From 955217a94184f23f725f27079d31f5e0f0c0c16d Mon Sep 17 00:00:00 2001 From: Jennie Robinson Faber Date: Wed, 29 Apr 2026 17:54:53 +0100 Subject: [PATCH 01/26] =?UTF-8?q?chore(admin):=20rename=20pending=5Fpaymen?= =?UTF-8?q?t=20label=20and=20tier=E2=86=92contribution?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backlog cleanup from docs/LAUNCH_READINESS.md: - B4: admin status filter + form options + STATUS_LABELS now read "Payment setup incomplete" so admins stop conflating with membership state - CSV import preview header "Tier" → "Contribution" - handleUpdateTier → handleUpdateContribution on /member/account - update-contribution error log "tier" → "amount" --- app/pages/admin/members/index.vue | 8 ++++---- app/pages/member/account.vue | 4 ++-- server/api/members/update-contribution.post.js | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/app/pages/admin/members/index.vue b/app/pages/admin/members/index.vue index 4e8f28d..461ab20 100644 --- a/app/pages/admin/members/index.vue +++ b/app/pages/admin/members/index.vue @@ -42,7 +42,7 @@ @@ -269,7 +269,7 @@ Name Email Circle - Tier + Contribution @@ -373,7 +373,7 @@
- Create a free guest account so I can manage my registration - - + @@ -21,67 +23,89 @@
+ @change="handleFileSelect" + >
- +
-

