feat(api+client): projects feature (#26) #265

Merged

james merged 5 commits from 26-projects-feature into main 2026-06-23 23:35:36 +00:00

Conversation 1 Commits 5 Files changed 20 +2268 -16

james commented 2026-06-23 21:00:40 +00:00

Owner

Copy link

Summary

Brings the Projects feature live across the full stack — a per-user list of independent / outside-of-work projects with name, optional description, and optional link. Mirrors the Notes / Education CRUD shape end to end:

• DB (#016): projects table (user-scoped, ON DELETE CASCADE). display_order reserved for a future reordering ticket. Index on user_id. ProjectsRepository ships cursor-paginated list, unbounded list, findById, create, update, delete.
• API: GET/POST /api/projects + PATCH/DELETE /api/projects/{id}. Cursor pagination via the shared timestamp+id envelope. zod DTOs in lib/dto/project.ts validate name (1..200), description (≤2000, nullable), and link (http(s):// only, nullable — javascript: and friends rejected).
• OpenAPI: four routes registered in lib/api/openapi-routes.ts; openapi.json regenerated; drift gate green; coverage 69 (path, method) pairs.
• @carol/api-client: useProjects, useCreateProject, useUpdateProject, useDeleteProject (mutations patch the list cache in place); keys.projects added to the central registry.
• Client: /projects screen replaces the placeholder. Inline create + edit-in-place, link tappable via Linking.openURL, KeyboardAwareScrollView + Enter chains, theme-aware styles pre-flattened to plain objects per #239.
• i18n: full projects.* namespace in en.json (sentence case, first person, voice-guide compliant).

Routes

Method	Path	Description
GET	/api/projects	List (cursor-paginated)
POST	/api/projects	Create
PATCH	/api/projects/{id}	Update (partial)
DELETE	/api/projects/{id}	Delete

Test plan

• pnpm install --frozen-lockfile
• pnpm -F @carol/api typecheck
• pnpm -F @carol/api lint
• pnpm -F @carol/api test — 680 passed (53 files; sqlite leg; postgres-leg tests skipped here, will run on CI)
• pnpm -F @carol/api openapi:check — up to date
• pnpm -F @carol/api openapi:coverage — 69 (path, method) pairs registered
• pnpm -F @carol/api-client check — generated client up to date
• pnpm -F @carol/api-client typecheck
• pnpm -F @carol/api-client lint
• pnpm -F @carol/api-client test
• pnpm -F @carol/client typecheck
• pnpm -F @carol/client lint
• pnpm -F @carol/client test
• pnpm -F @carol/client export:web — 24 routes including /projects

Notes for the reviewer

• projects in KYSELY_TABLES: added BEFORE users in tests/db/_engines.ts to keep the Postgres drop order FK-safe (the trap from #259).
• Link validation strictness: the zod schema accepts only well-formed URLs and only http:// / https:// schemes (refine on top of z.url()). The client mirrors that contract via isValidProjectLink in projects.tsx. Tests cover both "not a url" and "javascript:alert(1)".
• display_order: defaulted to 0 by the repo on insert, untouched by update. Reserved for the eventual reordering feature; no client surface today.
• Out of scope as per the ticket: reordering, linking projects to jobs/contracts, attachments, external import.

Linked: #26. See idea.md → Experience for the product context.

Closes #26.

