release: promote develop to main

.env.example

@@ -12,3 +12,46 @@ DEBUG=TRUE
 # Front-End Variables
 VITE_BASENAME=/
 #VITE_BACKEND_URL=
+
+# Authentication (#22): generate a random value; never commit the real secret.
+JWT_SECRET_KEY=
+FRONTEND_ORIGIN=http://localhost:3000
+AUTH_RESET_URL=http://localhost:3000/reset-password
+# Local simulation only with FLASK_DEBUG=1; reset links are private files.
+# AUTH_RESET_OUTBOX=.local/reset-outbox
+# SMTP_HOST=
+# SMTP_PORT=587
+# SMTP_FROM=
+# SMTP_USER=
+# SMTP_PASSWORD=
+# Production alternative: Resend HTTPS email delivery.
+# RESEND_API_KEY=re_...
+# AUTH_EMAIL_FROM=ClientFlow <no-reply@your-verified-domain.example>
+# Admin is disabled by default; local development only.
+ENABLE_DEV_ADMIN=0
+# Set false to connect the authentication UI to the backend.
+VITE_USE_MOCK_API=false
+VITE_BACKEND_URL=http://localhost:3001
+# Private embeddings service — backend only
+KNOWLEDGE_EMBEDDINGS_URL=
+KNOWLEDGE_EMBEDDINGS_API_KEY=
+KNOWLEDGE_EMBEDDINGS_MODEL=embeddinggemma
+KNOWLEDGE_EMBEDDINGS_DIMENSIONS=768
+
+# AI-01: server-side only. Never prefix service credentials with VITE_.
+AI_SERVICE_URL=https://mac-mini-de-stonetech.taildc6e48.ts.net/v1/agents/customer-service/respond
+AI_SERVICE_MODEL=qwen2.5:3b
+AI_MIN_SIMILARITY=0.5
+# Restrict the single credential to this local ClientFlow company ID.
+AI_SERVICE_COMPANY_ID=
+AI_SERVICE_API_KEY=
+# Alternatively map each company ID to its own provisioned service credential.
+# AI_SERVICE_COMPANY_KEYS={"1":"private-service-key"}
+
+# Use only with a stateless inference endpoint; tenant authorization stays in ClientFlow.
+AI_SERVICE_AUTH_MODE=company
+AI_SERVICE_PLATFORM_KEY=
+
+# Browser plan setup: random secret of at least 32 characters; empty disables writes.
+# Backend only. Remove after setup. Never use a VITE_ prefix.
+PLAN_SEED_KEY=

.eslintrc.cjs

@@ -0,0 +1,15 @@
+module.exports = {
+  root: true,
+  env: { browser: true, es2022: true, node: true },
+  parserOptions: { ecmaVersion: 'latest', sourceType: 'module', ecmaFeatures: { jsx: true } },
+  plugins: ['react'],
+  extends: ['eslint:recommended'],
+  settings: { react: { version: 'detect' } },
+  rules: {
+    'react/jsx-uses-react': 'error',
+    'react/jsx-uses-vars': 'error',
+    'no-unused-vars': 'off',
+    'no-constant-condition': ['error', { checkLoops: false }],
+  },
+  ignorePatterns: ['dist/', 'node_modules/'],
+};

.github/workflows/quality.yml

@@ -0,0 +1,101 @@
+name: Quality
+
+on:
+  pull_request:
+    branches: [develop]
+  push:
+    branches: [develop]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: quality-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  backend:
+    name: Backend tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: clientflow_test
+          POSTGRES_PASSWORD: ci_test_only
+          POSTGRES_DB: clientflow_db43
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U clientflow_test -d clientflow_db43"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      AUTH_TEST_DATABASE_URL: sqlite://
+      PYTHONPATH: src:tests
+      PYTHONDONTWRITEBYTECODE: "1"
+      PIPENV_VENV_IN_PROJECT: "1"
+      PIPENV_IGNORE_VIRTUALENVS: "1"
+      PIPENV_DONT_LOAD_ENV: "1"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: Pipfile.lock
+      - run: python -m pip install pipenv==2024.4.1
+      - run: pipenv verify && pipenv sync
+      - name: Check Python syntax and indentation
+        run: |
+          pipenv run python -m compileall -q src tests
+          pipenv run python -m tabnanny src tests
+      - name: Run backend tests with an isolated database
+        run: pipenv run python -m unittest discover -s tests -p 'test_*.py' -v
+
+      - name: Validate PostgreSQL migrations
+        env:
+          DATABASE_URL: postgresql://clientflow_test:ci_test_only@127.0.0.1:5432/clientflow_db43
+          MIGRATION_TEST_DATABASE_URL: postgresql://clientflow_test:ci_test_only@127.0.0.1:5432/clientflow_db43
+          FLASK_APP: src/app.py
+          JWT_SECRET_KEY: ci-only-signing-key-for-migration-tests-43
+        run: |
+          pipenv run flask db upgrade
+          pipenv run flask db check
+          pipenv run python -m unittest test_postgres_migrations test_postgres_migration_cycle -v
+
+  frontend:
+    name: Frontend checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+      - run: npm test
+      - run: npm run build
+
+  formatting:
+    name: Patch formatting
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Check added lines for whitespace errors
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: git diff --check "$BASE_SHA...$HEAD_SHA"
+      - name: Check commit whitespace
+        if: github.event_name != 'pull_request'
+        run: git show --format= --check HEAD

.gitignore

@@ -71,6 +71,7 @@ dist/*
 !.gitkeep
 !.htaccess
 !.eslintrc
+.env
 !.env.example
 .now
 
@@ -80,4 +81,25 @@ database.database
 database.db
 diagram.png
 __pycache__/
+.local/
+.venv/
+
+# Local Flask database files
+src/instance/*.db
+
+
+# Local databases and SQLite temporary files
+*.db
+*.db-*
+*.sqlite3
+*.sqlite3-*
+*.sqlite-*
+
+# Private key files
+*.pem
+*.key
+
+!.python-version
+
+# Ignore new local migration files; committed migrations remain tracked
 migrations

.python-version

@@ -0,0 +1 @@
+3.13

.vscode/settings.json

@@ -6,5 +6,8 @@
     },
     "[javascriptreact]": {
         "editor.defaultFormatter": "vscode.typescript-language-features"
+    },
+    "[javascript]": {
+        "editor.defaultFormatter": "vscode.typescript-language-features"
     }
 }

Pipfile

@@ -12,14 +12,17 @@ flask-migrate = "*"
 flask-swagger = "*"
 psycopg2-binary = "*"
 python-dotenv = "*"
-flask-cors = "*"
 gunicorn = "*"
 cloudinary = "*"
 flask-admin = "==2.0.0"
 typing-extensions = "*"
 flask-jwt-extended = "==4.6.0"
 wtforms = "==3.1.2"
 sqlalchemy = "*"
+flask-cors = "*"
+pypdf = "*"
+python-docx = "*"
+openai = "*"
 
 [requires]
 python_version = "3.13"