lisilou-portfolio/docs/BACKLOG-2026-07-16.md

Backlog from overnight session — 2026-07-16

Written to the repo because the available Gitea credential (write:repository only) cannot create issues. Transfer these to Gitea once a token with read:issue + write:issue scope exists.

Blockers needing Jerod's input

B1. Gitea API token for agent workflows

The stored git credential can push code but not read/create issues (required=[read:issue], token scope=write:repository). Create a token at git.jerodrigged.com/user/settings/applications with read:user, write:issue, write:repository and set it as GITEA_TOKEN (user env var) on this machine.

B2. Production (CT111) api/.env is a blank template

The GitHub deploy now auto-creates api/.env from .env.example, which is why the new stack runs — but every secret is empty. Until real values are set on CT111 at /opt/lisilou-portfolio/api/.env:

• admin dashboard login is disabled (no ADMIN_SECRET)
• new bookings send no n8n notification — real clients could book silently
• calendar availability shows all dates free (no Google creds)
• SSO/client portal sign-in is inactive (no OIDC_* / SESSION_SECRET) Copy working values from CT114:/opt/…/api/.env (adjust SITE_URL / CORS_ORIGIN to https://lisilou.jerodrigged.com), then docker compose restart api.

B3. Authentik provider + groups (issues #10/#12)

Code for OIDC login and the client portal is deployed and tested, but Authentik needs one-time admin setup (see header comment in api/auth.js):

1. OAuth2/OpenID provider (confidential; redirect URIs for both dev and prod /api/auth/callback), application "LisiLou Portfolio"
2. lisilou-admin group with Elysse (grants dashboard access)
3. Enrollment flow for client self-registration (#12) — Authentik-side config only
4. Fill OIDC_* + SESSION_SECRET in both instances' api/.env

B4. Decide the deploy topology (dev vs prod)

Discovered overnight: lisilou.jerodrigged.com → NPM (CT102) → CT111, deployed by GitHub Actions from github.com/jhodgkin/lisilou-portfolio; the Gitea repo deploys to CT114 (dev). The public site was 20 commits stale because pushes stopped reaching GitHub. I've synced GitHub main and both pipelines are green, but:

• keeping two remotes in sync manually will drift again (mirror Gitea→GitHub, or point NPM at CT114, or move prod deploy to Gitea Actions)
• CT111 and CT114 have separate SQLite DBs — real bookings live on CT111 only
• homelab/docs/infrastructure.md is stale (lists CT114 as Keycloak; CT111 notes don't mention the GitHub runner deploy chain)

Security

S1. Signed-contract download is unauthenticated and enumerable

GET /api/bookings/:id/contract serves any signed contract by numeric id (kept because n8n email links use it). Replace with HMAC-signed URLs (?token=…, using SESSION_SECRET) and update the n8n workflow template.

S2. Dev ADMIN_SECRET committed in playwright.config.js

9yPu… is in git history and matches the dev instance. Rotate the dev secret and inject via env/Gitea secret instead of a hardcoded default.

Content (needed to look professional — code is ready, assets are missing)

C1. Real photography on the prod volume

• /images/hero.jpg — new: homepage hero photo (soft scrim applied automatically)
• portfolio category covers (/images/portfolio/*-cover.jpg) or working Immich album links — cards currently show the styled placeholder
• location photos (/images/locations/<id>/hero.jpg, 1.jpg, 2.jpg)
• /images/logo.png, /images/favicon.ico, profile photo Verify the Immich share albums referenced in site.json resolve on prod.

C2. Contract template PDF

api/contracts/model-release.pdf is absent on both instances — the e-sign step falls back and no PDF gets stamped. Drop the real contract on the volumes.

C3. Confirm public contact details

site.json has hello@lisilou.com and an empty phone; Venmo username LisiLouPhoto — confirm all are real before promoting the site.

Nice-to-haves spotted during the walkthrough

• Portfolio lightbox: verify Immich proxy flow end-to-end on prod (couldn't test without albums)
• /dashboard and /my-bookings aren't linked from anywhere for the photographer; consider a footer link or bookmark
• Add robots.txt + real meta description / OpenGraph tags for sharing
• The "designer plugin" requested for the design review doesn't exist in this Claude Code environment — the pass was done manually (screenshots + fixes); if there's a specific plugin to install, add it to .claude/settings.json