6f1e7731d7
fix: implement subnet-aware CORS middleware to replace insecure wildcard origins
2026-04-21 17:58:14 +03:00
0d7ccf834b
docs: update SESSION_STATE for Phase 2 completion and handover
...
Session 19 summary:
- Network configuration fully environment-variable driven (zero hardcoded IPs)
- SSL proxies bound to SERVER_IP for cross-network access
- Frontend uses SERVER_IP for API routing
- Fixed username input focus-jumping bug in login form
- LAN access fully working (192.168.84.131)
- VPN access needs CORS subnet validation (currently blocked)
Known issues documented for next session:
- Temporary allow_origins=['*'] needs replacement with subnet validation
- VPN CORS blocking (subnet notation creates invalid origin URLs)
All 427 tests passing, build successful.
2026-04-21 17:56:11 +03:00
6bf95a0df0
fix: prevent username input from unmounting during typing in login form
...
The username input was conditionally hidden when it had a value, causing
the field to disappear and focus to jump to password when typing. Fixed by:
1. Always rendering the username input (removed conditional)
2. Using controlled input with value prop
3. Only auto-focus password when username is already entered
This fixes the focus-jumping bug that made it impossible to enter usernames.
2026-04-21 17:54:19 +03:00
904e153d8a
temp: allow all CORS origins for debugging LDAP login issue
...
Temporarily using allow_origins=['*'] to debug whether CORS is blocking
LDAP login requests from VPN client. This is insecure for production.
TODO: Fix subnet pattern matching in ALLOWED_ORIGINS configuration.
2026-04-21 15:32:01 +03:00
fcff97bae2
fix: bind SSL proxies to SERVER_IP for VPN/remote access
...
local-ssl-proxy was binding to 0.0.0.0 which doesn't work reliably for
cross-network access (VPN, remote clients). Now binds to SERVER_IP from
inventory.env, ensuring the proxy is reachable from all networks that can
reach the server's main IP address.
2026-04-21 15:27:28 +03:00
2daeb1e2ae
fix: use SERVER_IP from network config for backend API calls from VPN
...
When accessing from VPN/Tailscale (e.g., 100.78.182.28), frontend was trying
to reach backend on that same IP, but backend listens on SERVER_IP instead.
Now uses SERVER_IP from network.json config, ensuring remote clients connect
to the correct server address regardless of their access network.
2026-04-21 15:23:12 +03:00
3c9e5a8149
refactor: remove all hardcoded IPs/subnets, use environment variables only
...
- Next.js allowedDevOrigins now loaded from ALLOWED_DEV_ORIGINS env var
- start_server.sh generates ALLOWED_DEV_ORIGINS from EXTRA_ALLOWED_ORIGINS
- Subnet notation (10.0.0.0/24) auto-converts to wildcard patterns (10.0.0.*)
- Individual IPs convert to subnet patterns (192.168.1.100 -> 192.168.1.*)
- Zero hardcoded IPs in source code - all from inventory.env
2026-04-21 15:21:05 +03:00
2078cd9ade
fix: resolve CORS preflight issues and Next.js dev origin warnings
...
- Simplify backend CORS middleware to use standard FastAPI implementation
- Keep subnet validation function for future use in route-level checks
- Add Tailscale subnet pattern to Next.js allowedDevOrigins config
- Both individual IPs and subnet configurations now work correctly
2026-04-21 15:19:45 +03:00
983d6e4bb4
feat: add subnet-based CORS validation support for VPN/Tailscale origins
...
- Add ipaddress module for subnet parsing (10.0.0.0/24 format)
- Implement subnet validation in CORS middleware
- Separate individual IPs from subnet definitions in EXTRA_ALLOWED_ORIGINS
- Custom SubnetAwareCORSMiddleware for dynamic origin validation
- Support both exact IP matches and subnet ranges
- Backward compatible with existing ALLOWED_ORIGINS list
2026-04-21 15:17:29 +03:00
8825118795
chore: update service worker
2026-04-21 15:09:39 +03:00
cc42e7cf29
docs: update SESSION_STATE and VERSION for Phase 2 completion and handover
2026-04-21 15:09:35 +03:00
ca68aeae52
chore: update service worker
2026-04-21 15:02:10 +03:00
6d43b16e6e
docs: update SESSION_STATE for Phase 2 Task 6 completion
2026-04-21 14:53:59 +03:00
3df15cf68f
feat(phase2): add photo display to inventory card with modal viewer
...
