Skip to content

session-final-report.md

Latest commit

 

History

History
171 lines (132 loc) · 12.2 KB

session-final-report.md

File metadata and controls

171 lines (132 loc) · 12.2 KB
Raw

PrepFlow Session Final Report

Generated 2026-06-27 after the feat/complete-core-workflows completion pass. Refreshed after the final hardening pass on fix/final-functional-hardening so this report reflects the current verified branch state.

Implemented work

  • Added recipe ingredient management to admin Menu CRUD. Menu items return recipe_ingredients; create/update writes recipe rows in the same transaction; available menu items require at least one ingredient so the prep tracker cannot silently miss new dishes.
  • Added daily dish-count prep summary beside the procurement list. /api/admin/prep returns both dish totals and raw ingredient totals for the selected fulfillment date.
  • Hardened order creation: unavailable menu items cannot be ordered, batch lookup uses online vs pop_up context, and capacity is counted by servings (SUM(order_items.quantity)), not order rows.
  • Hardened payment proof upload: only the owning customer can upload, only while the order is pending, only for GCash/bank methods, and the uploaded proof must match the selected payment method.
  • Hardened admin status changes to the locked lifecycle. GCash/bank orders cannot be confirmed before proof upload; COD can move pending -> confirmed; completed/cancelled orders cannot be revived.
  • Added courier-link/note same-status audit logging, preserved status-transition audit logging, and kept email dispatch non-blocking.
  • Forced card payment methods inactive in admin config so the Card tile remains disabled/Coming Soon.
  • Added credential-aware API CORS config for local web and Android emulator testing. Android now uses http://10.0.2.2 as its Capacitor origin and API host during local APK testing.
  • Extended shared/web DTOs and zod validation boundaries for batches, payment methods, fulfillment options, audit logs, and menu/order mutation payloads.
  • Fixed root Bun shortcuts for the current Bun CLI syntax: bun run build, bun run build:mobile, and bun run sync:mobile now work from the repository root.
  • Updated mobile docs with the verified debug APK build path, Android SDK/JBR environment variables, emulator API host, and shared capturePhoto() upload flow.
  • Marked the original completion audit as a historical baseline so it no longer reads like the current task list or recommends removed PayMongo scope.
  • Added order creation audit logs inside the order transaction.
  • Hardened status/proof lifecycle writes so order updates and audit-log writes happen atomically under row locks.
  • Enforced active fulfillment options server-side; disabled pickup/courier/pop-up modes are no longer orderable by direct API calls.
  • Restricted courier links to valid URLs on delivery orders in courier-eligible states.
  • Matched shared zod response schemas to Laravel decimal string serialization.
  • Tightened checkout so GCash/bank orders require receipt capture before submission, closed/full batches disable checkout, and success/tracker pages show status-accurate payment verification copy.
  • Added explicit query error states for high-risk customer/admin order, prep, and settings views.
  • Preserved earlier merged work: OCR-assisted proof verification, shipping tiers, payment/fulfillment/shipping settings CRUD, transactional email, success screen, customer camera upload, analytics dashboard, and smart reorder/favorites.
  • Added final checkout hardening: config-query failures now block checkout with visible errors, the selected fulfillment mode is synced to active seller options, and failed proof upload after order creation redirects to the saved order instead of allowing duplicate pending orders.
  • Corrected COD success copy so pending COD orders say seller confirmation is required before prep starts.
  • Made the menu-side ingredient tracker visible on saved menu rows with per-serving procurement impact, added ingredient-name suggestions, and canonicalized ingredient names before save.
  • Hardened Prep date filtering and procurement grouping: raw SQL now uses DATE(o.fulfillment_date) for date filters and groups ingredient names case-insensitively, so Shrimp and shrimp do not split the shopping list.
  • Aligned menu image URL and payment QR URL validation with the existing 255-character database columns.