+

or drag and drop

-

PNG, JPG, GIF up to 10MB

+

+ PNG, JPG, GIF up to 10MB +

-
- Uploading... - {{ uploadProgress }}% + Uploading... + {{ uploadProgress }}%
-
+
-
+
{{ errorMessage }}
diff --git a/app/components/NaturalDateInput.vue b/app/components/NaturalDateInput.vue index c2d1130..4e97e05 100644 --- a/app/components/NaturalDateInput.vue +++ b/app/components/NaturalDateInput.vue @@ -18,12 +18,14 @@ @@ -31,7 +33,8 @@
@@ -41,7 +44,8 @@
@@ -51,7 +55,7 @@
- + Use traditional date picker
-- 2.47.3 From 23154ff232dad834c049cbb24ecffdfcab2751c4 Mon Sep 17 00:00:00 2001 From: Jennie Robinson Faber Date: Wed, 29 Apr 2026 19:59:49 +0100 Subject: [PATCH 08/26] fix(oidc): disable devInteractions so custom interactions.url runs in dev MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit oidc-provider's devInteractions is a quick-start scaffold that, when enabled, mutates configuration.url to its own urlFor('interaction') helper — emitting /interaction/UID instead of our /oidc/interaction/UID. That made /oidc/auth redirect to a 404 in local dev and forced a stale TODO entry. We already have our own interaction handler at server/routes/oidc/interaction/[uid].get.ts, so devInteractions is unnecessary; disabling it makes dev match prod and clears the oidc-provider warning "your configuration is not in effect". --- server/utils/oidc-provider.ts | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/server/utils/oidc-provider.ts b/server/utils/oidc-provider.ts index dfc7042..187f8a8 100644 --- a/server/utils/oidc-provider.ts +++ b/server/utils/oidc-provider.ts @@ -86,9 +86,7 @@ export async function getOidcProvider() { }, features: { - devInteractions: { - enabled: process.env.NODE_ENV !== "production", - }, + devInteractions: { enabled: false }, revocation: { enabled: true }, rpInitiatedLogout: { enabled: true, -- 2.47.3 From 59d2be2df829baa6895b502262afa363af156325 Mon Sep 17 00:00:00 2001 From: Jennie Robinson Faber Date: Wed, 29 Apr 2026 20:10:38 +0100 Subject: [PATCH 09/26] docs(backlog): close out a11y triage items Strike two stale entries (verified 2026-04-29) and the OIDC routing quirk (fixed in 23154ff). --- docs/LAUNCH_READINESS.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/LAUNCH_READINESS.md b/docs/LAUNCH_READINESS.md index 27c0e99..a51543e 100644 --- a/docs/LAUNCH_READINESS.md +++ b/docs/LAUNCH_READINESS.md @@ -132,10 +132,10 @@ Not blocking launch — the amendment hasn't passed yet, and the user-visible co See `docs/TODO.md` for: - Button minimum target size (WCAG AAA 2.5.5). -- `/oidc/interaction/[uid]` routing quirk. +- ~~`/oidc/interaction/[uid]` routing quirk~~ — fixed 2026-04-29 (commit `23154ff`); root cause was `oidc-provider`'s `devInteractions` overriding our custom `interactions.url`. - Admin layout migration from `guild-*` tokens to zine spec. -- Admin dashboard quick-action button contrast. -- Members table NAME column clipping. +- ~~Admin dashboard quick-action button contrast~~ — verified stale 2026-04-29. +- ~~Members table NAME column clipping~~ — verified stale 2026-04-29. - OWASP ASVS L1 Phase 4 (file-upload validation pipeline, granular RBAC, credential encryption). - `tickets/available.get.js:115` `memberSavings` block reports `$0 saved` for inactive members — cosmetic; suppress comparison block when `!hasMemberAccess(member)` if it ever surfaces in UI. - Simplify-pass follow-ups (2026-04-25): source-grep test bloat, login/verify rate-limit gap, stringly-typed `metadata.type`, reconcile-payments sequential loop, stale `new Date()` in events list, `loadPublicSeries` helper extraction. -- 2.47.3 From 05c47c44998321db16c13227e31481b311136008 Mon Sep 17 00:00:00 2001 From: Jennie Robinson Faber Date: Wed, 29 Apr 2026 20:22:25 +0100 Subject: [PATCH 10/26] docs(backlog): close out admin layout token migration as stale Verified clean 2026-04-29: grep for guild-[0-9]|candlelight-[0-9]|ember-[0-9] across app/layouts/, app/pages/admin/, and app/components/admin/ returns zero matches. All admin surfaces already use design tokens. --- docs/LAUNCH_READINESS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/LAUNCH_READINESS.md b/docs/LAUNCH_READINESS.md index a51543e..cd0329d 100644 --- a/docs/LAUNCH_READINESS.md +++ b/docs/LAUNCH_READINESS.md @@ -133,7 +133,7 @@ Not blocking launch — the amendment hasn't passed yet, and the user-visible co See `docs/TODO.md` for: - Button minimum target size (WCAG AAA 2.5.5). - ~~`/oidc/interaction/[uid]` routing quirk~~ — fixed 2026-04-29 (commit `23154ff`); root cause was `oidc-provider`'s `devInteractions` overriding our custom `interactions.url`. -- Admin layout migration from `guild-*` tokens to zine spec. +- ~~Admin layout migration from `guild-*` tokens to zine spec~~ — verified clean 2026-04-29; grep for `guild-[0-9]|candlelight-[0-9]|ember-[0-9]` across `app/layouts/`, `app/pages/admin/`, `app/components/admin/` returns zero matches. All tokens already converted. - ~~Admin dashboard quick-action button contrast~~ — verified stale 2026-04-29. - ~~Members table NAME column clipping~~ — verified stale 2026-04-29. - OWASP ASVS L1 Phase 4 (file-upload validation pipeline, granular RBAC, credential encryption). -- 2.47.3 From 350d6c219c6625910bcecc796c61ef7221df01a5 Mon Sep 17 00:00:00 2001 From: Jennie Robinson Faber Date: Wed, 29 Apr 2026 20:22:30 +0100 Subject: [PATCH 11/26] fix(series): replace phantom guild Tailwind on EventSeriesBadge Swap bg-guild-*/border-guild-*/text-guild-* utility classes for design tokens in a scoped style block. Drops rounded-* per the no-rounded-corners rule and uses dashed borders for the structural block per the zine spec. --- app/components/EventSeriesBadge.vue | 39 ++++++++++++++++++----------- 1 file changed, 25 insertions(+), 14 deletions(-) diff --git a/app/components/EventSeriesBadge.vue b/app/components/EventSeriesBadge.vue index a8b23a0..6b9252a 100644 --- a/app/components/EventSeriesBadge.vue +++ b/app/components/EventSeriesBadge.vue @@ -1,18 +1,14 @@