boban
/
nimuli
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
97 Commits
1 Branch
0 Tags
8.3 MiB
Commit Graph

28 Commits (deb5f310a116587cbf1e81ca84110326db3447f9)

Author SHA1 Message Date
boban deb5f310a1 fix(bio): plan-aware URL + plan-seeder + ulid→slug fix 
- Migration: add bio_pages_limit to plans, make limit cols nullable (agency=unlimited)
- PlanSeeder: 4 plans (free/pro/business/agency) with tier/features/bio_pages_limit
- workspaces:assign-default-plan command: assigns free plan to unassigned workspaces
- BioPage::publicUrl(): free=apex-path, pro+=subdomain, custom=custom-domain
  - Security: str_ends_with check uses '.'.$apex to prevent evilnimu.li bypass
- BioPage::shortPublicUrl(): URL without scheme for display
- PlanLimitsService: use bio_pages_limit column (was features['bio_pages']), null=unlimited
- BioPageController: fix $bio → $page variable (view expects $page)
- Bio index/edit views: use publicUrl()/shortPublicUrl(), not hardcoded ULID URLs
- Bio edit view: publicUrlBase/displayUrlBase from component (plan-aware prefix)
- Create-bio modal: plan-aware URL prefix display
- PlanFactory/WorkspaceFactory: free()/pro() states for tests
- Tests: PublicUrlTest (5 cases), Free404FixTest (3 cases)

Known pre-existing failure (not caused by this change):
- Tests\Feature\Auth\EmailVerificationTest::email can be verified

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-17 22:44:54 +02:00
boban 248c5100d1 fix(sidebar+types): mobile slide animation, close-on-navigate, PHPStan clean 
- sidebar: transition-[width,transform] so mobile open/close animates
- sidebar: pure :class binding replaces mixed class+:style for translate
- layout: livewire:navigated closes mobile sidebar via Alpine store
- tests: RouteSmokeTest covers all 17 workspace/profile/AI routes
- scripts: crawl-all-routes.mjs + console-check.mjs (Playwright)
- phpstan: add @property-read, @var, @return generics across 15 modal/component files → 0 errors
- pint: auto-fix style violations in 9 files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 15:47:17 +02:00
boban 2510620f67 fix(modals): make create/edit/delete modals actually save + auto-refresh lists 
- All create modals now validate→create→dispatch(kebab-case event)→toast→close
- All edit/delete modals dispatch kebab-case events to Index classes
- Index components listen via #[On] and call resetPage() to refresh
- QR Code save() validates url field conditionally per type
- Tests updated to assert kebab-case event names

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 15:13:44 +02:00
boban c67bde8fc5 feat: Toaster, button-component, 10 new modals, links-page fix, vite-tuning 
- Toaster Livewire component (toast event, dismiss, auto-hide, 6 tests)
- <x-ui.button> Blade component with wire:loading indicator + variants
- QR modals: CreateQrCode, EditQrCode, DeleteQrCode (TDD, 8 tests)
- Bio modals: CreateBioPage, EditBioPage, DeleteBioPage (TDD, 7 tests)
- Domain modals: AddDomain, VerifyDomain, DeleteDomain (TDD, 7 tests)
- Profile modal: DeleteAccount with password confirm (TDD, 4 tests)
- Links page: fix openModal event name, wire up Edit/Delete to modals, toast on all CRUD
- vite.config.js: add chart.js/auto + optimizeDeps.force
- QrCode model: add newFactory() + QrCodeFactory
- Layout: Toaster embedded before </body>
- 141 tests / 296 assertions all green, verify 29/29

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 13:55:25 +02:00
boban ba67f67d60 fix(ui+seed): FOUC eliminated + persistent dev-user 
Seed:
- DevUserSeeder: idempotent — creates workspace + WorkspaceMember + sets
  default_workspace_id. Auto-recreates everything on migrate:fresh --seed.
- DatabaseSeeder: PlanSeeder first (nexxo needs a plan), then DevUserSeeder
  always, DemoDataSeeder only in local/dev env.
- DevUserSeederTest: create + idempotent + in-DatabaseSeeder + order check.
- Removed WithoutModelEvents trait from DatabaseSeeder (was suppressing
  model observers needed for workspace creation).