- Create PhotoModal component for full-res photo viewing
- Add photo thumbnail (200px square) to inventory item card
- Implement photo modal trigger on thumbnail click
- Add fallback text when no photo available
- Modal closeable via X button, click outside, or Escape key
- Image scales responsively without stretching
- Add comprehensive test coverage (30+ tests)
- All 427 tests passing, build successful
- TypeScript strict mode compliant
2026-04-21 14:53:27 +03:00
74c91b117f
test(phase2): fix mobile E2E test Playwright fixture structure - 15 tests valid
2026-04-21 14:45:24 +03:00
982b09f7b4
test(phase2): add mobile camera integration testing suite and report
2026-04-21 14:43:32 +03:00
5b4bf81444
fix(phase2): remove uppercase text from ItemDetailModal labels (AI_RULES compliance)
2026-04-21 13:47:40 +03:00
a8d7e5ac09
feat(phase2): add admin photo replacement button with ItemDetailModal
...
- Add ItemDetailModal component for viewing item details and replacing photos
- Add photo replacement/deletion endpoints to API layer (PUT/DELETE /items/{id}/photo)
- Update InventoryTable to open detail modal on item click
- Show current photo thumbnail with Replace/Delete buttons
- Support uploading new photo with ItemPhotoUpload component
- Delete old photo on backend when replacing (no orphaned files)
- Full test coverage: 18 tests for ItemDetailModal component
- All 393 tests passing, zero TypeScript errors
- Build verified successfully
2026-04-21 13:30:38 +03:00
2ba1994022
fix: remove console.error and update uploadPhoto type signature in item creation
2026-04-21 13:26:09 +03:00
661094cfce
docs: update SESSION_STATE for Phase 2 Task 3 completion (photo upload integration)
2026-04-21 13:20:31 +03:00
31899be050
feat(phase2): integrate photo upload into item creation
...
- Create frontend/app/items/create.tsx with multi-step item creation workflow (Details → Photo Upload → Preview → Confirm)
- Create frontend/hooks/useItemCreate.ts custom hook managing form state, step navigation, and photo upload
- Add integration tests for item creation workflow with photo upload support
- Photo upload step supports manual crop UI with crop bounds submission
- ManualCropUI visible by default with toggle to use full photo
- Photo uploaded before item confirmation, ensuring photo is attached
- Works with mobile camera capture via ItemPhotoUpload component
- All 374 tests passing
2026-04-21 13:20:06 +03:00
627711f7e3
chore: update service worker
2026-04-21 13:11:57 +03:00
359f317200
docs: update SESSION_STATE for Phase 2 Task 2 completion
2026-04-21 13:06:00 +03:00
b2e2daf40d
feat(phase2): implement ManualCropUI with drag handles
...
- useCropHandles.ts: Hook managing crop bounds state, drag operations, and constraints
- 8 draggable handles (4 corners + 4 edges)
- Real-time crop bounds calculation during drag
- Constrained within image bounds (no dragging outside)
- Minimum crop size enforcement (100x100px)
- Support for mobile (touch) and desktop (mouse) events
- Bounds validation on initialization
- ManualCropUI.tsx: Interactive crop preview component
- Responsive image display with calculated scaling
- Semi-transparent overlay outside crop box with visible bounding box
- 8 draggable handles with visual feedback (highlight/scale on hover)
- 'Use Full Photo' button to clear crop and show full image
- Real-time onCropChange callbacks to parent
- Error handling for failed image loads
- Touch and mouse event support (desktop + mobile)
- TypeScript strict mode compliant
- Tests: 26 comprehensive test cases
- Hook tests (26 passing): initialization, setCrop, resetCrop, drag operations (corners, edges), constraints, endDrag, edge cases
- Component tests (26 passing): rendering, handles, overlay, callbacks, button, error handling, dimensions, touch/mouse support, responsive behavior, size enforcement, bounds display
All 364 tests passing (13 test files, zero regressions)
Minimum crop size: 100x100px
Handle visual feedback on hover/drag
TypeScript strict mode: ✓
2026-04-21 13:05:37 +03:00
5a64dadc1e
fix(phase2): resolve code quality issues in ItemPhotoUpload (act warnings, toast cleanup, dual error handling)
...
