5 commits

Author	SHA1	Message	Date
Daniel	993442f98a	feat: the API describes itself, at /api/openapi.json ... docs/api-reference.md was hand-written, and by the time anyone checked it was documenting twenty-three endpoints that answer 404 while missing others that exist. That is what hand-written reference material does: it is correct on the day it is written and silently wrong afterwards. A second hand-written document, in YAML this time, would rot the same way. So paths, methods and mount points are read from the Express router stack at request time. They cannot disagree with the app, because they are the app: 186 paths, 215 operations, and — checked — no /learning endpoints, which is what the prose version went on claiming for weeks after that feature was deleted. What introspection cannot know is what an endpoint is *for*. That half lives in src/utils/openapiRoutes.js, keyed by "METHOD /path", and it is the half that rots, so it is the half that is enforced: a Playwright spec fetches the live document and fails when the number of operations without a summary rises above 199 — the debt as measured today. A ratchet, not a target. Adding an endpoint pushes the count over and fails the build; describing one lowers the number. The failure lists the operations by name, so it says what to write. Whether an operation is public is stated per route rather than inferred from middleware. Guessing wrong there is worse in both directions: calling a public endpoint protected hides a hole, and the reverse invites a bug report. The contract spec lives in e2e rather than the unit suite because it needs the whole app mounted, and requiring server.js from node:test pulls in the database pool and hangs the run — that has happened here before. Also: e2e now runs in CI on dev, gated by a shell check inside the step rather than a job-level "if", which this Forgejo dispatches anyway and then kills with "Early termination". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-13 00:52:55 +02:00
Daniel	5a666f5ca5	test: e2e runs against its own throwaway database, not production's ... The e2e stack shared production's Postgres — same server, same database, same table. Seeded robots sat in `users` beside real clinicians, and anything a test wrote, or a migration under test changed, landed on real data. Nothing about "run the tests" should be able to reach an account belonging to a person. Now it has a Postgres and a Redis of its own, both on tmpfs: created empty on every run, held in RAM, gone on teardown. scripts/e2e.sh is one command that recreates the stack, seeds it, runs the browser and leaves the app up at 127.0.0.1:3553 so it can be clicked around in, with the report served at :3554. Two bugs fell out of it immediately, both of which only a database that did not already exist could have found: The schema could not be built from nothing. The entrypoint migrated before the app created its baseline tables, so the first migration failed on saved_encounters not existing. It never showed because every database this has ever run against already had the baseline. Then, one layer down, 1777800000000_generated-images creates a table with a foreign key to learning_content — which the baseline stopped creating when Learning Hub was removed. Restoring into a brand-new database could not have booted. The entrypoint now stands aside when the database is empty and lets the app do it in the order it already gets right, and the foreign key is only created where its target is. All 20 migrations replay from empty, producing the same 23 tables production has. Configuration lives in the database, so a throwaway one starts at defaults — 14 settings against production's 49. That is why every model picker was empty: models.custom did not exist. The tests were right and the environment was incomplete, so the seed now states what the suite depends on, with fictional model ids: a test should not pass because of a setting somebody changed on the live system last week. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-13 00:49:25 +02:00
Daniel	79c329ceda	test(e2e): seed an admin account, and fix the sign-in that broke the browser suite ... Adds the admin fixture the Search Sources screen needed, and repairs the reason no browser-driving e2e test could log in at all. The sign-in failure first. The suite drove the app over http on a container hostname, which is not a secure context, so the browser provides no crypto.randomUUID. AccountBoundary calls it to mint a session generation on every sign-in; the call threw, the boot handler's catch swallowed it, and every test landed on the login screen holding a perfectly valid session. Measured: isSecureContext false and randomUUID undefined on http://pediatric-ai-scribe-e2e:3000, both true on http://127.0.0.1:3553, where boundary.enter() returns