diff --git a/CLAUDE.md b/CLAUDE.md index 67879cf..dcf9b46 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -8,7 +8,9 @@ LisiLou Photography Portfolio — a photography booking and portfolio site for E Built as a zero-framework SPA with a Node.js/Express booking API, deployed on a homelab Proxmox cluster. **Live dev URL:** http://192.168.1.192:8080 (CT114, lisilou-dev LXC) -**Gitea repo:** https://git.jerodrigged.com/jhodgkin/lisilou-portfolio +**Production URL:** https://lisilou.jerodrigged.com (CT111 via Cloudflare tunnel → NPM CT102) +**Gitea repo:** https://git.jerodrigged.com/jhodgkin/lisilou-portfolio (deploys dev, CT114) +**GitHub mirror:** https://github.com/jhodgkin/lisilou-portfolio (deploys prod, CT111 — push here too or prod drifts!) ## Technology Stack @@ -18,7 +20,7 @@ Built as a zero-framework SPA with a Node.js/Express booking API, deployed on a | Portfolio server | Nginx Alpine | | Booking API | Node.js 20 / Express / better-sqlite3 | | Deployment | Docker Compose (two services: `portfolio` + `api`) | -| CI/CD | Gitea Actions → auto-deploys to CT114 on push to `main` | +| CI/CD | Gitea Actions → CT114 (dev); GitHub Actions → CT111 (prod) on push to `main` | | Image hosting | Immich (immich.jerodrigged.com) | ## Development Commands @@ -67,7 +69,7 @@ All content is loaded at runtime — no rebuild needed: ``` site.json -├── site — title, tagline, logo, favicon +├── site — title, tagline, logo, favicon, heroImage (optional hero photo) ├── photographer — name, bio, profile image ├── contact — email, phone ├── social — instagram, facebook, etc. @@ -157,14 +159,19 @@ Every push to `main`: | Step | Feature | Issue | Status | |------|---------|-------|--------| -| 1 | Date picker | #3 | Shell done; Google Calendar availability pending | +| 1 | Date picker | #3 | Done — Google Calendar busy dates (graceful when unconfigured) | | 2 | Session type | #4 | Done — config-driven from `sessionTypes[]` | | 3 | Session length | #4 | Done — mini/full with pricing from config | | 4 | Location picker | #5 | Done — photo cards with detail expand panel | -| 5 | Contract e-signature | #6 | Shell placeholder; PDF.js + pdf-lib pending | -| 6 | Venmo payment | #7 | Shell placeholder; deep link + QR pending | +| 5 | Contract e-signature | #6 | Done — PDF.js viewer + canvas pad; needs `api/contracts/model-release.pdf` on volume | +| 6 | Venmo payment | #7 | Done — deep link + server-generated QR | | 7 | Confirm & submit | — | Done — summary + POST /api/bookings | +Also done: n8n webhooks (#8), admin dashboard at `/dashboard` (#11), Authentik OIDC +login (#10, needs Authentik-side setup), client portal at `/my-bookings` (#13). +Auth lives in `api/auth.js` (zero-dep OIDC + HMAC cookie sessions); admin routes +accept an OIDC admin session or the legacy `ADMIN_SECRET` bearer. + ### Booking JS Functions (in `src/index.html`) | Function | Purpose | @@ -181,17 +188,10 @@ Every push to `main`: | `populateSummary()` | Fills step 7 confirm rows from bookingState + config labels | | `submitBooking()` | POST /api/bookings; shows success state | -## Pending Issues +## Pending Work -| # | Feature | -|---|---------| -| #3 | Google Calendar availability (real date picker with blocked dates) | -| #6 | Contract e-signature (PDF.js viewer + HTML5 canvas signature pad) | -| #7 | Venmo payment step (deep link + QR code) | -| #8 | n8n email notifications on new booking | -| #10 | Authentik OIDC (photographer admin + client self-registration) | -| #11 | Management dashboard with payment status | -| #12 | Authentik client self-registration enrollment flow | -| #13 | Client portal /my-bookings | +All original wizard issues (#3–#13) are code-complete. Remaining items — mostly +infrastructure setup, secrets, and content — are catalogued in +`docs/BACKLOG-2026-07-16.md` and should be transferred to Gitea issues. Issues are tracked at: https://git.jerodrigged.com/jhodgkin/homelab/issues diff --git a/docs/BACKLOG-2026-07-16.md b/docs/BACKLOG-2026-07-16.md new file mode 100644 index 0000000..136b6db --- /dev/null +++ b/docs/BACKLOG-2026-07-16.md @@ -0,0 +1,83 @@ +# Backlog from overnight session — 2026-07-16 + +Written to the repo because the available Gitea credential (`write:repository` only) +cannot create issues. **Transfer these to Gitea once a token with +`read:issue` + `write:issue` scope exists.