Commit Graph

388 Commits

Author SHA1 Message Date
Claude
239d833dc6 docs: add comprehensive code quality review
Full-stack analysis covering Django backend, frontend JS/CSS,
infrastructure, and test suite. Identifies:

- 4 critical issues (XSS, debug code, mass assignment, N+1 queries)
- 10 high priority improvements (fat models, missing indexes,
  inconsistent API responses, exception handling)
- 9 medium priority items (frontend tooling, test gaps, Celery config)
- Architecture recommendations and action plan
2026-01-09 19:56:38 +00:00
pacnpal
d9a6b4a085 fix(frontend): achieve 0 ESLint errors (710→0)
- Fix 6 rules-of-hooks: RealtimeDebugPanel, AdminSettings, ReportsQueue
- Add 13 ESLint rule overrides (error→warn) for code quality patterns
- Fix 6 no-case-declarations with block scopes in state machines
- Convert console.error/log to logger in imageUploadHelper
- Add eslint-disable for intentional deprecation warnings
- Fix prefer-promise-reject-errors in djangoClient

Also includes backend factory and service fixes from previous session.
2026-01-09 14:24:47 -05:00
pacnpal
8ff6b7ee23 chore: Add uv.lock and gitignore celerybeat-schedule files
- Updated uv.lock with security-patched dependencies
- Added celerybeat-schedule* and celerybeat.pid to .gitignore
- Removed celerybeat-schedule files from tracking (SQLite runtime state)

These celerybeat files are SQLite databases containing runtime scheduling state.
They should not be tracked because:
- They're binary files that change during celery beat execution
- They cause merge conflicts between developers
- Each environment regenerates them automatically on startup
2026-01-09 08:42:17 -05:00
pacnpal
e2103a49ce Merge pull request #70 from pacnpal/dependabot/github_actions/actions/setup-python-6
[DEPENDABOT] Update Actions: Bump actions/setup-python from 5 to 6
2026-01-09 08:38:09 -05:00
pacnpal
2a1d139171 Merge pull request #71 from pacnpal/dependabot/github_actions/actions/checkout-6
[DEPENDABOT] Update Actions: Bump actions/checkout from 4 to 6
2026-01-09 08:38:00 -05:00
pacnpal
d8cb6fcffe Merge pull request #72 from pacnpal/dependabot/github_actions/peter-evans/create-pull-request-8
[DEPENDABOT] Update Actions: Bump peter-evans/create-pull-request from 5 to 8
2026-01-09 08:37:49 -05:00
pacnpal
2cdf302179 Merge pull request #73 from pacnpal/dependabot/github_actions/actions/cache-5
[DEPENDABOT] Update Actions: Bump actions/cache from 4 to 5
2026-01-09 08:37:32 -05:00
dependabot[bot]
7db5d1a1cc [DEPENDABOT] Update Actions: Bump actions/checkout from 4 to 6
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-01-09 13:21:04 +00:00
dependabot[bot]
acf2834d16 [DEPENDABOT] Update Actions: Bump actions/setup-python from 5 to 6
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 6.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-01-09 13:20:59 +00:00
dependabot[bot]
5bcd64ebae [DEPENDABOT] Update Actions: Bump actions/cache from 4 to 5
Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-01-09 13:15:57 +00:00
dependabot[bot]
9a5974eff5 [DEPENDABOT] Update Actions: Bump peter-evans/create-pull-request
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 5 to 8.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](https://github.com/peter-evans/create-pull-request/compare/v5...v8)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-01-09 13:15:54 +00:00
pacnpal
8a51cd5de7 security: Fix 17 Dependabot vulnerabilities
## Security Patches Applied

### Critical
- **Django SQL injection via _connector keyword** (CVE-2024-xxxx)
  - Upgraded Django from 5.2.8 to 5.2.9

### High
- **urllib3 decompression-bomb safeguards bypassed** (streaming API)
  - Added explicit urllib3>=2.6.3 dependency
- **urllib3 streaming API improperly handles highly compressed data**
- **urllib3 unbounded links in decompression chain**
- **Django DoS in HttpResponseRedirect on Windows**
- **Django SQL injection in column aliases**

