Repository navigation
FlowStack V2: setup tooling, onboarding, invitations and email templates - #12
Open
jacksonkasi1 wants to merge 29 commits into
Open
jacksonkasi1 wants to merge 29 commits into
jacksonkasi1 wants to merge 29 commits into
Conversation
- Root scripts for doctor, dev:local/dev:secrets, db:*, secrets:*, sentry:verify, prepare (husky). - Dev dependencies: husky, lint-staged, postgres (db status/migrate), pglite-socket (tests). - Sentry SDK for the TanStack app. - bun audit: 45 advisories (5 critical) on dev resolved by in-range updates (bun audit fix; vitest, shadcn, react-devtools) and a solid-js ^1.9.17 override. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Project name, optional integrations, safe ports, and v1 .flowstack.json compatibility. Shared libraries for env manifest and project config. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bun run dev uses Infisical when enabled and never falls back silently; dev:local and dev:secrets choose explicitly. Non-development secrets are CI-only and always refused in AI agent sessions. Turborepo passes injected variables to dev tasks; builds hash only public values. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Hash-based migration status detects migrations drizzle would skip because of out-of-order journal timestamps. Production migrations are CI-only; push/drop are blocked outside development. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…logs - Sentry v11 dataCollection set explicitly (v11 collects everything when unset); shared privacy baseline and beforeSend scrubber in @repo/config. - /health/live and /health/ready (database), request IDs, safe 500s. - R2 credentials required only when storage is enabled. - Build with NODE_ENV=production: an unset NODE_ENV made Bun inline "development", which enabled SQL query logging in production bundles. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both apps: optional Sentry with the shared privacy baseline, root error boundaries (TanStack also reports SSR errors), development-only /debug/sentry, source maps only for Sentry uploads and deleted afterwards. Google, magic link and uploads follow TEMPLATE_FEATURES. Fix: axios read the undocumented VITE_API_URL instead of VITE_API_BASE_URL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Images tagged by release; candidates deployed with no traffic and health-checked before promotion; optional auto-rollback; rollback and status commands; Secret Manager references so values never pass through the deployer; preflight validation; production deploys CI-only. Legacy key files and env-file secrets keep working with warnings. Manual, approval-gated GitHub workflow using Workload Identity Federation and Infisical OIDC for migrations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds a full-history gitleaks job (pinned, checksum-verified; failure to install fails the job), actionlint, shellcheck, a minimal-integrations preset, sentinel-secret builds checked by check-bundle-secrets, a tagged release workflow and Dependabot for dev. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AGENTS.md is the single source of agent rules (CLAUDE.md imports it, AGENT.md points to it); removes unrelated WXT/admin examples. New guides for Infisical, database, Sentry, git hooks, CI/CD and upgrading; quick start and setup docs match the commands. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…udit records A candidate that failed verification stayed Ready and could later be selected as the rollback target once a newer release was promoted. Failed revisions are now marked with a failed-<release> traffic tag (0% traffic, not deleted) and excluded from rollback selection. Every run can write a JSON audit record (DEPLOY_REPORT_FILE), uploaded by the workflow. Actions updated to current majors (auth/setup-gcloud v3, upload-artifact v7). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
infisical run passes its own environment, including INFISICAL_TOKEN, to the child. A launcher now strips Infisical credentials before the app starts. Machine identities using Universal Auth exchange client credentials (read from the environment, never argv) for a short-lived token; a rejected identity stops before any command runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Neon hosts keep the Neon HTTP driver; other hosts use postgres.js (DATABASE_DRIVER overrides, DATABASE_POOL_MAX sizes the pool). Local, Docker and Cloud SQL databases now work at runtime, not only for migrations, so doctor no longer warns about non-Neon hosts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bun run setup now checks Node.js and Bun first, then (after install) validates secrets (local .env or Infisical with an offer to sign in), checks database connectivity, applies development migrations only with consent (prompt, --migrate or --yes), and runs doctor. Reruns offer to reuse earlier choices and resume. Setup keeps zero third-party imports so it runs before bun install; onboarding runs as a separate process. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
flowstack:upgrade:check reports what a newer starter release changes, using .flowstack.json sourceCommit as the merge base: clean updates, three-way merges, conflicts, deletions, application-owned files (report only), new migrations (never executed) and dependency changes (majors flagged, never applied). flowstack:upgrade previews, requires a clean tree and confirmation, backs up every touched file, writes conflict proposals instead of overwriting, and records the new version only once conflicts are resolved (--mark-resolved). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tests/e2e-api.test.ts runs the production API build against real migrations on an isolated PostgreSQL with a local mail catcher: registration, email-link verification, sign-out/in, session isolation, forged/tampered/bearer credentials, cross-site requests, per-user and per-organization storage authorization, invitations, safe errors and log redaction. Verified to fail when the membership check is removed. e2e/ (Playwright) walks the browser journey (protected redirect, sign-up, verification, onboarding, sign-out, wrong password, sign-in) and runs for all four presets in CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Setup docs describe the post-install checks, consent for migrations and resuming; README and AGENTS.md list test:e2e and the upgrade commands; CI docs add the e2e job to the required checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A port check that never answered could stall doctor indefinitely; it now reports the port as unavailable after two seconds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Better Auth resolves no client IP from a multi-hop X-Forwarded-For chain unless the proxies are trusted, so behind Google's load balancer (client, lb-ip) every client shared one rate-limit bucket: a few failed sign-ins from anyone limited all users. AUTH_TRUSTED_PROXIES and AUTH_IP_HEADERS now configure advanced.ipAddress (default unchanged); deploy preflight warns while unset. E2E tests prove separate buckets and that a forged left-most address cannot escape a limit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
jacksonkasi1
marked this pull request as ready for review
October 27, 2026 14:54
|
Sorry @jacksonkasi1, your pull request is larger than the review limit of 150,000 diff characters |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Refresh the shared entry experience in Vite and TanStack: generic onboarding artwork, clearer progress, resumable workspace/team setup, invitation acceptance, session refresh and verification success screens. Valid recipient-matched invitations remove redundant verification while ordinary signups retain verification.
Keep the existing design across all four emails, with Peacock India branding, configurable example.com links and social icons. Correct the bottom red strip placement and React Email preview runtime. Notification features are excluded. No database migration is required.
This branch also includes the existing FlowStack V2 setup, secrets, monitoring, deployment and upgrade tooling commits proposed in #11. That PR uses a fork without push access; this draft publishes current work in this repository while preserving that history.
Validation
Leave unmerged as requested. Auto-merge has not been enabled.
Dependency maintenance
Commit 9107bb4 updates Better Auth to 1.7.12, Drizzle ORM to 0.45.4, Drizzle Kit to 0.31.11, Hono to 4.13.14 and its Node adapter to 2.1.5, plus compatible database, S3, routing and build-tool fixes. All affected workspace declarations are aligned. The onboarding hook now exports a portable public RequestContext type; its fetch dependency matches Better Auth 1.7.12 exactly.
Frozen-lockfile installation, strict lint/type/build and bun audit pass. Audit reports zero known vulnerabilities. Local integration tests passed: 111 passed, 4 skipped, zero failures. All 12 CI jobs passed for 9107bb4, including shared lint/types/tests/audit, all five preset builds, four browser configurations, secret scanning and workflow validation. Successful verification run. The duplicate local preset matrix was still running when CI completed the full matrix. See docs/advanced/dependency-maintenance.md for version choices and upstream release links.