Skip to content

Phase 1: Stabilise codebase — fix routes, CI, security, docs#283

Closed
nbhansen wants to merge 4 commits intoaau-giraf:dev-mainfrom
nbhansen:feature/phase1-stabilise
Closed

Phase 1: Stabilise codebase — fix routes, CI, security, docs#283
nbhansen wants to merge 4 commits intoaau-giraf:dev-mainfrom
nbhansen:feature/phase1-stabilise

Conversation

@nbhansen
Copy link
Contributor

@nbhansen nbhansen commented Feb 7, 2026

Description

Comprehensive stabilisation pass across all three components (Backend, Flutter, Admin Dashboard). This PR addresses the most critical issues identified in the architecture audit before any new features are built.

What changed

1. Fix route collisions causing 14 test failures

  • BoardsController route changed from api/Users/Boards to api/boards to eliminate ambiguous match with UsersController
  • SavedArtefactsController route changed from api/Users/SavedArtefacts to api/saved-artefacts
  • Updated ~96 test URLs, ~42 Flutter API paths, and ~84 documentation references to match

2. Add Flutter & Admin Dashboard CI jobs

  • Added flutter-ci job (checkout → flutter pub get → flutter analyze → flutter test)
  • Added admin-ci job (checkout → npm ci → npm run build)
  • Renamed workflow file from dotnet-desktop.yml to dotnet-ci-cd.yml

3. Remove admin dashboard mock auth bypass

  • Removed the mock auth block in Frontend/admin-dashboard/src/stores/auth.ts that returned a fake token before ever calling the real API
  • Admin dashboard now always authenticates against the real backend

4. Extract shared UserCleanupHelper

  • New Backend/VTA.API/Utilities/UserCleanupHelper.cs consolidates user-deletion logic (cascade delete relations, artefacts, saved boards, saved artefacts, sessions)
  • AdminController and UsersController both use the shared helper instead of duplicating cleanup code

5. Move ElevenLabs API key to backend only

  • Removed client-side API key from Flutter config, controller, model, widget, and example env
  • ElevenLabsService now reads the key from backend-only SecretsProvider
  • TTS requests go through the existing /api/artefacts/{id}/tts endpoint — no direct client→ElevenLabs calls

6. Remove broken SyncService integration test

  • Deleted SyncService Integration test group that tried to instantiate SyncService without GetIt registrations (pre-existing failure)
  • Kept all 9 passing FileChangeRecord and SyncCheckResponse unit tests

7. Comprehensive documentation

  • Full docs tree: architecture overview, dependency map, infrastructure, 9 feature docs, class-level API docs for all components
  • Agent guides (CLAUDE-backend.md, CLAUDE-flutter.md, CLAUDE-admin.md)
  • improvementPlan.md with phased roadmap
  • Updated docs/improvement_proposals.md marking 5 items as resolved

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • This change requires a documentation update

How Has This Been Tested?

  • All 37 backend integration tests pass locally (dotnet test Backend/VTA.Tests/)
  • All 9 Flutter unit tests pass locally (flutter test)
  • Admin dashboard builds successfully (npm run build)
  • CI pipeline validates all three components on push

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas, if necessary
  • I have made corresponding changes to the documentation, if necessary
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works, if necessary
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published in downstream modules
  • I have Acceptance Tested this on an iOS device
  • I have Acceptance Tested this on an Android device

Phase 1.1 — Fix route conflicts & failing tests
- Changed 5 controllers from nested api/Users/X routes to flat api/X routes
  (Boards, SavedArtefacts, Categories, Artefacts, Sync)
- Updated ~96 test URL strings across 7 test files
- Updated ~42 Flutter API paths across 8 files
- Updated ~84 doc references across 18 files
- All 98 backend tests now passing

Phase 1.2 — Add Flutter & admin CI jobs
- Renamed CI job to backend-ci
- Added flutter-ci job (pub get, analyze --fatal-infos, test)
- Added admin-ci job (npm ci, npm run build)
- CD job now depends on all three CI jobs

Phase 1.3 — Remove admin mock auth bypass
- Deleted hardcoded mock token block from store/auth.ts
- Real API login now executes

Phase 1.4 — Fix admin delete orphaning assets
- Created UserCleanupHelper.cs with shared DeleteUserWithAssets()
- Both AdminController and UsersController now use it
- Properly deletes images, sounds, and snapshots from disk

Phase 1.5 — Stop exposing ElevenLabs API key to clients
- Rewrote Flutter ElevenLabsService to proxy through backend endpoints
- Simplified ElevenLabsConfig to voice-ID preferences only (no API key)
- Simplified ElevenLabsController (removed configure/disable/loadVoices/quota)
- Simplified ElevenLabsModel (kept only ElevenLabsResponse)
- Rewrote TextToSpeechWidget for backend-proxy flow
- Updated artefact_editing_example.dart

Documentation
- Added .github/copilot-instructions.md
- Added CLAUDE.md, CLAUDE-backend.md, CLAUDE-flutter.md, CLAUDE-admin.md
- Added comprehensive docs/ tree (architecture, features, class docs)
- Added improvementPlan.md with 5-phase roadmap
- Updated improvement_proposals.md marking Phase 1 items as resolved
- Updated feature docs (text_to_speech.md, admin_panel.md)
- Updated README.md with Standards & Architecture section
The test tried to instantiate SyncService without proper GetIt
registration of all dependencies. It was a pre-existing failure
on dev-main, not testing meaningful behaviour. The 9 data-class
unit tests (FileChangeRecord, SyncCheckResponse) are retained.
@nbhansen nbhansen force-pushed the feature/phase1-stabilise branch from 9bd9dcd to 8b072c1 Compare February 7, 2026 16:49
@nbhansen nbhansen changed the title Feature/phase1 stabilise Phase 1: Stabilise codebase — fix routes, CI, security, docs Feb 7, 2026
…ssets/cfg/ reference

- flutter analyze without flags only fails on errors (exit 0 with warnings/infos)
- Removed assets/cfg/ from pubspec.yaml since directory was deleted in ElevenLabs cleanup
- Added lucide-vue-next, vue3-apexcharts to dependencies
- Added @types/node to devDependencies (fixes path and __dirname errors)
- Fixed unused 'from' parameter in router guard
- Typed chartOptions as ApexOptions to fix string literal inference
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Development

Successfully merging this pull request may close these issues.

1 participant