Files changed

  • Backend controllers/middleware/config: api/app/Http/Controllers/Api/ConfigController.php, api/app/Http/Controllers/Api/MenuController.php, api/app/Http/Controllers/Api/OrderController.php, api/app/Http/Controllers/Api/PrepController.php, api/app/Http/Middleware/EnsureRole.php, api/config/cors.php, api/.env.example.
  • Backend migrations/tests: api/database/migrations/2025_06_27_000013_create_daily_procurement_view.php, api/tests/Feature/ConfigTest.php, api/tests/Feature/MenuCrudTest.php, api/tests/Feature/OrderTest.php, api/tests/Feature/PaymentProofTest.php, api/tests/Feature/PrepTest.php.
  • Web/mobile contracts and runtime: apps/web/src/lib/api.ts, apps/web/src/features/menu/useMenu.ts, apps/web/src/features/orders/useOrders.ts, apps/web/src/routes/Checkout.tsx, apps/web/src/routes/OrderDetail.tsx, apps/web/src/routes/OrderSuccess.tsx, apps/web/src/routes/Orders.tsx, apps/web/src/routes/admin/MenuManager.tsx, apps/web/src/routes/admin/OrderDetail.tsx, apps/web/src/routes/admin/Orders.tsx, apps/web/src/routes/admin/Prep.tsx, apps/web/src/routes/admin/Settings.tsx, apps/web/src/types.ts, apps/web/.env.example, apps/web/package.json, apps/mobile/capacitor.config.ts, packages/shared/src/index.ts, bun.lock.
  • Root/mobile/docs cleanup: package.json, apps/mobile/README.md, docs/planning/completion-audit.md.
  • Documentation: DECISIONS.md, docs/planning/session-final-report.md.

Verification gates

php ../tools/composer.phar test

PASS  Tests\Feature\ConfigTest
✓ api cors allows credentialed android emulator origin

PASS  Tests\Feature\MenuCrudTest
✓ recipe ingredient names are canonicalized

PASS  Tests\Feature\OrderTest
✓ capacity reached rejects order by servings
✓ pop up orders use pop up batch context
✓ unavailable menu item cannot be ordered
✓ non cod pending order cannot be confirmed without uploaded payment

PASS  Tests\Feature\PaymentProofTest
✓ cod order rejects payment proof upload
✓ non pending order rejects payment proof upload
✓ mismatched payment method rejects payment proof upload

PASS  Tests\Feature\PrepTest
✓ prep groups ingredient names case insensitively

Tests:    77 passed (208 assertions)
Duration: 5.95s

vendor/bin/pint --test

{"tool":"pint","result":"passed"}

bun run build:mobile from the repository root

$ bun run --cwd apps/web build && bun run --cwd apps/mobile sync
$ tsc -b && vite build
✓ 139 modules transformed.
dist/index.html                   0.82 kB │ gzip:   0.44 kB
dist/assets/index-BFm5LUUB.css   17.32 kB │ gzip:   4.12 kB
dist/assets/index-69tJRxy7.js   423.11 kB │ gzip: 120.22 kB
✓ built in 4.84s
$ cap sync
[info] Found 1 Capacitor plugin for android:
       @capacitor/camera@6.1.3
[info] Sync finished in 0.294s

.\gradlew.bat assembleDebug

BUILD SUCCESSFUL in 3s
108 actionable tasks: 23 executed, 85 up-to-date

APK install/launch/logcat on prepflow_test_api34

Performing Streamed Install
Success
Starting: Intent { cmp=ph.thaijoint.prepflow/.MainActivity }
Displayed ph.thaijoint.prepflow/.MainActivity for user 0: +2s614ms

APK contents were checked after the final rebuild and contained the current synced assets:

assets/public/assets/index-BFm5LUUB.css
assets/public/assets/index-69tJRxy7.js

Runtime log review after the final APK launch found no Mixed Content, Access to fetch, CORS, net::ERR, AndroidRuntime, or FATAL EXCEPTION lines for the PrepFlow app.