Fixed 3 critical code quality issues:
1. Act() warnings in tests (9 tests):
- Wrapped all async state updates in act() blocks in usePhotoUpload.test.ts
- Tests using waitFor() now properly await state updates within act()
- All 21 tests pass with zero act() warnings
2. Missing toast cleanup on unmount:
- Added toastIdRef to track pending toast IDs
- Added cleanup useEffect that dismisses toasts on component unmount
- Prevents memory leaks and orphaned toast notifications
3. Dual error reporting channels (lines 23-28):
- Removed useEffect that synced hook error to local state AND called onError callback
- Now syncs hook error to local state only (for display)
- Parent components rely on hook error state, reducing dual-path confusion
- Toast error calls are explicit in catch block
Test Results:
- Frontend: 312/312 tests passing (includes 21 photo upload tests)
- Act() warnings: Eliminated
- No regressions introduced
2026-04-21 12:50:44 +03:00
db9aafd47f
feat(phase2): implement ItemPhotoUpload component and hook
2026-04-21 12:31:23 +03:00
e46777b933
merge: Phase 1 image system implementation complete
...
- Database: Added photo_path, photo_thumbnail_path, photo_upload_date fields
- Services: ImageStorage (file ops) + ImageProcessor (image processing pipeline)
- API: POST/PUT /api/items/{id}/photo upload endpoints with validation
- API: GET /api/items/{id} returns photo URLs
- Static: FastAPI StaticFiles mount for /images/ directory
- Tests: 127+ comprehensive tests across all components
- Security: Fixed race conditions, path traversal, crop validation
- Ready for Phase 2 (frontend UI)
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com >
2026-04-20 22:47:31 +03:00
294555c574
feat(phase1): add static file serving for /images/
2026-04-20 22:43:33 +03:00
a6753e077f
docs: update SESSION_STATE.md - Task 4 Photo API fixes complete
2026-04-20 22:39:40 +03:00
af8dcbae3a
fix(phase1): fix race condition, path traversal, double processing, validation in photo API
2026-04-20 22:39:02 +03:00
8d2750cfa3
fix(phase1): fix deprecated PIL APIs, private API, exception handling, magic numbers, transparency, DoS prevention
2026-04-20 22:21:51 +03:00
3aafacab12
feat(phase1): implement OpenCV image processing pipeline
...
- Create ImageProcessor service with EXIF orientation detection
- Implement smart cropping via OpenCV contour detection (10% padding)
- Add text orientation detection using Hough line transform
- Resize and compress images to 1200px with 85% JPEG quality
- Generate 200px square thumbnails with center crop
- Fallback to Pillow if OpenCV fails
- Comprehensive test suite: 28 tests all passing
- File size validation (reject >10MB)
- Graceful error handling for corrupted/invalid images
- Update requirements.txt with opencv-python, piexif, python-magic
2026-04-20 22:17:11 +03:00
01321bf607
fix(phase1): restore API contract while preserving N+1 optimization
...
The N+1 optimization in save_image() pre-lowercases the existing_files list
before passing to get_unique_filename(). However, this broke the API contract:
the function should handle any-case input to remain robust.
Changed: get_unique_filename() now defensively lowercases the input list,
ensuring collision detection works regardless of input case.
Benefits:
- Fixes implicit API contract change (function expected any-case input)
- Maintains N+1 optimization (pre-lowercasing still works)
- Supports both optimization and edge cases (direct function calls)
- All 22 tests pass
2026-04-20 22:09:58 +03:00
2951ed81eb
fix(phase1): add logging, remove unused import, add error handling
2026-04-20 22:06:18 +03:00
ea49cd6e4a
feat(phase1): add image storage utilities
...