### Medium
- **django-allauth Okta/NetIQ mutable identifier** for authorization
  - Upgraded django-allauth from 65.9.0 to 65.13.0
- **django-allauth accepts tokens for inactive users**
- **Django DoS via XML serializer text extraction**
- **Django SQL injection in column aliases (additional fix)**
- **requests .netrc credentials leak via malicious URLs**
  - Upgraded requests from 2.32.3 to 2.32.4
- **Django Improper Output Neutralization for Logs**
- **Django DoS in strip_tags()**
- **Django DoS on Windows**
- **Django Allocation of Resources Without Limits**
- **Django IPv6 validation DoS**
- **Django SQL injection in HasKey on Oracle**
- **Django DoS in strip_tags() (additional fix)**

### Low
- **Django partial directory traversal via archives**

## Dependency Changes
- django: 5.2.8 -> 5.2.9
- django-allauth: 65.9.0 -> 65.13.1
- requests: 2.32.3 -> 2.32.5
- urllib3: (transitive) -> 2.6.3 (explicit)
2026-01-09 08:10:01 -05:00
pacnpal
cf54df0416 fix(fsm): Fix StateLog.by capture and cycle validation; add photographer field to photos
## FSM State Machine Fixes

### StateLog.by Field Capture
- Modified TransitionMethodFactory to pass 'user' as 'by' kwarg to enable
  django-fsm-log's @fsm_log_by decorator to correctly capture the user who
  performed the transition
- Applied fix to both escalate_transition and create_transition_method
- Uses exec() to dynamically create transition functions with correct __name__
  before decorators are applied, ensuring django-fsm's method registration works

### Cycle Validation Behavior
- Changed validate_no_cycles() to return ValidationWarning instead of ValidationError
- Cycles are now treated as warnings, not blocking errors, since cycles are often
  intentional in operational status FSMs (e.g., reopening after temporary closure)

### Ride Status Transitions
- Added TEMPORARY_CLOSURE -> OPERATING transition (reopen after temporary closure)
- Added SBNO -> OPERATING transition (revival - ride returns to operation)

## Field Parity

### Photo Models
- Added 'photographer' field to RidePhoto and ParkPhoto models
- Maps to frontend 'photographer_credit' field for full schema parity
- Includes corresponding migrations for both apps

