admin/linkder
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

M1: phone app shell, settings, profile, dev login

Browse Source 
Everything now renders inside a phone illustration on the entry screen,
with a five-tab bar. The frame lives in the root layout rather than one
page, so sign-in, onboarding and the job form are inside it too.

- Entry screen is the product running, not a marketing page: a live
  swipeable deck of real verified pros with a trade-filter strip above
  the card. deck.showcase is the only public procedure in that router
  and writes nothing, so an anonymous right swipe reaches no one.

- Settings: notification preferences (new table, defaults returned when
  no row exists), signed-in devices, GDPR export, deletion request.

  Closes the setEmail finding: an unverified address is no longer
  written to users.email, which is UNIQUE -- claiming a stranger's
  address used to block them from ever signing up with Google, and the
  uniqueness error leaked whether an address was registered. Now parked
  in email_change_requests until a token proves ownership.

- Profile: for a pro it leads with their REAL deck card, rendered by the
  same exported <Card> clients swipe, so the two cannot drift. Adds
  pro.previewCard (works at draft/pending, where publicProfile 404s) and
  pro.reorderMedia (photo position 0 is the deck card). Warns before an
  edit that would send a verified pro back for review, rather than after
  it silently drops them off the deck. Clients get a thin profile plus a
  route into pro onboarding -- supply is the launch blocker.

- Dev login: +34600000000 / 000000, behind THREE guards (NODE_ENV,
  an explicit ALLOW_DEV_LOGIN flag, and an exact number match). It
  overwrites the stored code rather than skipping verification, so the
  real expiry, attempt cap and single-use consumption still apply.

- Seed uses portrait photos. The cards previously showed picsum stock
  scenery -- a locksmith standing on a railway track.

Fixes found along the way: the card's name rendered ink-950 navy on a
dark photo because globals.css sets h1..h6 colour in @layer base, which
beat the inherited text-white; and the card referenced --color-go-500,
--border and --card, none of which exist, so the SEND JOB stamp had no
colour.

Also adds public/sw.js as a kill-switch: a service worker left
registered on localhost:3000 by a different project was intercepting
this app's chunks.