- Create backend/services/image_storage.py with 4 core functions:
- sanitize_filename(): remove unsafe chars, limit to 255 chars, convert to lowercase
- get_unique_filename(): handle collisions with UUID suffix (format: {name}_{uuid8}_{variant}.jpg)
- ensure_image_directories(): create /images/ root and category subdirs on startup
- save_image(): save bytes to /images/{category}/{filename}, returns relative path
- Create comprehensive test suite (22 tests) covering all functionality
- Integrate ensure_image_directories() into FastAPI startup event
- Directory structure: /images/{category}/{filename}
- Collision handling: auto-suffix with UUID if filename exists
- All tests passing, pathlib.Path for safe operations
2026-04-20 21:57:26 +03:00
92f6977cae
fix(phase1): add photo fields to schemas and set datetime default
2026-04-20 21:49:51 +03:00
6ed88fdb84
feat(phase1): add photo fields to Item model
2026-04-20 21:36:18 +03:00
39fab336ba
bede-various
2026-04-19 19:21:08 +03:00
d4707d9881
chore: update .gitignore with 30+ missing patterns
...
Added missing .gitignore patterns:
- IDE & editor configs (.vscode, .idea, *.swp, *~, etc.)
- Test coverage & reports (playwright-report, htmlcov, .coverage)
- TypeScript build cache (*.tsbuildinfo)
- Local dev environment (.env.local, .env.test, etc.)
- Git artifacts (*.orig, *.rej, *.patch~)
- Test images & assets (_images.tests/, _images/)
Also removed tracked test artifacts from git:
- .coverage file
- frontend/playwright-report/ directory
Coverage improvement: 40+ → 71 patterns (100% complete)
2026-04-19 19:20:09 +03:00
109fe1c856
chore: update VERSION.json to 1.12.0
2026-04-19 19:14:56 +03:00
d85c72e1d6
Build [v0.2.0]
...
Major UI/UX optimization release:
- Removed all bold fonts throughout app (291 replacements) - font-normal standard
- Full-app spacing optimization: Scanner, Inventory, Logs, Admin, Login pages
- Fixed mobile portrait viewport overflow issues (~136px gained on mobile)
- Updated AI_RULES.md Section 3: NO BOLD FONTS requirement
- Increased subtitle/label font sizes for readability
- Mobile-first responsive breakpoints implemented
Test results: 291/291 frontend, 41/41 backend, zero TypeScript errors
Version bumped: 0.1.0 → 0.2.0
2026-04-19 19:12:55 +03:00
5664a904a2
refactor: compact component spacing throughout app
...
PHASE 3 - COMPONENT SPACING OPTIMIZATION:
components/IdentityCheckOverlay.tsx:
- Modal padding: p-8 sm:p-10 → p-4 md:p-6
- Spacing: space-y-8 → space-y-3 md:space-y-4
components/CameraView.tsx:
- Container gaps: gap-6 → gap-3 md:gap-4
components/AIOnboarding.tsx (4 fixes):
- Main sections: gap-6 → gap-3 md:gap-4
- Live mode: gap-6 → gap-3 md:gap-4
- Results form: gap-6 → gap-3 md:gap-4
- Step view: gap-6 → gap-3 md:gap-4
components/ScannerSection.tsx:
- Container spacing: space-y-6 → space-y-3 md:space-y-4
- Scanner section: space-y-4 → space-y-2 md:space-y-3
components/LogsTable.tsx (2 fixes):
- Empty state: gap-6 → gap-3 md:gap-4
- Modal: p-6 sm:p-10 space-y-8 → p-4 md:p-6 space-y-3 md:space-y-4
Results:
- All 291 tests passing
- Zero TypeScript errors
- Mobile-first spacing applied throughout
- Consistent responsive pattern across all components
2026-04-19 19:06:19 +03:00
ceaae5bb8f
refactor: optimize spacing on main pages (inventory, admin, logs, scanner)
...
