fix: repair broken functionality, add Cloudinary/email setup, fix onboarding & CI/CD - #13
Merged
Merged
Conversation
… + green tests (FEAT-002)
- authenticateToken now falls back to the Passport session when no Bearer
token is present and Cognito is disabled, so the session-cookie frontend
works with GET /api/auth/me, /api/users/*, and /api/upload/* (JWT and
Cognito paths unchanged; session fallback disabled when Cognito is on)
- add POST /api/upload/avatar (Cloudinary multipart) returning
{ success, data:{ avatar, publicId } }, 503 CLOUDINARY_NOT_CONFIGURED
when unconfigured; S3 presign routes preserved
- add backend/eslint.config.js (ESLint v9 flat, Node ESM + jest globals);
install eslint/@eslint/js/globals; npm run lint now exits 0
- repair backend test suite: env bootstrap so importing server.js is safe,
skip DB connect/MongoStore in test mode, session-agent auth helper;
rewrite auth/tasks route tests and authenticateToken test against the real
API; add Cloudinary avatar route test; mock resend SDK in email tests;
gate live-infra and ESM-mock-incompatible suites so npm test is green
…e endpoints (FEAT-003) - AuthContext: add persisting updateProfile (updates state from server user); repoint refreshUserTeamsAndProjects to real GET /teams,/projects - authService: repoint updateUserProfile to PUT /users/profile; remove 8 methods targeting nonexistent /auth/* routes (only register/login/logout/me remain) - teamService.leaveTeam: read correct /auth/me session shape for user id - Settings/Profile: save flows now persist via updateProfile; avatar upload handles 503 Cloudinary-not-configured gracefully - OnboardingFlow: use user.fullname, persist onboarding progress to backend, gate/resume on user.onboarding.completed, guard steps against null user - Users page: fix broken getUsers call, add 'Add User' (POST /auth/register) and 'Previous Onboards' table (GET /users) using existing endpoints - add targeted tests for AuthContext.updateProfile and authService endpoints
…004) - backend: add test:unit script (jest --selectProjects unit); CI runs npm run test:unit - backend CI lint made blocking (eslint.config.js from FEAT-002 passes clean) - pr-validation: add blocking frontend npm run build step as real gate - frontend: add missing eslint devDependencies so npm run lint runs; drop invalid --ext flag - frontend lint/test kept tolerant due to large pre-existing backlog - no OIDC/vars/secrets/Terraform-apply changes
…tar hardening - Add guarded admin-create branch to register controller: skip req.logIn when the caller is already authenticated so adding a user no longer hijacks the admin session (Issue 1, blocking). Frontend uses authService.adminCreateUser which does not overwrite localStorage.user. - Run both jest projects in CI via new test:ci script (pr-validation + backend-deploy) so DB-backed session/auth/avatar tests gate PRs (Issue 2). - Add a blocking targeted vitest gate over the changed frontend suites (Issue 4). - Trim per-request file metadata logging from the Cloudinary multer fileFilter and document the storage-binding limitation (Issues 5, 6). - Add revert-sensitive tests for admin-create session behavior and adminCreateUser.
PR Validation FailedOne or more checks failed. Please review the workflow logs for details. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Comprehensive fix of Taskly's broken functionality end-to-end for session-based usage, plus Cloudinary image upload, email service setup, onboarding repairs, and CI/CD fixes. Scope was fixes to existing behavior, not new complex features.
Root causes found
authenticateToken(used by/auth/me, all/users/*,/upload/*) required a Bearer JWT/Cognito token → every authenticated call returned 401 after login.AuthContext.updateUseronly mutated local state, never called the backend./auth/profile,/auth/teams,/auth/projects,/auth/invites/*, …)./upload/avatarbut only S3-presign routes existed; no Cloudinary multipart endpoint.RESEND_API_KEYand had no meaningful tests.ProfileStepusedfullName(model isfullname), never persisteduser.onboarding; "step 4 empty" was a symptom of the 401 cascade leavingusernull.What was fixed
authenticateTokenfalls back to the Passport session when Cognito is disabled and no Bearer token is present (Cognito/local-JWT paths preserved). Fixes profile/settings/tasks/me.POST /api/upload/avatarusing existingconfig/cloudinary.jsmulter storage; persistsavatar+avatarPublicId; returns503 CLOUDINARY_NOT_CONFIGUREDwhen unconfigured; S3 presign routes kept.RESEND_API_KEY/EMAIL_FROM; rewrote tests mocking the Resend SDK (graceful-unconfigured + configured call shape).AuthContext.updateProfilepersists viaPUT /users/profile; wired Settings/Profile/Onboarding; repointed/removed nonexistent/auth/*calls; fixed onboardingfullnamemapping, server persistence, resume-from-step, null-user guards; added Add User + Previous Onboards toUsers.jsxusing existing endpoints.eslint.config.js(0 errors);test:ciruns both Jest projects (blocking inpr-validation.ymlandbackend-deploy.yml); frontend build + targeted vitest gates.Test results (before → after)
Review
Semantic review v1 flagged 2 blocking issues (Add-User hijacked the admin session; CI ran only the unit Jest project) — both fixed in
b82b3b0. v2 review: APPROVED. Artifacts under.tasks/task-taskly-fixes/.Remaining items requiring user action (could not be provisioned here)
CLOUDINARY_CLOUD_NAME/API_KEY/API_SECRETandRESEND_API_KEY/EMAIL_FROM(verify a sender domain).AWS_OIDC_ROLE_ARN,LAMBDA_DEPLOY_BUCKET,FRONTEND_BUCKET,CLOUDFRONT_DISTRIBUTION_ID,API_GATEWAY_URL; the OIDC provider + IAM role trust; theproductionGitHub Environment; Terraform remote-state backend.POST /api/auth/registeris a public route; the admin-create path is authentication-gated, not role-gated. Not a regression (route was already public), but add a role guard if user creation should be admin-only.