UI (nimuli-app.blade.php):
- Inline JS theme-init before first paint: reads localStorage nimuli_theme,
  falls back to server-side user preference. Eliminates theme flash on reload.
- Critical CSS in <head>: CSS vars, body opacity 0 → 1 fade (120ms),
  skeleton sidebar + topbar visible during JS load.
- app-spinner shown until app-ready class added by markReady().
- Skeleton + spinner hidden via body.app-ready CSS selector.
- livewire:navigated event re-triggers markReady() for SPA navigation.
- x-cloak on mobile sidebar overlay to prevent pre-Alpine flash.

Bash aliases added to ~/.bashrc:
- seed-dev  → db:seed --class=DevUserSeeder
- migrate-fresh → migrate:fresh --seed
- reset-db  → migrate:fresh --seed (with confirmation message)

Tests: 109/109 passing. Smoke: all routes ✅. DB sanity ✅.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 12:53:29 +02:00
boban 5748dd3443 style: apply Pint formatting to modal files and tests 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 12:42:16 +02:00
boban fa9985cc33 feat: modal infrastructure + 11 modals (links, team, settings, workspace) 
wire-elements/modal v3 integration:
- Replace custom Alpine modal-container with <livewire:livewire-ui-modal />
- Customize vendor modal view with design tokens (bg-s1, dark overlay, smooth transitions)
- All modals extend ModalComponent, use $this->closeModal()

Modals built (PHP + Blade view + tests):
- ConfirmAction — reusable danger confirm with custom event dispatch
- CreateLink, EditLink, DeleteLink — full CRUD with workspace isolation
- InviteMember, EditMemberRole, RemoveMember — team management
- CreateApiToken, RevokeApiToken — Sanctum token lifecycle
- CreateWebhook, DeleteWebhook — webhook CRUD
- CreateWorkspace (uses CreateWorkspaceAction), DeleteWorkspace (confirmation input)

Fixes:
- Remove SoftDeletes from Webhook model (table has no deleted_at column)
- Auto-generate webhook secret when user leaves field empty
- Use correct role enum: owner/admin/editor/viewer (not member)
- Protected Livewire model properties replaced with re-query pattern
- Sidebar "New Workspace" button now dispatches openModal

Tests: 105/105 passing, 211 assertions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 12:41:14 +02:00
boban d0365fd34f fix: tests green + logout route + smoke test 
- Add POST /logout route (was missing from auth.php)
- Add workspaceId property to Analytics component (fixes #[On] binding)
- tests/bootstrap.php: force APP_ENV=testing before Docker OS env takes over
- phpunit.xml: use tests/bootstrap.php + force=true on APP_ENV
- Update AuthenticationTest, ProfileTest, LoginRateLimitTest to match current app structure
- Add tests/Feature/Livewire/WorkspacePagesTest.php: 11 workspace route tests
- scripts/smoke-test.sh: HTTP smoke test for all routes
- Result: 75/75 tests passing, all smoke routes 302→login

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 11:57:32 +02:00
boban ea9274be49 fix(quality): PHPStan level 6 compliance, Pint formatting 
- Add phpstan.neon with level 6 config and larastan extension
- Fix all 92 PHPStan errors: Eloquent relation generics, iterable
  value types, HasFactory generic annotations, missing return types
- Fix logic bugs: always-true Safari/Chrome comparison, nullsafe on
  non-nullable Carbon, unused $renderer suppressed with ignore rule
- Implement MustVerifyEmail on User model (was commented out in Breeze
  scaffold) to satisfy VerifyEmailController type contract
- Remove broken QrCode::newFactory() referencing non-existent factory
- Add @var docblocks for app('current_workspace') mixed resolution
- Apply Pint formatting: 53 style issues fixed across 168 files
- Test suite unchanged: 9 pre-existing assertSeeLivewire failures,
  55 tests passing

