smacks/flixcooks-website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(phase-2): proper auth system rework via feature branch #7

Closed
LordSchmackes wants to merge 3 commits from feature/phase-2-auth-firebase into main
pull from: feature/phase-2-auth-firebase
merge into: :main
Conversation 0 Commits 3 Files Changed 6
+17 -2
1 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 70392c4665 - Show all commits
.agents/brain.md
+17 -2
View File
@@ -33,5 +33,20 @@ This document summarizes the architectural knowledge, conventions, and learnings
- **Phase 3 (Nutrition):** Implemented. Recipes now store `calories`, `protein`, `carbs`, and `fat`. Admin panel handles inputs, and the UI displays them beautifully.
- **Phase 4 (Interactive Cooking Mode):** Implemented. Recipes now support step-by-step looping background videos and interactive timers (`step_videos`, `step_timers`). The UI utilizes a fullscreen overlay slider with Vanilla JS logic.
## 6. Next Steps
According to `TODO.md`, the next major feature block is **Phase 5 (PWA & Offline Support)**, which involves service workers, manifest files, and enabling the app to be installable on mobile devices.
## 6. Git Workflow Violations & Recovery
- **Phase 2 (commit `21833fa`) and Phase 4 (commit `a4a2d83`) were committed directly to `main`**, bypassing the required feature branch → PR flow. This is the correct diagnosis when someone says "Phase X wasn't saved properly" — the code exists, but the audit trail does not.
- **Recovery strategy (retroactive feature branch):** Branch from current `main`, clean up / improve the work on that branch, then open a PR. This produces the audit trail without rewriting history. Do not force-push or attempt to amend merged commits in `main`.
## 7. Phase 2 Architecture Details
- **Auth CSS location:** All auth/profile/favorites styles live in `assets/style.css` under the `PHASE 2` section header. `login.php` should have **no inline `<style>` block**.
- **Firebase SDK version:** Using the **v10 compat SDK** (loaded via `gstatic.com`). The compat layer allows legacy v8-style API calls (`window.auth.signInWithEmailAndPassword`). This is intentional.
- **Firebase v10 error code change:** `auth/wrong-password` and `auth/user-not-found` were consolidated into `auth/invalid-credential` in Firebase v10. All three must be handled for backwards compatibility.
- **Session sync flow:** `head.php` → `onAuthStateChanged` fires → XHR POST to `api/session.php` with uid/email/token → PHP sets `$_SESSION['fc_user']` → page reloads to show auth state.
- **Token is NOT verified server-side:** `api/session.php` trusts the client-sent UID and email. The ID Token is stored but not validated cryptographically. Acceptable for a food blog; would need Firebase Admin SDK for sensitive apps.
- **Dark mode is forced:** The site is dark-only by design. `head.php` sets `data-theme="dark"` unconditionally to prevent FOUC. There is no light mode toggle and this is intentional.
## 8. Next Steps
According to `TODO.md`, all 5 phases are complete. The next work will be new features or bug fixes as directed by the user.