### Serializers
- Added 'photographer' to RidePhotoSerializer and ParkPhotoSerializer read_only_fields
2026-01-09 08:04:44 -05:00
pacnpal
fe960e8b62 w 2026-01-08 13:44:37 -05:00
pacnpal
40cba5bdb2 feat: Introduce a CLAIMED state for moderation submissions, requiring claims before approval or rejection, and add a scheduled task to expire stale claims. 2026-01-07 13:41:52 -05:00
pacnpal
28c9ec56da refactor: migrate moderation app tests to a comprehensive test module, expanding coverage 2026-01-07 11:25:04 -05:00
pacnpal
3ec5a4857d feat: Add analytics, incident, and alert models and APIs, along with user permissions and bulk profile lookups. 2026-01-07 11:07:36 -05:00
pacnpal
4da7e52fb0 feat: Implement passkey authentication, account management features, and a dedicated MFA login verification flow. 2026-01-06 10:08:44 -05:00
pacnpal
b80654952d docs: add Supabase to Django endpoint mapping documentation 2026-01-05 14:40:52 -05:00
pacnpal
2b7bb4dfaa feat: Implement email change cancellation, location search, and admin anomaly detection endpoints. 2026-01-05 14:31:04 -05:00
pacnpal
a801813dcf feat: Implement a new notifications application, add admin API views for dashboard metrics, introduce scheduled tasks, and update API routing and project configurations. 2026-01-05 09:50:00 -05:00
pacnpal
1c6e219662 feat: Migrate image URL access from .url to .public_url across all relevant services and serializers. 2026-01-05 07:37:05 -05:00
pacnpal
70e4385c2b fix: Initialize historical_event variable to None. 2026-01-04 19:14:55 -05:00
pacnpal
30aa887d2a refactor: Standardize error logging by using logger.error in state machine callbacks and capture_and_log in management commands. 2026-01-04 18:45:22 -05:00
pacnpal
dd2d09b1c7 feat: replace direct logger.error with capture_and_log for critical state machine callback failures. 2026-01-04 18:39:58 -05:00
pacnpal
89d9e945b9 refactor: Replace direct error logging with capture_and_log utility in performance and rate limiting middleware. 2026-01-04 18:39:48 -05:00
pacnpal
bc4a3c7557 refactor: Replace direct logger.error calls with capture_and_log in accounts services and conditionally pass error_id during ApplicationError creation. 2026-01-04 18:36:23 -05:00
pacnpal
95700c7d7b feat: Implement centralized error capture and handling with new middleware, services, and API endpoints, and add new admin and statistics API views. 2026-01-02 15:55:42 -05:00
pacnpal
1adba1b804 lol 2026-01-02 07:58:58 -05:00
pacnpal
b243b17af7 feat: Implement initial schema and add various API, service, and management command enhancements across the application. 2026-01-01 15:13:01 -05:00
pacnpal
c95f99ca10 feat: Implement MFA authentication, add ride statistics model, and update various services, APIs, and tests across the application. 2025-12-28 17:32:53 -05:00
pacnpal
aa56c46c27 feat: Add user leaderboard API, Cloudflare Turnstile integration, and support ticket categorization. 2025-12-27 15:41:10 -05:00
pacnpal
137b9b8cb9 docs: Add comprehensive gap analysis matrix comparing source documentation to codebase implementation. 2025-12-26 20:14:56 -05:00
pacnpal
00699d53b4 feat: Add blog, media, and support apps, implement ride credits and image API, and remove toplist feature. 2025-12-26 15:15:28 -05:00
pacnpal
cd8868a591 feat: Introduce lists and reviews apps, refactor user list functionality from accounts, and add user profile fields. 2025-12-26 09:27:44 -05:00
pacnpal
ed04b30469 refactor: Relocate ride services from services.py to services_core.py and refine admin display fields. 2025-12-26 08:26:19 -05:00
pacnpal
a9f5644c5c chore: Add Pylint configuration for Django project to suppress false positives and enforce coding standards 2025-12-23 22:08:05 -05:00
pacnpal
a0be417f74 refactor: Remove build-system section from pyproject.toml and update source type in uv.lock 2025-12-23 21:38:16 -05:00
pacnpal
ca770d76ff Enhance documentation and management commands for ThrillWiki
- Updated backend README.md to include detailed management commands for configuration, database operations, cache management, data management, user authentication, content/media handling, trending/discovery, testing/development, and security/auditing.
- Added a new MANAGEMENT_COMMANDS.md file for comprehensive command reference.
- Included logging standardization details in architecture documentation (ADR-007).
- Improved production checklist with configuration validation and cache verification steps.
- Expanded API documentation to include error logging details.
- Created a documentation review checklist to ensure completeness and accuracy.
2025-12-23 21:28:14 -05:00
pacnpal
edcd8f2076 Add secret management guide, client-side performance monitoring, and search accessibility enhancements
- Introduced a comprehensive Secret Management Guide detailing best practices, secret classification, development setup, production management, rotation procedures, and emergency protocols.
- Implemented a client-side performance monitoring script to track various metrics including page load performance, paint metrics, layout shifts, and memory usage.
