[thiagocanali]

Behavior

Users sign in with a provisioned Supabase email/password account before seeing tasks. The API verifies Bearer tokens with Supabase Auth getUser and scopes all task/history access to that verified identity. Foreign task IDs return 404; ownership cannot be supplied or reassigned through request bodies.

The ownership migration preserves old rows with NULL owners and quarantines them. Owner-leading indexes support scoped queries. RLS denies direct Data API access to tasks, activities and migration history; Prisma remains the trusted server data boundary.

Runtime and deployment

• Add a same-origin Vercel Function for /api/v1/* and /health, with full locked workspace installation.
• Fail closed when authentication is unconfigured: generic API 503 and an unavailable client state.
• Limit local bypass to explicit development mode and loopback servers; reject it in production/Vercel.
• Store browser sessions per tab and unmount private views on logout, account changes or API 401.
• Require Node 22.12+.

Dependency hardening

• Pin Zod 4.6.7 and stable Prisma CLI/client/pg adapter 7.10.1. Use the PostgreSQL adapter with a bounded pool and move CLI datasource configuration into prisma.config.ts.
• Pin Vitest 5.1.0, Vite 8.3.8 and compatible Vue tooling.
• npm audit --omit=dev reports zero vulnerabilities. CI rejects high/critical production advisories.
• Full audit has no high/critical entries; five moderate development-only entries remain in the Vue test formatter chain. They are documented in docs/DEPENDENCIES.md, without suppressions or forced incompatible overrides.

Validation

• 46 tests passed: 30 API (including five real PostgreSQL integration tests) and 16 Vue component tests.
• Typecheck, production builds and git diff --check passed.
• Existing migrations applied on disposable PostgreSQL 16; Prisma migrate diff detected no schema difference after the dependency upgrade.
• Chromium passed login, create, persisted reload, logout and second-account isolation through the actual API/PostgreSQL with a synthetic Auth HTTP provider. Cross-user access returned 404; no page errors.
• GitHub Actions validate passed for f2f48f4.
• Vercel preview dpl_B4hvmvQ6fSSZ9wcYa7wKksaE27aS is READY. Platform-authenticated HTTP checks confirmed /health 200 and /api/v1/tasks 503 with the expected generic error while Supabase is unconfigured.

Hosted activation blocker

Creating a dedicated taskDesk Supabase project was rejected because the account already has two active free projects. The cost lookup quoted $0/month, but does not remove the quota. No other project was paused, deleted or reused, and no paid resource was created. A capacity change or an explicit selection of a project that may be paused is required before hosted activation.

Hosted login and database connectivity remain unverified until this is resolved and environment variables are configured. See docs/DEPLOYMENT.md, docs/SECURITY.md and docs/DEPENDENCIES.md for activation, token revocation limits and legacy-data handling. PR #3 and this PR are merged into main. The production deployment for merge commit d0eb00c is READY; HTTP checks confirmed /health 200 and the unconfigured task endpoint 503. Hosted activation remains blocked by Supabase capacity.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
task-desk	Ready	Preview	Nov 11, 2026 11:56pm UTC