PHASE 2 - HIGH PRIORITY PAGE OPTIMIZATIONS:
app/inventory/page.tsx (11 fixes):
- Main container: space-y-6 → space-y-3 md:space-y-4
- Header spacing: mb-6 md:mb-10 → mb-4 md:mb-6
- Modal padding: p-8 → p-4 md:p-6
- Category editor: space-y-6 → space-y-3 md:space-y-4
- Box manager: p-8 gaps 6 → p-4 md:p-6 gaps 3 md:gap-4
- Grid gaps: gap-6 → gap-3 md:gap-4 throughout
app/admin/page.tsx (4 fixes):
- Main container: space-y-6 md:space-y-10 → space-y-3 md:space-y-6
- Section spacing: space-y-6 md:space-y-8 → space-y-3 md:space-y-4
- Grid gaps: gap-6 md:gap-8 → gap-3 md:gap-4
app/logs/page.tsx (3 fixes):
- Main container: space-y-6 md:space-y-10 → space-y-3 md:space-y-6
- Header gap: gap-6 → gap-3 md:gap-4
- Filter section: space-y-6 → space-y-3 md:space-y-4
app/page.tsx (Scanner):
- Header gap: gap-4 mb-6 → gap-3 md:gap-4 mb-3 md:mb-4
- Controls padding: px-4 py-2 → px-3 py-2
- Footer: mt-20 mb-8 → mt-12 md:mt-20 mb-4 md:mb-8
- Box modal: p-6 → p-4 md:p-6, gaps optimized
components/AdminOverlay.tsx (4 fixes):
- Header padding: p-6 → p-3 md:p-6
- Content spacing: space-y-8 → space-y-3 md:space-y-4
- Section spacing: space-y-4 → space-y-2 md:space-y-3
- User/category grids: gap-2, p-4 → p-3 md:p-4
Tests: 291/291 passing - No regressions
2026-04-19 19:05:25 +03:00
2cbc036eb2
fix: critical mobile viewport fixes - login, modals, page constraints
...
- Remove min-h-screen or make responsive (md:min-h-screen for desktop only)
- Login modal: p-8 → p-4 md:p-6, space-y-8 → space-y-3 md:space-y-4
- NewItemDialog: responsive spacing p-4 md:p-6, gaps 3 md:gap-4
- StockAdjustmentPanel: p-6 → p-4 md:p-6, gaps/spacing reduced for mobile
- All container padding and gaps now follow mobile-first pattern
- Fixes viewport overflow on 375px portrait mode
- Tests: 291/291 passing
2026-04-19 19:04:17 +03:00
f05fe4b1b6
refactor: extend admin spacing optimization to all components
...
Phase 3: Complete admin dashboard spacing standardization
AiManager component:
- p-5 md:p-8 → p-4 md:p-6 panel padding
- space-y-6 → space-y-4 container spacing
- mb-1 removed, gap-4 → gap-3 in header
- grid gap-6 → gap-4 for API keys section
- space-y-1.5 → space-y-1 for form fields
- py-2 → py-1.5 inputs, py-2.5 → py-2 buttons
- textarea p-6 → p-4, min-h 200px → implicit compact
- gap-4 → gap-3 in info section
CategoryManager component:
- p-5 md:p-8 → p-4 md:p-6 panel padding
- space-y-6 → space-y-4 container spacing
- gap-4 → gap-3 icon header gap
- py-3 → py-2 button padding
- Modal: space-y-4 → space-y-3, p-6 sm:p-10 → p-6 consistent
- py-2.5 → py-1.5 inputs
- h-32 textarea → h-24 compact
Tests: 291/291 passing, Build: success
Total admin dashboard savings: ~150px vertical (all 4 components)
2026-04-19 18:59:36 +03:00
1f45e4981b
refactor: optimize admin spacing - phase 2 refinements
...
Medium-impact spacing reductions:
- DatabaseManager: gap-6→gap-4 flex gap, sm:pr-6→sm:pr-4, sm:pl-6→sm:pl-4
- IdentityManager: modal header mb-2→mb-3 for better proportion
- All panels: maintain consistent gap-3 grid spacing
- Form field spacing: space-y-1 throughout for compact form layouts
- Modal padding: p-6 consistent across all dialogs
- Input heights: py-1.5 for compact density
Tests: 291/291 passing, Build: success
Estimated additional ~20-30px vertical savings vs Phase 1
2026-04-19 18:57:16 +03:00
c4c36dc6b6
fix: admin UI spacing - reduce container/padding, increase typography
...
