Files

T

Moheeb Zara 8ad1ca44b7 feat: open-source release prep, audit fixes, and deploy hardening

Production deploy completed (DigitalOcean Droplet, self-hosted Supabase,
Caddy + Let's Encrypt, GitHub Actions auto-deploy on push to main, daily
pg_dumpall backups). This commit lands the work that came out of the
deep audit pass and the open-source release prep.

Audit fixes:
- Webhook signing secret is now displayed in the settings UI with
  show/hide and copy-to-clipboard; the broken external docs.hackerspace.sh
  link is replaced with a link to the new local docs.
- Settings updateSpaceSettings parameter type now includes
  mission_statement so the field persists.
- members page enforces member_directory_visibility for non-admin viewers
  (admin_only, board_visible, members_visible).
- Mobile responsiveness pass: Projects Kanban grid, Members + Payments
  tables (column hiding on small screens), Proposal tally + voting
  buttons (2-col on mobile).

Open-source release scaffolding:
- LICENSE (MIT).
- CONTRIBUTING.md with dev setup, conventions, PR flow.
- SECURITY.md with disclosure policy.
- CHANGELOG.md.
- docs/WEBHOOKS.md with Node and Python signature verification examples.
- README.md rewritten for an open-source audience.

Removed v0/Vercel references:
- @vercel/analytics dependency removed.
- app/layout.tsx no longer imports Analytics, drops generator: 'v0.app'.
- Canonical deployment docs (docs/DEPLOYMENT.md, docs/README.md,
  docs/ARCHITECTURE.md, DATABASE.md, CLAUDE.md, README.md) now describe
  the self-hosted Droplet target only.
- e2e console-error check no longer filters [v0] noise.

Landing page:
- GitHub icon link to the public repo in the nav and footer.

2026-05-14 16:28:16 -07:00

3.8 KiB

Raw Permalink Blame History

Contributing to hackerspace-management

Thank you for your interest. This document explains how to set up a development environment, the conventions the codebase follows, and how to submit a change.

Getting set up

Fork the repository on GitHub and clone your fork:

git clone https://github.com/<your-user>/hackerspace-management.git
cd hackerspace-management

Install dependencies:
```
pnpm install
```
Copy the env template and fill it in:
```
cp .env.example .env.local
```
For a fully local stack (recommended), follow docs/LOCAL_DEV.md. It walks you through running Supabase locally with the Supabase CLI in under five minutes.
Start the dev server:
```
pnpm dev
```
Sign up, create a space, and you should land on the dashboard at http://localhost:3000/dashboard.

How the project is structured

Top-level directories:

app/ — Next.js App Router routes, grouped by (app) (authenticated app), (landing) (public landing), (resources) (legacy hackerspace.sh subsite).
components/ — Shared React components.
lib/ — Server actions, helpers, validations, type definitions.
scripts/ — Database schema and numbered SQL migrations.
docs/ — Long-form documentation.
e2e/ — Playwright end-to-end tests.
__tests__/ — Vitest unit tests.

See docs/ARCHITECTURE.md for a deeper tour.

Database changes

The schema is owned by scripts/schema.sql (full, idempotent state) and a sequence of numbered files (scripts/NNN_description.sql). Rules:

Add a new numbered file under scripts/ for every schema change. Do not edit prior numbered files.
Update scripts/schema.sql to reflect the new canonical state.
Keep migrations idempotent (IF NOT EXISTS, OR REPLACE, exception-handled CREATE TYPE).
Add or update RLS policies whenever you add a table. Default to deny.
Note the change in CHANGELOG.md.

scripts/README.md documents the migration conventions in full.

Coding conventions

TypeScript strict mode. No any unless the third-party type is genuinely lost.
Prefer server components and server actions. Push client interactivity to small leaf components.
Tailwind for styling, shadcn/ui primitives for inputs, dialogs, dropdowns.
Avoid premature abstraction. Three similar lines of code is better than a clever helper.
Validation lives in lib/validations.ts (Zod). Every server action must validate its input.
All queries that touch tenant data go through the Supabase server client. Service role only inside trusted server actions, never in client components.

Tests

Unit: pnpm test. Files live under __tests__/.
End to end: pnpm test:e2e. Files live under e2e/. Requires a local dev server.
New server actions need a unit test. New user-visible flows need an e2e test.

Submitting a change

Create a branch off main:
```
git checkout -b feat/short-description
```
Make your change. Run pnpm lint and pnpm test.

Commit. Write the message in the imperative mood, focused on the why:

feat: surface webhook secret with copy button

Admins could rotate the signing secret but never see the new value,
making it impossible to use for signature verification.

Push and open a pull request against main. Describe what changed and why, link any related issue, and call out anything reviewers should pay extra attention to.
CI runs lint and tests. A maintainer will review.

Security issues

Do not file public GitHub issues for security vulnerabilities. See SECURITY.md for the disclosure process.

Code of conduct

Be kind. Assume good faith. Hackerspaces and makerspaces thrive on collaboration. We extend the same expectation to the project.

3.8 KiB Raw Permalink Blame History