Browser smoke testing

Local servers used:

  • Laravel API: http://127.0.0.1:8000
  • Vite web dashboard: http://127.0.0.1:5174/

In-app browser checks:

  • Admin login with seeded admin@thaijoint.ph / prepflow123 redirects to /admin.
  • Dashboard renders revenue, AOV, customer count, repeat rate, order count by status, revenue by fulfillment date, top sellers, peak days, and recent orders.
  • Menu Management renders recipe ingredient counts, per-serving "Ingredient Tracker / Procurement impact" rows, and the New Menu Item form includes repeatable ingredient name, quantity-per-serving, unit controls, and ingredient-name suggestions.
  • Prep & Procurement renders daily dish counts and raw ingredient totals from confirmed orders.
  • Settings renders CRUD entry points for payment methods, fulfillment options, shipping tiers, and batches/cutoffs; Card is disabled.
  • Admin Order Detail renders payment proof, expected total, OCR section, items, status controls, and audit trail.

APK testing notes

  • Android Studio and SDK were available at C:\Android\Sdk; AVD prepflow_test_api34 was used.
  • First APK launch found a real WebView blocker: credentialed API fetches from the Capacitor origin were rejected because CORS returned wildcard Access-Control-Allow-Origin.
  • Fixed by adding api/config/cors.php, explicit CORS_ALLOWED_ORIGINS, and hostname: '10.0.2.2' in apps/mobile/capacitor.config.ts.
  • Rebuilt, reinstalled, and relaunched the APK after the fix. The app launched without CORS, mixed-content, network, or fatal runtime errors in the scoped log.
  • Rebuilt, reinstalled, and relaunched again after the final frontend/backend hardening pass; the APK embedded the current synced web assets and launched cleanly on emulator-5554.
  • Debug APK path: apps/mobile/android/app/build/outputs/apk/debug/app-debug.apk (generated and ignored, not committed).

OCR approach

Current OCR remains best-effort and non-blocking: Cloudinary OCR response text is used when available, optional local Tesseract is available when OCR_TECHNIQUE=tesseract and TESSERACT_BIN are configured, otherwise proof_ocr_text remains null. OCR text is never parsed for auto-approval; seller verification remains manual.

Not done

  • PayMongo remains intentionally removed from scope. Payment is receipt upload plus seller verification; Card remains disabled.
  • Maps API remains intentionally optional because shipping tiers provide deterministic delivery fees without API keys.
  • Production Android release signing, Play Store submission, final icons, splash assets, and production HTTPS API configuration are still outside this functional-completion pass.
  • Frontend visual polish is intentionally deferred per the user's latest instruction.
  • A full ingredient catalog table remains a future refinement. Current behavior canonicalizes common free-text mistakes and groups case-insensitively without adding schema scope.

Open items needing the user

  • Real SMTP credentials if transactional emails should send outside the dev log driver.
  • Tesseract binary path if local OCR fallback is required.
  • Production HTTPS VITE_NATIVE_API_URL for APKs outside the emulator/dev machine.
  • Final Android app icon, splash screen, release keystore/signing credentials, and Play Store metadata.
  • Optional live-reload config for Android development if the app should point at Vite instead of bundled assets.

Rubric traceability

  • Sessions/auth: register/login/logout session regeneration preserved and tested.
  • JSON/AJAX: JsonResponds explicit json_encode responses preserved; EnsureRole no longer uses response()->json; frontend API calls remain centralized in apps/web/src/lib/api.ts.
  • PDO/transactions: menu CRUD uses PDO prepared statements; recipe sync and order writes use transactions; batch/capacity checks remain inside DB::transaction with lockForUpdate.
  • Validation: Laravel validation and shared zod validation are present for menu recipes, payment proof upload, order creation/status updates, batches, and config writes.
  • CRUD: admin menu recipes, payment methods, fulfillment options, shipping tiers, batches, orders, proof uploads, and prep endpoints are covered.
  • Lifecycle integrity: creation, proof upload, status transitions, and courier updates now keep audit rows atomic with state changes.
  • Innovation features: recipe-driven procurement, dish-count prep summary, batch capacity/cutoff, analytics dashboard, smart reorder/favorites, OCR-assisted verification, and shipping tiers are implemented. Ingredient names are now canonicalized and grouped case-insensitively so the procurement list is harder to fragment accidentally.