Phase 1: High-impact spacing reductions
- DatabaseManager: space-y-4 md:space-y-5, p-8→p-6, text-xs→text-sm labels
- LdapManager: space-y-3, p-6, py-2→py-1.5 inputs, button heights reduced
- IdentityManager: p-6, space-y-1 user list, modal input py-1.5
- All panels: mb-3 instead of mb-4, gap-3 instead of gap-4
- Button heights: py-4→py-2.5 (Export), py-3→py-2 (LDAP buttons)
- Input padding: py-2→py-1.5, py-3→py-1.5 for better density
Tests: 291/291 passing, Build: success, zero TypeScript errors
Estimated ~80-100px vertical savings across admin dashboard
2026-04-19 18:55:20 +03:00
7eafd45ab1
refactor: polish spacing details (Phase 3 - Low-Impact)
2026-04-19 18:45:14 +03:00
12b2ef26cf
fix: implement Phase 2 medium-impact spacing reductions
...
Applied systematic spacing optimizations across admin manager components (40px savings):
DatabaseManager.tsx:
- Input field padding: py-3 → py-2 (3 inputs: retention_count, schedule_hour, schedule_freq_days)
- Form field spacing: space-y-2 → space-y-1.5 (Max Backups field group)
- Grid gaps: gap-4 → gap-3 (storage policy fields)
- Item list spacing: space-y-2 → space-y-1.5 (backup list)
- Modal form spacing: space-y-4 → space-y-3 (recovery points section)
- Backup metadata text: text-[11px] → text-xs (created_at + filesize display)
LdapManager.tsx:
- Input field padding: py-2.5 → py-2 (4 inputs: server_uri, base_dn, user_template, groups_dn)
- Form field spacing: space-y-1.5 → space-y-1 (all label+input groups)
- Button padding: py-2.5 → py-2 (test connection), py-3 → py-2.5 (save policy)
IdentityManager.tsx:
- Input field padding: py-3 → py-2 (username, password, role in edit modal)
- Form field spacing: space-y-4 → space-y-3 (edit modal form)
- Form field labels: space-y-1.5 → space-y-1 (all 3 fields)
- User list spacing: space-y-2 → space-y-1.5 (user items)
AiManager.tsx:
- Grid gaps: gap-4 → gap-3 (provider options grid)
- Input field padding: py-3 → py-2 (Gemini/Claude API key inputs)
- Form field spacing: space-y-2 → space-y-1.5 (API key field groups)
- Modal spacing: space-y-6 → space-y-3 (provider access keys section)
- Prompt section spacing: space-y-4 → space-y-3 (system prompt area)
CategoryManager.tsx:
- Grid gaps: gap-3 → gap-2.5 (category items grid)
- Input field padding: py-3.5 → py-2.5, py-4 → py-2.5 (name + description inputs)
- Form field spacing: space-y-6 → space-y-3, space-y-1.5 → space-y-1 (edit modal)
Test Results:
- Frontend (Vitest): 291/291 tests passing ✓
- Backend (Pytest): 41/41 tests passing ✓
- Total: 332 tests validated, zero regressions
All changes maintain visual hierarchy and premium density standards without sacrificing usability.
2026-04-19 18:36:44 +03:00
08c1eb5074
refactor: optimize spacing and typography (Phase 1 - High-Impact)
...
DatabaseManager:
- Reduce container spacing: space-y-6 md:space-y-8 → space-y-4 md:space-y-5
- Reduce panel padding: p-5 md:p-8 → p-4 md:p-6
- Reduce inner section spacing: space-y-6 → space-y-4, space-y-8 → space-y-5
- Reduce grid gap: gap-6 → gap-4
- Reduce button heights: Export/Import py-4 → py-3, Force Backup py-3 → py-2.5
LdapManager:
- Reduce container spacing: space-y-6 → space-y-4
- Reduce panel padding: p-5 md:p-8 → p-4 md:p-6
- Reduce grid gaps: gap-4 → gap-3 (2 instances)
- Reduce button heights: py-3 → py-2.5 (Test Connection, Save LDAP Policy)
IdentityManager:
- Reduce panel padding: p-5 md:p-8 → p-4 md:p-6
- Reduce user list spacing: space-y-2.5 → space-y-2
- Reduce modal padding: p-8 → p-6
- Reduce modal header gap: mb-6 → mb-4
Results: ~80px vertical space saved (~7% density gain on 1920px viewport)
All 291 tests passing.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com >
2026-04-19 18:34:11 +03:00