true and the app enters. Chrome's --unsafely-treat-insecure-origin-as-secure was tried first and does not work: Playwright rejects the --user-data-dir it must be paired with, and the flag alone leaves isSecureContext false. Loopback needs no flags, so the runner now uses the host network and the published port. The seed is new. The e2e user was a registration someone did by hand once that the shared Postgres happened to keep — enough to log in and no more. There was no admin account, so nothing under /api/admin could be tested through a real request, which is how the Search Sources card came to be verified by reading its markup. e2e/seed.js creates both accounts and reconciles an existing one, so a leftover with the wrong role cannot fail the suite for a reason unrelated to the code. It resets passwords and grants admin, so it refuses any address outside @ped-ai.test. The runner seeds before it tests. The new spec covers what markup-reading could not: that an ordinary account is refused the settings and never offered the Admin menu item, that no API key comes back readable, that the Test button reports each source separately, and that every control the save handler reads exists in a real render. Each account gets its own browser context, because AccountBoundary allows one owner per document and freezing the page on a second is the behaviour, not a bug. 10/10 pass on both projects. Two unit tests pin the loopback requirement and the seed's domain guard so neither can be undone quietly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 17:24:32 +02:00
Daniel	d71714b65d	test(lint): static reference linter — catches dead-code + orphan refs ... You were right that Playwright has been catching the easy bugs while the high-signal bugs (lightbox stranded after the Bedside reorg, PVC clinically wrong, prod not rebuilt) all had to be caught by you as the user. Adding a static linter so the class of bug that produced the lightbox regression fails CI next time instead of the app. scripts/lint-references.js walks public/js and validates every getElementById('X') and querySelector('#X') resolves to an id that is defined SOMEWHERE in the repo — either a static HTML attribute, a .id = 'X' assignment, or an id="X" substring inside a JS template string. It also walks HTML for asset references (data-img-src, <img src>, <audio src>, <link href>) and verifies each root-absolute path maps to a real file on disk. Running it on the current tree surfaced two real problems: 1. shadess.js:917 reached for #wv-note-transcript when collecting refine source context. The actual id is #wv-transcript (no -note- infix — the transcript element is shared across well-visit sub- panels). The bug meant a generated well-visit note's Refine call silently missed the original transcript as source context; the AI still "worked" but with less signal and no error. Fixed. 2. public/js/adminMilestones.js (221 lines) referenced 17 ids that were removed a year+ ago in commit 3173ce6 ("Remove milestone admin UI, add CMS content refresh button"). That commit dropped the HTML but forgot the JS, which has been dead-loaded on every page view since. All its addEventListener calls are guarded with optional chaining, so nothing errored — just silent cruft. Deleted the file and dropped the <script defer> tag from index.html. scripts/e2e.sh runs the linter as a preflight before the Playwright container starts; a broken reference now fails the suite before any test even boots. Allowlist is kept small and prefix-based for the handful of id families that are built dynamically by JS (bedside em-* sections, BP chart elements, etc.). When a new component is added, its ids get picked up automatically by the repo-wide collect() pass; the allowlist rarely needs to grow. Suite: 294 passed / 0 failed.	2026-04-23 18:58:38 +02:00
Daniel	abdbaa3507	feat: A1+A2 — Playwright smoke suite + index.html mtime-based caching ... Safety net for upcoming refactors: - 26 Playwright smoke tests via @playwright/test 1.50.0 in an official Playwright container (no host Node needed). Covers every Bedside sub-pill, the age→weight estimator, dose calculators (seizure/sepsis/anaphylaxis/ burns/airway), and interactive widgets (lightbox, vent SVG). - `npm run e2e` wrapper runs tests inside mcr.microsoft.com/playwright:v1.50.0-noble on the ped-ai_default Docker network so no host port mapping is needed. - public/e2e-harness.html + public/js/e2e-bootstrap.js load the calculators component without the SPA auth wall (scripts external to satisfy CSP). Server: - server.js now re-reads public/index.html on mtime change instead of caching at boot. Fixes the "edit HTML, restart container" friction. - CSP upgradeInsecureRequests disabled in helmet config; Caddy still enforces HTTPS at the reverse-proxy layer in production.	2026-04-20 03:51:22 +02:00