit(100) to 15+ handlers that parsed limit directly
MEDIUM-006: Remove unsafe-eval from CSP script-src on Swagger routes
MEDIUM-007: Pin all GitHub Actions to SHA in 11 workflow files
MEDIUM-008: Replace rabbitmq:3-management-alpine with rabbitmq:3-alpine in prod
MEDIUM-009: Add trial-already-used check in subscription service
MEDIUM-010: Add 60s periodic token re-validation to WebSocket connections
MEDIUM-011: Mask email in auth handler logs with maskEmail() helper
MEDIUM-012: Add k-anonymity threshold (k=5) to playback analytics stats
LOW-001: Align frontend password policy to 12 chars (matching backend)
LOW-003: Replace deprecated dotenv with dotenvy crate in Rust stream server
LOW-004: Enable xpack.security in Elasticsearch dev/local compose files
LOW-005: Accept context.Context in CleanupExpiredSessions instead of Background()
LOW-002: Noted — Hyperswitch version update deferred (requires payment integration tests)
29/30 findings remediated. 1 noted (LOW-002).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- EducationPage with 3 tabs: Catalog, My Courses, Certificates
- HLS.js video player integration for course lessons
- Course enrollment, progress tracking, and certificate display
- TypeScript types matching backend models
- API service layer for all education endpoints
- Lazy loading route configuration
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Distribution types, API service, and page component
- Distributions list with platform-specific status badges
- External streaming revenue table with summary cards
- Platform icons and status colors for Spotify/Apple Music/Deezer
- ARIA labels for accessibility
- Lazy-loaded route at /distribution
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add subscription types, service, and page component
- Pricing page with Free/Creator/Premium plan cards
- Monthly/yearly billing toggle (17% savings on yearly)
- Current subscription status display
- Cancel/reactivate subscription controls
- Invoice billing history table
- ARIA labels for accessibility
- Lazy-loaded route at /subscription
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
LazyComponent.tsx and routeConfig.tsx import LazyCloud from the
lazy-component module, but it was not re-exported in index.ts.
This caused: 'The requested module does not provide an export
named LazyCloud' at runtime.
CLN-04: Replaced any with unknown, proper interfaces, or concrete
types across 17 files. Focus: error handlers, API responses,
WebSocket data, and function parameters.
- Fix setTimeout memory leak in ChatRoom.tsx by storing timeout in
useRef and cleaning up on unmount
- Add tests for Accordion, Collapsible, FloatingInput, AnimatedNumber,
and FAB components (5 new test files, all passing)
- Fix socialService methods (deleteComment, markRead, markAllRead) to
return values matching test expectations
- Fix MSW handlers for chat/token and notification endpoints to use
proper { success: true, data: ... } envelope format
- Fix invalid CSS selector in TrackList.test.tsx that caused JSDOM crash
- Document excluded test files with TODO tickets in vitest.config.ts
Co-authored-by: Cursor <cursoragent@cursor.com>