typecheck, lint clean; 186 tests pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
serfowi
2026-08-21 03:16:27 -04:00
co-authored by Claude Opus 5
parent 582f13fa99
commit 176ba187c8
51 changed files with 15622 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/api/test/pro.router.test.ts
+248
View File
@@ -0,0 +1,248 @@
/**
* Integration tests for the pro profile surface.
*
* pnpm services:up && pnpm db:migrate && pnpm db:seed
*
* previewCard exists precisely because publicProfile refuses non-verified pros,
* so most of what follows is about it working where publicProfile cannot, and
* about reordering never reaching another pro's photos.
*/
import { config } from 'dotenv';
import { sql } from 'drizzle-orm';
import { afterAll, beforeAll, describe, expect, it } from 'vitest';
config({ path: '../../.env' });
const { closePool, db } = await import('@linkder/db');
const { appRouter } = await import('../src/root');
const { createInnerContext } = await import('../src/context');
const { createCallerFactory } = await import('../src/trpc');
const createCaller = createCallerFactory(appRouter);
type Session = import('../src/context').Session;
function callerFor(session: Session | null) {
return createCaller(createInnerContext({ db, session }));
}
const proSession = (userId: string, verificationStatus: string): Session => ({
userId,
role: 'pro',
name: 'Test Pro',
email: 'pro@test',
phone: null,
verificationStatus: verificationStatus as Session['verificationStatus'],
});
let verifiedPro: string;
let pendingPro: string;
let otherPro: string;
beforeAll(async () => {
const verified = await db.execute<{ user_id: string }>(sql`
SELECT p.user_id FROM pro_profiles p
WHERE p.verification_status = 'verified' ORDER BY p.user_id LIMIT 2
`);
verifiedPro = verified[0]!.user_id;
otherPro = verified[1]!.user_id;
const pending = await db.execute<{ user_id: string }>(sql`
SELECT p.user_id FROM pro_profiles p
WHERE p.verification_status = 'pending' ORDER BY p.user_id LIMIT 1
`);
pendingPro = pending[0]!.user_id;
});
afterAll(async () => {
// The skills tests write to real seeded profiles; put them back empty.
await db.execute(
sql`UPDATE pro_profiles SET skills = '{}'::text[] WHERE user_id IN (${verifiedPro}, ${pendingPro})`,
);
await closePool();
});
describe('pro.previewCard', () => {
it('returns the caller’s own card', async () => {
const card = await callerFor(proSession(verifiedPro, 'verified')).pro.previewCard();
expect(card?.proId).toBe(verifiedPro);
expect(card?.headline).toBeTruthy();
});
it('works for a pro whose verification has NOT passed', async () => {
// publicProfile 404s here, which is why this procedure exists: the moment a
// pro most needs to see their card is before they are approved.
const card = await callerFor(proSession(pendingPro, 'pending')).pro.previewCard();
expect(card?.proId).toBe(pendingPro);
await expect(
callerFor(proSession(pendingPro, 'pending')).pro.publicProfile({ proId: pendingPro }),
).rejects.toThrow();
});
it('carries the photos in deck order, lead photo first', async () => {
const card = await callerFor(proSession(verifiedPro, 'verified')).pro.previewCard();
const rows = await db.execute<{ url: string }>(sql`
SELECT url FROM pro_media WHERE pro_id = ${verifiedPro} ORDER BY position
`);
expect(card?.photos[0]).toBe(rows[0]!.url);
});
it('is not reachable by a client', async () => {
await expect(
callerFor({
userId: verifiedPro,
role: 'client',
name: null,
email: null,
phone: null,
verificationStatus: null,
}).pro.previewCard(),
).rejects.toThrow();
});
});
describe('pro.reorderMedia', () => {
it('puts the chosen photo first', async () => {
const before = await db.execute<{ id: string }>(sql`
SELECT id FROM pro_media WHERE pro_id = ${verifiedPro} ORDER BY position
`);
const reversed = before.map((r) => r.id).reverse();
await callerFor(proSession(verifiedPro, 'verified')).pro.reorderMedia({
orderedIds: reversed,
});
const after = await db.execute<{ id: string }>(sql`
SELECT id FROM pro_media WHERE pro_id = ${verifiedPro} ORDER BY position
`);
expect(after.map((r) => r.id)).toEqual(reversed);
});
it('refuses a list containing another pro’s photo', async () => {
const mine = await db.execute<{ id: string }>(sql`
SELECT id FROM pro_media WHERE pro_id = ${verifiedPro} ORDER BY position
`);
const theirs = await db.execute<{ id: string }>(sql`
SELECT id FROM pro_media WHERE pro_id = ${otherPro} LIMIT 1
`);
