# Backlog from overnight session — 2026-07-16

Written to the repo because the available Gitea credential (`write:repository` only)
cannot create issues. **Transfer these to Gitea once a token with
`read:issue` + `write:issue` scope exists.**

## Blockers needing Jerod's input

### B1. Gitea API token for agent workflows
The stored git credential can push code but not read/create issues
(`required=[read:issue], token scope=write:repository`). Create a token at
git.jerodrigged.com/user/settings/applications with `read:user`, `write:issue`,
`write:repository` and set it as `GITEA_TOKEN` (user env var) on this machine.

### B2. Production (CT111) api/.env is a blank template
The GitHub deploy now auto-creates `api/.env` from `.env.example`, which is why the
new stack runs — but every secret is empty. Until real values are set on CT111 at
`/opt/lisilou-portfolio/api/.env`:
- admin dashboard login is disabled (no `ADMIN_SECRET`)
- **new bookings send no n8n notification — real clients could book silently**
- calendar availability shows all dates free (no Google creds)
- SSO/client portal sign-in is inactive (no `OIDC_*` / `SESSION_SECRET`)
Copy working values from CT114:`/opt/…/api/.env` (adjust `SITE_URL` / `CORS_ORIGIN`
to https://lisilou.jerodrigged.com), then `docker compose restart api`.

### B3. Authentik provider + groups (issues #10/#12)
Code for OIDC login and the client portal is deployed and tested, but Authentik
needs one-time admin setup (see header comment in `api/auth.js`):
1. OAuth2/OpenID provider (confidential; redirect URIs for both dev and prod
   `/api/auth/callback`), application "LisiLou Portfolio"
2. `lisilou-admin` group with Elysse (grants dashboard access)
3. Enrollment flow for client self-registration (#12) — Authentik-side config only
4. Fill `OIDC_*` + `SESSION_SECRET` in both instances' `api/.env`

### B4. Decide the deploy topology (dev vs prod)
Discovered overnight: `lisilou.jerodrigged.com` → NPM (CT102) → **CT111**, deployed
by **GitHub** Actions from github.com/jhodgkin/lisilou-portfolio; the Gitea repo
deploys to **CT114** (dev). The public site was 20 commits stale because pushes
stopped reaching GitHub. I've synced GitHub main and both pipelines are green, but:
- keeping two remotes in sync manually will drift again (mirror Gitea→GitHub, or
  point NPM at CT114, or move prod deploy to Gitea Actions)
- CT111 and CT114 have separate SQLite DBs — real bookings live on CT111 only
- `homelab/docs/infrastructure.md` is stale (lists CT114 as Keycloak; CT111 notes
  don't mention the GitHub runner deploy chain)

## Security

### S1. Signed-contract download is unauthenticated and enumerable
`GET /api/bookings/:id/contract` serves any signed contract by numeric id (kept
because n8n email links use it). Replace with HMAC-signed URLs
(`?token=…`, using SESSION_SECRET) and update the n8n workflow template.

### S2. Dev ADMIN_SECRET committed in playwright.config.js
`9yPu…` is in git history and matches the dev instance. Rotate the dev secret and
inject via env/Gitea secret instead of a hardcoded default.

## Content (needed to look professional — code is ready, assets are missing)

### C1. Real photography on the prod volume
- `/images/hero.jpg` — new: homepage hero photo (soft scrim applied automatically)
- portfolio category covers (`/images/portfolio/*-cover.jpg`) or working Immich
  album links — cards currently show the styled placeholder
- location photos (`/images/locations/<id>/hero.jpg`, `1.jpg`, `2.jpg`)
- `/images/logo.png`, `/images/favicon.ico`, profile photo
Verify the Immich share albums referenced in `site.json` resolve on prod.

### C2. Contract template PDF
`api/contracts/model-release.pdf` is absent on both instances — the e-sign step
falls back and no PDF gets stamped. Drop the real contract on the volumes.

### C3. Confirm public contact details
`site.json` has `hello@lisilou.com` and an empty phone; Venmo username
`LisiLouPhoto` — confirm all are real before promoting the site.

## Nice-to-haves spotted during the walkthrough
- Portfolio lightbox: verify Immich proxy flow end-to-end on prod (couldn't test
  without albums)
- `/dashboard` and `/my-bookings` aren't linked from anywhere for the photographer;
  consider a footer link or bookmark
- Add `robots.txt` + real meta description / OpenGraph tags for sharing
- The "designer plugin" requested for the design review doesn't exist in this
  Claude Code environment — the pass was done manually (screenshots + fixes);
  if there's a specific plugin to install, add it to `.claude/settings.json`