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 08:28:10 +02:00
boban 96ec518200 feat(domains): Domain model, DNS TXT verification action, pending verifier job 2026-05-16 08:14:33 +02:00
boban d7ca84dd2e feat(auth): TOTP 2FA enable/disable with recovery codes 2026-05-16 08:08:31 +02:00
boban a3930b5d25 test(security): assert Permissions-Policy header 2026-05-16 07:52:20 +02:00
boban 3f6b281c62 feat(security): add HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy headers 2026-05-16 07:51:33 +02:00
boban c8a6325a77 feat(webhooks): outgoing webhooks with HMAC signature, SSRF protection, retry 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 07:46:57 +02:00
boban 3568e67ca0 fix(api): use DeleteLink action for cache invalidation, fix validation, add delete tests 2026-05-16 07:42:56 +02:00
boban 1375519cdb feat(api): REST API v1 — links CRUD with Sanctum auth 
Adds /api/v1/workspaces/{ulid}/links endpoints (index, store, destroy)
protected by Sanctum token auth; adds HasApiTokens to User model and
AuthorizesRequests to base Controller; wires routes/api.php into bootstrap.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 07:38:45 +02:00
boban 8f1398380f fix(billing): pm_type/pm_last_four migration, narrow CSRF exclusion, EU paper size 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 01:46:54 +02:00
boban 06dbb1dffb feat(billing): Cashier Billable on Workspace, Stripe webhook route 
- Add Laravel\Cashier\Billable trait to Workspace model
- Register Workspace as Cashier customer model in AppServiceProvider
- Publish cashier config with EUR currency and de_DE locale defaults
- Add CSRF exclusion for stripe/* in bootstrap/app.php
- Add StripeWebhookTest verifying endpoint exists and rejects bad signatures

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 01:35:11 +02:00
boban 5c5ddbbe83 fix(i18n): remove stale redis del pattern, drop dead singleton 2026-05-16 01:29:45 +02:00
boban b121520ed6 fix(i18n): include namespace in cache key/query, clean up singleton, test isolation 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 01:27:10 +02:00
boban ce9e53d206 feat(i18n): database-backed translation loader with Redis cache 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 01:20:48 +02:00
boban 66e559173c feat(analytics): click recording job with IP hashing, device detection, Redis counters 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 00:56:52 +02:00
boban ebdcd141bb feat(redirect): hot-path redirect controller with Redis cache, 302/404/410 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 00:52:16 +02:00
boban 49f2e3b00f feat(workspace): create action, middleware, policies 
- CreateWorkspace action: creates workspace + owner member + sets default_workspace_id
- ResolveWorkspace middleware: resolves workspace by ULID, 404s for non-members
- WorkspacePolicy: owner/admin/editor/viewer role-based gates
- Register WorkspacePolicy in AppServiceProvider
- Add ulid string cast to Workspace model to ensure scalar after create()
- Feature test: CreateWorkspaceTest (4 assertions, passing)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 00:41:32 +02:00
boban ee0824302a fix(auth): remove dummy login route, validate locale allowlist 
- Remove no-op POST /login route that caused named-route collision and
  was testing throttle:5,1 middleware against a null handler.
- Rewrite LoginRateLimitTest to drive the real Volt login component via
  Volt::test(), verifying the RateLimiter blocks the 6th attempt with
  auth.throttle message; throttle is Laravel core, test confirms wiring.
- Add supported_locales allowlist to config/app.php ['de', 'en'].
- LocaleFromUser middleware now validates user locale against allowlist
  and falls back to app.locale for unknown/unsupported values.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 00:38:32 +02:00
boban 9d5d5af24d feat(auth): argon2id hashing, locale middleware, login rate limiting 
Switch default password hashing from bcrypt to argon2id, add
LocaleFromUser middleware appended to web stack, and add HTTP-level
throttle:5,1 on POST /login to satisfy the 429 rate-limit test.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 00:32:26 +02:00
boban d0bb8f92ee feat(models): add core domain models 
Creates Workspace, WorkspaceMember, WorkspaceInvitation, Link,
LinkVariant, Click (append-only), Plan, and Domain Eloquent models with
correct relationships. Updates User model with SoftDeletes, ULID
auto-generation on create, guarded/casts, and workspace relationships.
Fixes ProfileTest assertion to match SoftDeletes behavior on User.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-16 00:19:51 +02:00
boban 25dddf5293 feat: initial Nimuli scaffold with Laravel 12, Livewire 3, Octane, Reverb, Docker 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-15 23:51:57 +02:00