const smuggled = [...mine.slice(1).map((r) => r.id), theirs[0]!.id];
await expect(
callerFor(proSession(verifiedPro, 'verified')).pro.reorderMedia({ orderedIds: smuggled }),
).rejects.toThrow();
});
it('refuses a partial list, which would leave gaps in the ordering', async () => {
const mine = await db.execute<{ id: string }>(sql`
SELECT id FROM pro_media WHERE pro_id = ${verifiedPro} ORDER BY position
`);
await expect(
callerFor(proSession(verifiedPro, 'verified')).pro.reorderMedia({
orderedIds: [mine[0]!.id],
}),
).rejects.toThrow();
});
it('leaves the other pro’s photos untouched', async () => {
const theirsBefore = await db.execute<{ id: string; position: number }>(sql`
SELECT id, position FROM pro_media WHERE pro_id = ${otherPro} ORDER BY position
`);
const mine = await db.execute<{ id: string }>(sql`
SELECT id FROM pro_media WHERE pro_id = ${verifiedPro} ORDER BY position
`);
await callerFor(proSession(verifiedPro, 'verified')).pro.reorderMedia({
orderedIds: mine.map((r) => r.id).reverse(),
});
const theirsAfter = await db.execute<{ id: string; position: number }>(sql`
SELECT id, position FROM pro_media WHERE pro_id = ${otherPro} ORDER BY position
`);
expect(theirsAfter).toEqual(theirsBefore);
});
});
describe('pro.updateSkills', () => {
it('saves the list and hands it back on pro.me', async () => {
const caller = callerFor(proSession(verifiedPro, 'verified'));
const result = await caller.pro.updateSkills({
skills: ['Underfloor heating', 'Emergency callouts'],
});
expect(result.skills).toEqual(['Underfloor heating', 'Emergency callouts']);
const profile = await caller.pro.me();
expect(profile?.skills).toEqual(['Underfloor heating', 'Emergency callouts']);
});
it('replaces the whole list rather than appending', async () => {
const caller = callerFor(proSession(verifiedPro, 'verified'));
const result = await caller.pro.updateSkills({ skills: ['Bathroom fitting'] });
expect(result.skills).toEqual(['Bathroom fitting']);
});
it('trims and drops case-insensitive duplicates', async () => {
const result = await callerFor(proSession(verifiedPro, 'verified')).pro.updateSkills({
skills: [' Leak detection ', 'leak detection', 'LEAK DETECTION', 'Boiler swaps'],
});
// First spelling wins; the rest are the same claim twice.
expect(result.skills).toEqual(['Leak detection', 'Boiler swaps']);
});
it('refuses more than the cap, and entries that are too long', async () => {
const caller = callerFor(proSession(verifiedPro, 'verified'));
await expect(
caller.pro.updateSkills({ skills: Array.from({ length: 13 }, (_, i) => `Skill ${i}`) }),
).rejects.toThrow();
await expect(caller.pro.updateSkills({ skills: ['x'.repeat(41)] })).rejects.toThrow();
await expect(caller.pro.updateSkills({ skills: ['a'] })).rejects.toThrow();
});
it('accepts an empty list, so a pro can clear it', async () => {
const result = await callerFor(proSession(verifiedPro, 'verified')).pro.updateSkills({
skills: [],
});
expect(result.skills).toEqual([]);
});
it('does NOT send a verified pro back for review', async () => {
await callerFor(proSession(verifiedPro, 'verified')).pro.updateSkills({
skills: ['Listed buildings'],
});
const rows = await db.execute<{ status: string }>(
sql`SELECT verification_status AS status FROM pro_profiles WHERE user_id = ${verifiedPro}`,
);
// Skills are description, not a licensed claim — demoting for one would
// just teach pros to leave the field empty.
expect(rows[0]!.status).toBe('verified');
});
it('works before verification has passed', async () => {
const result = await callerFor(proSession(pendingPro, 'pending')).pro.updateSkills({
skills: ['Rewiring'],
});
expect(result.skills).toEqual(['Rewiring']);
});
it('never touches another pro row', async () => {
await callerFor(proSession(verifiedPro, 'verified')).pro.updateSkills({ skills: ['Mine'] });
const rows = await db.execute<{ skills: string[] }>(
sql`SELECT skills FROM pro_profiles WHERE user_id = ${otherPro}`,
);
expect(rows[0]!.skills).not.toContain('Mine');
});
it('rejects a caller who is not a pro', async () => {
const client: Session = {
userId: verifiedPro,
role: 'client',
name: 'Test Client',
email: 'client@test',
phone: null,
verificationStatus: null,
};
await expect(callerFor(client).pro.updateSkills({ skills: ['Nope'] })).rejects.toThrow();
await expect(callerFor(null).pro.updateSkills({ skills: ['Nope'] })).rejects.toThrow();
});
});
packages/api/test/settings.router.test.ts