** + +## Blockers needing Jerod's input + +### B1. Gitea API token for agent workflows +The stored git credential can push code but not read/create issues +(`required=[read:issue], token scope=write:repository`). Create a token at +git.jerodrigged.com/user/settings/applications with `read:user`, `write:issue`, +`write:repository` and set it as `GITEA_TOKEN` (user env var) on this machine. + +### B2. Production (CT111) api/.env is a blank template +The GitHub deploy now auto-creates `api/.env` from `.env.example`, which is why the +new stack runs — but every secret is empty. Until real values are set on CT111 at +`/opt/lisilou-portfolio/api/.env`: +- admin dashboard login is disabled (no `ADMIN_SECRET`) +- **new bookings send no n8n notification — real clients could book silently** +- calendar availability shows all dates free (no Google creds) +- SSO/client portal sign-in is inactive (no `OIDC_*` / `SESSION_SECRET`) +Copy working values from CT114:`/opt/…/api/.env` (adjust `SITE_URL` / `CORS_ORIGIN` +to https://lisilou.jerodrigged.com), then `docker compose restart api`. + +### B3. Authentik provider + groups (issues #10/#12) +Code for OIDC login and the client portal is deployed and tested, but Authentik +needs one-time admin setup (see header comment in `api/auth.js`): +1. OAuth2/OpenID provider (confidential; redirect URIs for both dev and prod + `/api/auth/callback`), application "LisiLou Portfolio" +2. `lisilou-admin` group with Elysse (grants dashboard access) +3. Enrollment flow for client self-registration (#12) — Authentik-side config only +4. Fill `OIDC_*` + `SESSION_SECRET` in both instances' `api/.env` + +### B4. Decide the deploy topology (dev vs prod) +Discovered overnight: `lisilou.jerodrigged.com` → NPM (CT102) → **CT111**, deployed +by **GitHub** Actions from github.com/jhodgkin/lisilou-portfolio; the Gitea repo +deploys to **CT114** (dev). The public site was 20 commits stale because pushes +stopped reaching GitHub. I've synced GitHub main and both pipelines are green, but: +- keeping two remotes in sync manually will drift again (mirror Gitea→GitHub, or + point NPM at CT114, or move prod deploy to Gitea Actions) +- CT111 and CT114 have separate SQLite DBs — real bookings live on CT111 only +- `homelab/docs/infrastructure.md` is stale (lists CT114 as Keycloak; CT111 notes + don't mention the GitHub runner deploy chain) + +## Security + +### S1. Signed-contract download is unauthenticated and enumerable +`GET /api/bookings/:id/contract` serves any signed contract by numeric id (kept +because n8n email links use it). Replace with HMAC-signed URLs +(`?token=…`, using SESSION_SECRET) and update the n8n workflow template. + +### S2. Dev ADMIN_SECRET committed in playwright.config.js +`9yPu…` is in git history and matches the dev instance. Rotate the dev secret and +inject via env/Gitea secret instead of a hardcoded default. + +## Content (needed to look professional — code is ready, assets are missing) + +### C1. Real photography on the prod volume +- `/images/hero.jpg` — new: homepage hero photo (soft scrim applied automatically) +- portfolio category covers (`/images/portfolio/*-cover.jpg`) or working Immich + album links — cards currently show the styled placeholder +- location photos (`/images/locations//hero.jpg`, `1.jpg`, `2.jpg`) +- `/images/logo.png`, `/images/favicon.ico`, profile photo +Verify the Immich share albums referenced in `site.json` resolve on prod. + +### C2. Contract template PDF +`api/contracts/model-release.pdf` is absent on both instances — the e-sign step +falls back and no PDF gets stamped. Drop the real contract on the volumes. + +### C3. Confirm public contact details +`site.json` has `hello@lisilou.com` and an empty phone; Venmo username +`LisiLouPhoto` — confirm all are real before promoting the site. + +## Nice-to-haves spotted during the walkthrough +- Portfolio lightbox: verify Immich proxy flow end-to-end on prod (couldn't test + without albums) +- `/dashboard` and `/my-bookings` aren't linked from anywhere for the photographer; + consider a footer link or bookmark +- Add `robots.txt` + real meta description / OpenGraph tags for sharing +- The "designer plugin" requested for the design review doesn't exist in this + Claude Code environment — the pass was done manually (screenshots + fixes); + if there's a specific plugin to install, add it to `.claude/settings.json`