Files
platforms/.superpowers/sdd/2026-07-27-platform-admin-full-audit/task-6-report.md

46 lines
3.1 KiB
Markdown

# Task 6 report
## RED baseline
`pnpm audit:platform` initially exited with code 1. The audit reported missing API declarations, route entries, and view files for the resource contract catalogue.
## Implementation
- Added `src/api/resources.ts` as the single front-end catalogue for all 46 backend resource contracts, including path, title, mode, page kind, and fields.
- Added route modules and declarative list/tree pages for each resource.
- Added reusable read-only and tree pages; read-only definitions do not render create, edit, status, or archive controls.
- Updated the shared CRUD page with server-side keyword filters, identity-based details, typed form data, archive confirmation, and API error messages.
- Removed platform UI use of internal numeric identifiers in favour of `identity` and `parent_identity`.
## Verification
- `pnpm type:check` — pass
- `pnpm audit:platform` — pass
- `pnpm build` — pass
## Notes
The tree page consumes `parent_identity`; the corresponding menu API must expose that identity relation rather than an internal numeric parent key.
## Fix round 1
- Replaced inferred front-end paths with an explicit 46-path catalogue: it includes the dashboard endpoint, adds `/ec/ec_order_item`, and removes the non-list safety disposal action from the menu catalogue.
- Corrected the safety, e-commerce, staff, and user API paths to match the registered backend routes exactly.
- Added audit assertions for exact path/mode/page-kind contracts, separate read-only UI surfaces, identifier leakage, and tree semantics.
- Detail drawers now filter `id` and `*_id` fields before rendering.
## Fix round 2
- The resource catalogue now contains exactly the 46 backend `ExpectedResources` names, including the append-only `saf_event_disposal` contract rather than a synthetic dashboard entry.
- Every definition has its own backend write allowlist and required `*_identity` fields; no resource inherits a generic `name/status` schema.
- Safety disposal is a detail action on `saf_event` (`/safety/saf_event/:identity/disposals`) and has no standalone menu or page.
- `ec_category` and `platform_menu` use tree pages. The shared tree preserves identity-first behavior and uses backend `parent_id` only for in-memory hierarchy adaptation when `parent_identity` is unavailable.
- The audit transpiles and evaluates `resources.ts`, then compares the resulting definitions, allowlists, required identities, modes, page types, tree semantics, and identifier-safety rules to the complete expected contract.
## Fix round 3
- Added tested backend identity-to-key resolution for public account and relationship requests; clients send `*_identity`, while numeric keys remain internal persistence details.
- Platform-menu and e-commerce-category tree responses now expose `parent_identity` and omit `parent_id`; the front-end tree no longer falls back to numeric keys.
- Settlement input accepts `subject_identity` with supported gas, delivery, and staff subject types.
- The platform audit now cross-checks every front-end definition against the backend resource catalogue and registered route source.