+358
View File
@@ -0,0 +1,358 @@
/**
* Integration tests for the settings surface, against the live seeded database.
*
* pnpm services:up && pnpm db:migrate && pnpm db:seed
*
* These are mostly authorization and information-leak tests. Settings hands a
* user controls over their own account; the failure mode that matters is one of
* them reaching somebody else's.
*/
import { config } from 'dotenv';
import { sql } from 'drizzle-orm';
import { afterAll, beforeAll, describe, expect, it } from 'vitest';
config({ path: '../../.env' });
const { closePool, db } = await import('@linkder/db');
const { appRouter } = await import('../src/root');
const { createInnerContext } = await import('../src/context');
const { createCallerFactory } = await import('../src/trpc');
const createCaller = createCallerFactory(appRouter);
type Session = import('../src/context').Session;
function callerFor(session: Session | null) {
return createCaller(createInnerContext({ db, session }));
}
const clientSession = (userId: string): Session => ({
userId,
role: 'client',
name: 'Test Client',
email: 'client@test',
phone: null,
verificationStatus: null,
});
const proSession = (userId: string): Session => ({
userId,
role: 'pro',
name: 'Test Pro',
email: 'pro@test',
phone: null,
verificationStatus: 'verified',
});
let alice: string;
let bob: string;
let aliceEmail: string;
let bobEmail: string;
/**
* A throwaway verified pro, owned by this file.
*
* Not a seeded one: vitest runs test FILES in parallel, and the location tests
* demote a verified pro to `pending` — doing that to a seeded pro would delete a
* card out from under deck.router.test.ts mid-run. This one is parked in the
* Gulf of Guinea with no trades, so no deck query can reach it either way.
*/
let pro: string;
const PRO_BASE = { lat: 0.5, lng: 0.5 };
// Unique per run: these tests write real addresses onto real rows, and a
// leftover from a previous run would collide with users.email's UNIQUE index.
const RUN = Math.random().toString(36).slice(2, 8);
/** Marks the session rows this file creates, so they can be cleaned up. */
const PROBE_UA = 'SettingsTestProbe';
beforeAll(async () => {
// Order by id, not created_at: the seed writes clients in one batch and
// created_at ties, so created_at ordering is not stable between runs.
const rows = await db.execute<{ id: string; email: string }>(
sql`SELECT id, email FROM users WHERE role = 'client' ORDER BY id LIMIT 2`,
);
alice = rows[0]!.id;
bob = rows[1]!.id;
aliceEmail = rows[0]!.email;
bobEmail = rows[1]!.email;
await db.execute(sql`DELETE FROM email_change_requests`);
await db.execute(sql`DELETE FROM deletion_requests`);
await db.execute(sql`DELETE FROM notification_preferences`);
await db.execute(sql`DELETE FROM sessions WHERE user_agent = ${PROBE_UA}`);
const created = await db.execute<{ id: string }>(sql`
INSERT INTO users (name, email, role)
VALUES ('Location Probe', ${`location-probe-${RUN}@example.com`}, 'pro')
RETURNING id
`);
pro = created[0]!.id;
await db.execute(sql`
INSERT INTO pro_profiles (
user_id, headline, bio, hourly_rate_cents, base_location, service_radius_m,
verification_status, verified_at
)
VALUES (
${pro}, 'Location probe', 'Exists only for the settings location tests.', 3000,
ST_SetSRID(ST_MakePoint(${PRO_BASE.lng}, ${PRO_BASE.lat}), 4326)::geography, 15000,
'verified', now()
)
`);
});
afterAll(async () => {
// Put the addresses back, or the next run starts from a different state.
await db.execute(sql`UPDATE users SET email = ${aliceEmail} WHERE id = ${alice}`);
await db.execute(sql`UPDATE users SET email = ${bobEmail} WHERE id = ${bob}`);
await db.execute(sql`DELETE FROM email_change_requests`);
await db.execute(sql`DELETE FROM deletion_requests`);
await db.execute(sql`DELETE FROM notification_preferences`);
await db.execute(sql`DELETE FROM sessions WHERE user_agent = ${PROBE_UA}`);
// Cascades to pro_profiles and audit_log.
await db.execute(sql`DELETE FROM users WHERE id = ${pro}`);
await db.execute(sql`
UPDATE users SET location = NULL, location_text = NULL, search_radius_m = 15000
WHERE id IN (${alice}, ${bob})
`);
await closePool();
});
describe('notification preferences', () => {
it('returns defaults when the user has never saved any', async () => {
const prefs = await callerFor(clientSession(alice)).notification.get();
expect(prefs.smsNewRequest).toBe(true);
// Marketing is the one that must default OFF — opt-in, not opt-out.
