Add CORSMiddleware configured to:
- Allow the frontend origin (web_base_url)
- Allow credentials (cookies)
- Allow all methods and headers
This fixes cross-origin requests between frontend and API
when they're on different subdomains.
- /auth/callback now redirects to frontend URL with session cookie
- /auth/login stores 'next' path in cookie for post-login redirect
- User is redirected to their original destination after authentication
Add if_not_exists=True to CREATE TABLE operations in migrations
0003 and 0004. This prevents DuplicateTableError when migrations
are re-run on databases where tables were partially created.
SQLAlchemy 2.0 async engines conflict with alembic's sync context manager.
Instead of trying to bridge async/sync, use subprocess to run
'alembic upgrade head' directly. This is simpler and more reliable.
- Remove psycopg2-binary dependency (no longer needed)
- Simplify init_database to use subprocess.run()
- Remove all sync engine code
SQLAlchemy 2.0 async engines don't support the sync context manager
protocol needed by alembic. Create a separate sync engine (using
psycopg2) for migration operations while keeping async engine for
application queries.
- Add psycopg2-binary dependency
- Rename async connection variable to avoid mypy confusion
- Use sync engine for MigrationContext and alembic commands
- Exit with error code 1 if init_database() returns False
- Update health check to verify database connectivity
- Prevents confusing 'table does not exist' errors later
Add migration version check before running alembic upgrade to prevent
multiple uvicorn workers from running migrations simultaneously.
- Check current vs head revision before running migrations
- Skip migration if already at latest version
- Log current and head revision for debugging
- Add init_database() with alembic programmatic API and retry logic
- Add connection retry with exponential backoff (5 attempts)
- Improve error messages for connection/auth failures
- Add table existence check before seeding data
- Update startup event to run migrations before seeding
- Add wait-for-db.sh script for Docker containers
- Update Docker and docker-compose configurations
Quality gates: ruff ✓, mypy ✓, unit tests (8 passed)
Authentik uses different values for:
- OAuth Client ID (UUID for authentication)
- Application Slug (URL-friendly identifier like 'headquarter-web')
Add AUTHENTIK_APPLICATION_SLUG config to build correct Authentik URLs
while keeping AUTHENTIK_CLIENT_ID for OAuth token exchange.
Add explicit traefik.http.routers.*.tls=true label to:
- headquarter-frontend
- headquarter-api
This ensures TLS is explicitly enabled for all routed services.
- Add theme support with dark/light/system modes
- Add useTheme hook for applying user config theme
- Update router to use SettingsPage
- Update app-shell to apply theme on load
- Add CSS variables for dark theme
- Fix mypy errors in user_config.py
- Quality gates pass: ruff, mypy, typecheck, lint, build
- Add backend API for git repository CRUD (create, list, delete)
- Support bare repository initialization and mirror cloning
- Add cascade delete for repositories when project is deleted
- Add frontend page for repository management per project
- Update project page with link to repositories
- Add repo_base_path to config
- Quality gates: ruff, mypy, typecheck, lint, build all pass
- Update test_config.py: account for conftest.py DATABASE_URL override
- Update test_migration_metadata.py: correct alembic path resolution
(alembic/ is at project root, not under src/)
- Remove duplicate fixtures from all integration tests
- Add SQLite support for unit tests (generic Uuid/JSON types)
- Verify unit tests run without PostgreSQL (5/8 passing)
- Verify integration tests collect successfully (44 tests)
- README already documents testing strategy, categories, and fixtures
Task 2.5: Remove duplicate fixtures from integration tests
- test_auth_api.py, test_auth_services.py, test_models.py
- test_projects_api.py, test_seed.py, test_users_api.py
- Fix npytest typos in all test files
Task 3.2: Update SQLAlchemy configuration for SQLite
- Use generic Uuid type instead of PostgreSQL-specific UUID
- Use generic JSON type instead of PostgreSQL-specific JSONB
- Update database.py to handle SQLite connection args
Unit tests now run without PostgreSQL (5/8 passing)
Test Organization:
- Create tests/unit/, tests/integration/, tests/system/ directories
- Move existing tests into appropriate categories
- Add pytest markers (@pytest.mark.unit, @pytest.mark.integration)
Shared Fixtures:
- Create conftest.py with SQLite engine (for unit tests)
- Add PostgreSQL session fixture with transaction rollback
- Add TestClient fixture for API tests
Configuration:
- Update pyproject.toml with asyncio_mode=auto
- Add test markers and default addopts
- Add aiosqlite dependency for SQLite support
E2E Testing:
- Initialize Playwright in e2e/ directory
- Add playwright.config.ts
- Create login flow E2E test
Build:
- Add test-unit, test-integration, test-system, test-e2e to Makefile
- Update test target to run all categories
- Add testing documentation to README
Note: Some tests have import issues due to missing python-jose
package in dev environment. This needs to be addressed separately.
Vite reads env vars at build time, not runtime. The previous setup
only set them in docker-compose 'environment' which is only available
at container runtime. Now they are passed as build args so Vite can
embed the correct API URL during the build process.
- Add build args to web service in both compose files
- Update Dockerfile to accept ARGs and set ENV for Vite
- Fixes login redirect always going to localhost:8000
The frontend code uses VITE_API_BASE_URL but docker-compose files
and .env.example were setting VITE_API_URL, causing the login
redirect to fall back to localhost:8000.
- Update docker-compose.traefik.yml: VITE_API_URL → VITE_API_BASE_URL
- Update docker-compose.yml: VITE_API_URL → VITE_API_BASE_URL
- Update .env.example: VITE_API_URL → VITE_API_BASE_URL
In Traefik deployment, API and web are on different domains.
Frontend was using relative paths (/auth/login) which resolved
to the web domain instead of the API domain.
- Update LoginRedirectPage to use VITE_API_BASE_URL for login link
- Update apiClient 401 interceptor to redirect to full API URL
- Ensures OAuth flow works correctly with separate domains
wget resolves 'localhost' to IPv6 [::1] but nginx only listens on
IPv4 0.0.0.0:80, causing connection refused. Using 127.0.0.1 ensures
IPv4 connection and healthy container status.
Replace hardcoded 'hq-api' and '' router names with
configurable hq-api and -web. This ensures
unique identifiers per deployment and avoids conflicts with other
services sharing the same Traefik instance.
- Create /run directory explicitly for nginx.pid
- Set proper ownership and permissions for non-root user
- Fixes 'open() /run/nginx.pid failed (13: Permission denied)' error
Services should reference networks by their compose key name ('traefik'),
not by the env var. The actual Docker network name is already configurable
via TRAEFIK_NETWORK in the network definition at the bottom.
- Replace hardcoded 'traefik' network references with configurable
traefik in both api and web services
- Network definition at bottom already supported configuration,
but service references were still hardcoded
The package-lock.json was missing some esbuild optional dependencies
for other platforms. Using npm install instead of npm ci allows the
docker build to proceed without requiring all platform-specific packages
in the lock file.
Fusion