95 lines
2.9 KiB
Markdown
95 lines
2.9 KiB
Markdown
# MVP Verification
|
|
|
|
## Backend
|
|
|
|
Run:
|
|
|
|
```powershell
|
|
Set-Location backend
|
|
go test ./... -v
|
|
```
|
|
|
|
Expected: all backend tests pass.
|
|
|
|
## PostgreSQL Integration
|
|
|
|
Set `DATABASE_URL` to the live PostgreSQL test database before running integration checks. Do not commit real credentials.
|
|
|
|
Run:
|
|
|
|
```powershell
|
|
Set-Location backend
|
|
go test -tags integration ./internal/db -run TestPostgresPing -v
|
|
```
|
|
|
|
Expected: `TestPostgresPing` passes.
|
|
|
|
## Web
|
|
|
|
The frontend is Svelte-only.
|
|
|
|
Run:
|
|
|
|
```powershell
|
|
Set-Location apps/web
|
|
npx tsc --noEmit -p tsconfig.app.json
|
|
npm test -- --run
|
|
npm run build
|
|
npx playwright test
|
|
```
|
|
|
|
Expected: TypeScript check, component tests, production build, and Playwright smoke/E2E tests pass.
|
|
|
|
## Desktop
|
|
|
|
Run:
|
|
|
|
```powershell
|
|
Set-Location apps/web
|
|
npm run build
|
|
Set-Location ../desktop
|
|
npm run build
|
|
```
|
|
|
|
Expected: Tauri desktop bundle builds when Rust/Cargo is installed and the stable Rust toolchain is complete.
|
|
|
|
Current machine status:
|
|
- `rustup` was installed through winget.
|
|
- The latest desktop build attempt fails before project compilation because `cargo` is not available on PATH: `program not found`.
|
|
- Desktop verification remains blocked until Rust/Cargo is installed and visible to the shell. Then run `npm run build` from `apps/desktop`.
|
|
|
|
## Latest Audit Verification
|
|
|
|
Last audited: 2026-07-18.
|
|
|
|
- `backend`: `go test ./... -v` passed.
|
|
- `apps/web`: `npx tsc --noEmit -p tsconfig.app.json` passed.
|
|
- `apps/web`: `npm test -- --run` passed.
|
|
- `apps/web`: `npm run build` passed.
|
|
- `apps/web`: `npx playwright test` passed.
|
|
- `apps/desktop`: `npm run build` blocked by missing Cargo/Rust toolchain on the current machine.
|
|
|
|
Audit fixes included:
|
|
|
|
- Signed expiring auth session tokens replaced forgeable `user:<id>` tokens.
|
|
- Project and inbox HTTP handlers now read the authenticated user from bearer middleware instead of hard-coding user `1`.
|
|
- Project dashboard loading now checks project ownership before returning counters.
|
|
- Inbox confirmation preserves provenance with `source_inbox_item_id` on generated tasks, notes, and sources.
|
|
- Task sharing now rejects note/source links from another project.
|
|
- AI user keys are encrypted before storage, decrypted on selection, and can be checked with a per-user action rate limit.
|
|
- Web API calls now use the backend `/api` prefix and the Svelte shell includes an inbox suggestion confirmation E2E path.
|
|
|
|
## Manual MVP Flow
|
|
|
|
1. Open the client and enter the server IP or domain on the login screen.
|
|
2. Create or log in as a private-deployment user.
|
|
3. Create a project.
|
|
4. Add text to project inbox.
|
|
5. Click Analyze/Organize.
|
|
6. Confirm one task and one note from the suggestion list.
|
|
7. Assign the task to another system user.
|
|
8. Explicitly share one note with the task.
|
|
9. Search for text from the note body in global search.
|
|
10. Open an AI session under the project and reference the note.
|
|
11. Use Tauri quick capture to send text into the active project inbox.
|