expect(prefs.smsMarketing).toBe(false);
expect(prefs.emailMarketing).toBe(false);
});
it('a partial update does not reset the preferences it did not mention', async () => {
const caller = callerFor(clientSession(alice));
await caller.notification.update({ smsMarketing: true });
await caller.notification.update({ smsNewRequest: false });
const prefs = await caller.notification.get();
expect(prefs.smsMarketing).toBe(true);
expect(prefs.smsNewRequest).toBe(false);
});
it("one user's preferences are invisible to another", async () => {
await callerFor(clientSession(alice)).notification.update({ pushMessages: false });
const bobPrefs = await callerFor(clientSession(bob)).notification.get();
expect(bobPrefs.pushMessages).toBe(true);
});
it('rejects an anonymous caller', async () => {
await expect(callerFor(null).notification.get()).rejects.toThrow();
});
});
describe('email change', () => {
it('does NOT write the address to users.email before it is confirmed', async () => {
const caller = callerFor(clientSession(alice));
await caller.user.requestEmailChange({ email: `claimed-${RUN}@example.com` });
const rows = await db.execute<{ count: number }>(
sql`SELECT count(*)::int AS count FROM users WHERE email = ${`claimed-${RUN}@example.com`}`,
);
// This is the whole point: an unproven address must not occupy the UNIQUE
// column, or its real owner can never sign up with Google.
expect(rows[0]!.count).toBe(0);
});
it('does not reveal whether an address is already registered', async () => {
// Requesting someone else's address must look exactly like any other request.
await expect(
callerFor(clientSession(alice)).user.requestEmailChange({ email: bobEmail }),
).resolves.toMatchObject({ sent: true });
});
it('commits the address once the token comes back', async () => {
const caller = callerFor(clientSession(alice));
const { token } = await caller.user.requestEmailChange({ email: `proven-${RUN}@example.com` });
await callerFor(null).user.confirmEmailChange({ token });
const rows = await db.execute<{ email: string; verified: boolean }>(
sql`SELECT email, email_verified AS verified FROM users WHERE id = ${alice}`,
);
expect(rows[0]!.email).toBe(`proven-${RUN}@example.com`);
expect(rows[0]!.verified).toBe(true);
});
it('refuses a token twice', async () => {
const caller = callerFor(clientSession(alice));
const { token } = await caller.user.requestEmailChange({ email: `once-${RUN}@example.com` });
await callerFor(null).user.confirmEmailChange({ token });
await expect(callerFor(null).user.confirmEmailChange({ token })).rejects.toThrow();
});
it('refuses to commit an address another account already holds', async () => {
const { token } = await callerFor(clientSession(alice)).user.requestEmailChange({
email: bobEmail,
});
// Only now — ownership proven — is the collision reported.
await expect(callerFor(null).user.confirmEmailChange({ token })).rejects.toThrow(/already/i);
});
});
describe('sessions', () => {
it('never returns another user’s sessions', async () => {
await db.execute(sql`
INSERT INTO sessions (user_id, token, expires_at, ip_address, user_agent)
VALUES (${bob}, ${`bob-token-${RUN}`}, now() + interval '1 day', '10.0.0.1', ${PROBE_UA})
`);
const aliceSessions = await callerFor(clientSession(alice)).user.sessions();
expect(aliceSessions.every((s) => s.userAgent !== PROBE_UA)).toBe(true);
});
it('never returns the session token', async () => {
const rows = await callerFor(clientSession(bob)).user.sessions();
for (const row of rows) {
expect(Object.keys(row)).not.toContain('token');
}
});
});
describe('deletion request', () => {
it('records a request without deleting the user', async () => {
const result = await callerFor(clientSession(bob)).user.requestDeletion({ reason: 'testing' });
expect(result.requested).toBe(true);
const still = await db.execute<{ count: number }>(
sql`SELECT count(*)::int AS count FROM users WHERE id = ${bob}`,
);
expect(still[0]!.count).toBe(1);
});
it('is idempotent while one is still outstanding', async () => {
const second = await callerFor(clientSession(bob)).user.requestDeletion({});
expect(second.alreadyPending).toBe(true);
});
});
describe('location and range', () => {
it('starts with no pin and the default radius', async () => {
const location = await callerFor(clientSession(bob)).user.location();
expect(location.scope).toBe('client');
expect(location.location).toBeNull();