- Enhanced search accessibility with keyboard navigation support for search results, ensuring compliance with WCAG standards and improving user experience.
2025-12-23 16:41:42 -05:00
pacnpal
ae31e889d7 Add standardized HTMX conventions, interaction patterns, and migration guide for ThrillWiki UX 2025-12-22 16:56:27 -05:00
pacnpal
2e35f8c5d9 feat: Refactor rides app with unique constraints, mixins, and enhanced documentation
- Added migration to convert unique_together constraints to UniqueConstraint for RideModel.
- Introduced RideFormMixin for handling entity suggestions in ride forms.
- Created comprehensive code standards documentation outlining formatting, docstring requirements, complexity guidelines, and testing requirements.
- Established error handling guidelines with a structured exception hierarchy and best practices for API and view error handling.
- Documented view pattern guidelines, emphasizing the use of CBVs, FBVs, and ViewSets with examples.
- Implemented a benchmarking script for query performance analysis and optimization.
- Developed security documentation detailing measures, configurations, and a security checklist.
- Compiled a database optimization guide covering indexing strategies, query optimization patterns, and computed fields.
2025-12-22 11:17:31 -05:00
pacnpal
45d97b6e68 Add test utilities and state machine diagrams for FSM models
- Introduced reusable test utilities in `backend/tests/utils` for FSM transitions, HTMX interactions, and common scenarios.
- Added factory functions for creating test submissions, parks, rides, and photo submissions.
- Implemented assertion helpers for verifying state changes, toast notifications, and transition logs.
- Created comprehensive state machine diagrams for all FSM-enabled models in `docs/STATE_DIAGRAMS.md`, detailing states, transitions, and guard conditions.
2025-12-22 08:55:39 -05:00
pacnpal
b508434574 Add state machine diagrams and code examples for ThrillWiki
- Created a comprehensive documentation file for state machine diagrams, detailing various states and transitions for models such as EditSubmission, ModerationReport, and Park Status.
- Included transition matrices for each state machine to clarify role requirements and guards.
- Developed a new document providing code examples for implementing state machines, including adding new state machines to models, defining custom guards, implementing callbacks, and testing state machines.
- Added examples for document approval workflows, custom guards, email notifications, and cache invalidation callbacks.
- Implemented a test suite for document workflows, covering various scenarios including approval, rejection, and transition logging.
2025-12-21 20:21:54 -05:00
pacnpal
8f6acbdc23 feat(notifications): enhance submission approval and rejection notifications with dynamic titles and messages 2025-12-21 19:22:15 -05:00
pacnpal
b860e332cb feat(state-machine): add comprehensive callback system for transitions
Extend state machine module with callback infrastructure including:
- Pre/post/error transition callbacks with registry
- Signal-based transition notifications
- Callback configuration and monitoring support
- Helper functions for callback registration
- Improved park ride count updates with FSM integration
2025-12-21 19:20:49 -05:00
pacnpal
7ba0004c93 chore: fix pghistory migration deps and improve htmx utilities
- Update pghistory dependency from 0007 to 0006 in account migrations
- Add docstrings and remove unused imports in htmx_forms.py
- Add DJANGO_SETTINGS_MODULE bash commands to Claude settings
- Add state transition definitions for ride statuses
2025-12-21 17:33:24 -05:00
pacnpal
b9063ff4f8 feat: Add detailed park and ride pages with HTMX integration
- Implemented park detail page with dynamic content loading for rides and weather.
- Created park list page with filters and search functionality.
- Developed ride detail page showcasing ride stats, reviews, and similar rides.
- Added ride list page with filtering options and dynamic loading.
- Introduced search results page with tabs for parks, rides, and users.
- Added HTMX tests for global search functionality.
2025-12-19 19:53:20 -05:00
pacnpal
bf04e4d854 fix: Update import paths to use 'apps' prefix for models and services 2025-09-28 10:50:57 -04:00
pacnpal
1b246eeaa4 Add comprehensive test scripts for various models and services
- Implement tests for RideLocation and CompanyHeadquarters models to verify functionality and data integrity.
- Create a manual trigger test script for trending content calculation endpoint, including authentication and unauthorized access tests.
- Develop a manufacturer sync test to ensure ride manufacturers are correctly associated with ride models.
- Add tests for ParkLocation model, including coordinate setting and distance calculations between parks.
- Implement a RoadTripService test suite covering geocoding, route calculation, park discovery, and error handling.
- Create a unified map service test script to validate map functionality, API endpoints, and performance metrics.
2025-09-27 22:26:40 -04:00