expect(location.radiusM).toBe(15_000);
});
it('saves a pin, a label and a radius, and reads them back', async () => {
const caller = callerFor(clientSession(alice));
await caller.user.updateLocation({
location: { lat: 41.4036, lng: 2.1744 },
addressText: 'Gracia, Barcelona',
radiusM: 8_000,
});
const location = await caller.user.location();
expect(location.addressText).toBe('Gracia, Barcelona');
expect(location.radiusM).toBe(8_000);
expect(location.location?.lat).toBeCloseTo(41.4036, 4);
expect(location.location?.lng).toBeCloseTo(2.1744, 4);
});
it('changes only what it was given', async () => {
const caller = callerFor(clientSession(alice));
await caller.user.updateLocation({ radiusM: 25_000 });
const location = await caller.user.location();
expect(location.radiusM).toBe(25_000);
// The pin saved by the previous test is still there.
expect(location.location?.lat).toBeCloseTo(41.4036, 4);
});
it('refuses a radius outside the supported range', async () => {
const caller = callerFor(clientSession(alice));
await expect(caller.user.updateLocation({ radiusM: 500_000 })).rejects.toThrow();
await expect(caller.user.updateLocation({ radiusM: 10 })).rejects.toThrow();
});
it('refuses an update that says nothing', async () => {
await expect(callerFor(clientSession(alice)).user.updateLocation({})).rejects.toThrow();
});
it('never reads or writes another user location', async () => {
await callerFor(clientSession(alice)).user.updateLocation({ radiusM: 3_000 });
const bobLocation = await callerFor(clientSession(bob)).user.location();
expect(bobLocation.radiusM).not.toBe(3_000);
});
it('rejects an anonymous caller', async () => {
await expect(callerFor(null).user.location()).rejects.toThrow();
await expect(callerFor(null).user.updateLocation({ radiusM: 5_000 })).rejects.toThrow();
});
it('reads a pro service area from the profile, not the user row', async () => {
// A stray value on the user row must not be what a pro is shown: the deck
// matches on the profile, so anything else would display a number that
// decides nothing.
await db.execute(sql`UPDATE users SET search_radius_m = 1000 WHERE id = ${pro}`);
const location = await callerFor(proSession(pro)).user.location();
expect(location.scope).toBe('pro');
expect(location.needsProfile).toBe(false);
expect(location.radiusM).toBe(15_000);
expect(location.location?.lat).toBeCloseTo(PRO_BASE.lat, 4);
expect(location.reviewOnChange).toBe(true);
});
it('writes a pro radius to the profile the deck reads', async () => {
await callerFor(proSession(pro)).user.updateLocation({ radiusM: 22_000 });
const rows = await db.execute<{ radius: number }>(
sql`SELECT service_radius_m AS radius FROM pro_profiles WHERE user_id = ${pro}`,
);
expect(rows[0]!.radius).toBe(22_000);
});
it('sends a verified pro back for review when the area changes', async () => {
await db.execute(
sql`UPDATE pro_profiles SET verification_status = 'verified' WHERE user_id = ${pro}`,
);
const result = await callerFor(proSession(pro)).user.updateLocation({ radiusM: 30_000 });
expect(result.sentForReview).toBe(true);
const rows = await db.execute<{ status: string }>(
sql`SELECT verification_status AS status FROM pro_profiles WHERE user_id = ${pro}`,
);
// Settings must not become the way around verification.
expect(rows[0]!.status).toBe('pending');
const audit = await db.execute<{ count: number }>(sql`
SELECT count(*)::int AS count FROM audit_log
WHERE actor_id = ${pro} AND action = 'verification.re_review_required'
`);
expect(audit[0]!.count).toBeGreaterThan(0);
});
it('leaves verification alone when nothing material changed', async () => {
await db.execute(
sql`UPDATE pro_profiles SET verification_status = 'verified' WHERE user_id = ${pro}`,
);
// The radius the row already holds, plus a label. Neither is material.
const result = await callerFor(proSession(pro)).user.updateLocation({
radiusM: 30_000,
addressText: 'Somewhere warm',
});
expect(result.sentForReview).toBe(false);
const rows = await db.execute<{ status: string }>(
sql`SELECT verification_status AS status FROM pro_profiles WHERE user_id = ${pro}`,
);
expect(rows[0]!.status).toBe('verified');
});
});
describe('data export', () => {
it('returns only the caller’s own rows', async () => {
const data = await callerFor(clientSession(alice)).user.exportData();
expect(data.user?.id).toBe(alice);
expect(data.jobs.every((j) => j.clientId === alice)).toBe(true);
});
});