## Summary Brings the Projects feature live across the full stack — a per-user list of independent / outside-of-work projects with name, optional description, and optional link. Mirrors the Notes / Education CRUD shape end to end: - **DB (#016)**: `projects` table (user-scoped, ON DELETE CASCADE). `display_order` reserved for a future reordering ticket. Index on `user_id`. `ProjectsRepository` ships cursor-paginated list, unbounded list, findById, create, update, delete. - **API**: `GET/POST /api/projects` + `PATCH/DELETE /api/projects/{id}`. Cursor pagination via the shared timestamp+id envelope. zod DTOs in `lib/dto/project.ts` validate name (1..200), description (≤2000, nullable), and link (http(s):// only, nullable — `javascript:` and friends rejected). - **OpenAPI**: four routes registered in `lib/api/openapi-routes.ts`; `openapi.json` regenerated; drift gate green; coverage 69 (path, method) pairs. - **@carol/api-client**: `useProjects`, `useCreateProject`, `useUpdateProject`, `useDeleteProject` (mutations patch the list cache in place); `keys.projects` added to the central registry. - **Client**: `/projects` screen replaces the placeholder. Inline create + edit-in-place, link tappable via `Linking.openURL`, KeyboardAwareScrollView + Enter chains, theme-aware styles pre-flattened to plain objects per #239. - **i18n**: full `projects.*` namespace in `en.json` (sentence case, first person, voice-guide compliant). ## Routes | Method | Path | Description | | --- | --- | --- | | GET | /api/projects | List (cursor-paginated) | | POST | /api/projects | Create | | PATCH | /api/projects/{id} | Update (partial) | | DELETE | /api/projects/{id} | Delete | ## Test plan - [x] `pnpm install --frozen-lockfile` - [x] `pnpm -F @carol/api typecheck` - [x] `pnpm -F @carol/api lint` - [x] `pnpm -F @carol/api test` — 680 passed (53 files; sqlite leg; postgres-leg tests skipped here, will run on CI) - [x] `pnpm -F @carol/api openapi:check` — up to date - [x] `pnpm -F @carol/api openapi:coverage` — 69 (path, method) pairs registered - [x] `pnpm -F @carol/api-client check` — generated client up to date - [x] `pnpm -F @carol/api-client typecheck` - [x] `pnpm -F @carol/api-client lint` - [x] `pnpm -F @carol/api-client test` - [x] `pnpm -F @carol/client typecheck` - [x] `pnpm -F @carol/client lint` - [x] `pnpm -F @carol/client test` - [x] `pnpm -F @carol/client export:web` — 24 routes including `/projects` ## Notes for the reviewer - **`projects` in `KYSELY_TABLES`**: added BEFORE `users` in `tests/db/_engines.ts` to keep the Postgres drop order FK-safe (the trap from #259). - **Link validation strictness**: the zod schema accepts only well-formed URLs and only `http://` / `https://` schemes (refine on top of `z.url()`). The client mirrors that contract via `isValidProjectLink` in `projects.tsx`. Tests cover both `"not a url"` and `"javascript:alert(1)"`. - **`display_order`**: defaulted to 0 by the repo on insert, untouched by update. Reserved for the eventual reordering feature; no client surface today. - **Out of scope** as per the ticket: reordering, linking projects to jobs/contracts, attachments, external import. Linked: [#26](https://forge.wynning.tech/james/carol/issues/26). See [`idea.md`](https://forge.wynning.tech/james/carol/src/branch/main/idea.md) → _Experience_ for the product context. Closes #26.

james added 5 commits 2026-06-23 21:00:40 +00:00

feat(db): projects table + repository (#26) ... 9217c16f6a

Adds the `projects` table (per-user, cascading on user delete) plus
`ProjectsRepository` mirroring the EducationsRepository / NotesRepository
pattern: cursor-paginated list, unbounded list, findById, create,
partial-update, deleteById. `display_order` is reserved for a future
reordering feature; the rest of the columns back the standalone-project
CRUD surface from idea.md's Experience section.

Dual-engine tests under tests/db/projects.test.ts; `projects` added to
KYSELY_TABLES before `users` for the Postgres drop order (#259).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat(api): /api/projects CRUD + zod DTOs + openapi (#26) ... 73ef10959e

Adds the four-handler shape (list, create, patch, delete) mirroring
/api/educations. Cross-user lookups 404 per the don't-leak-existence
rule; cursor-pagination uses the shared timestamp+id envelope from
lib/api/pagination.ts.

zod DTOs in lib/dto/project.ts validate name (1..200), description
(nullable, ≤2000), and link (nullable, http(s):// only — javascript:
and friends rejected at the zod layer). Update DTO requires at least
one field via the shared refine convention.

OpenAPI 3.1 registry entries added in lib/api/openapi-routes.ts;
openapi.json regenerated and drift-checked. HTTP-layer tests under
tests/api/projects.test.ts cover auth, ownership 404s, pagination,
URL validation, and the empty-patch 400.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat(api-client): projects hooks + regenerated typed client (#26) ... 940eba2b00

`useProjects`, `useCreateProject`, `useUpdateProject`,
`useDeleteProject` — same shape as the educations hooks. Mutations
patch the cached list in place to avoid edit-cycle flicker.

`keys.projects` added to the central key registry; the
distinct-first-segment invariant test updated to 10 buckets.
Generated schema regenerated from the bumped openapi.json.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat(i18n): projects screen catalog (#26) ... 0c610d64d7

Adds the projects.* keys the new CRUD screen consumes — title/lede,
field labels and placeholders, button states, loading/empty/error
strings, and a client-side linkInvalid hint. Sentence-case + first-
person per the design system voice guide. es.json keeps falling back
to English per-key (per the existing partial-locale convention).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat(client): projects screen — list, create, edit, delete (#26) ... f701111b1f

Replaces the placeholder /projects route with a real CRUD surface.
Inline create-and-edit form (mirrors notes.tsx), per-row Edit /
Delete actions (mirrors education in experience.tsx). Loading,
load-failed, and empty states all surfaced via the projects.*
catalog.

Enter chains the create + edit forms (name → description →
link → submit) under KeyboardAwareScrollView so the focused input
auto-scrolls into view on small screens (#258, #255). Link
validation runs client-side via lib/serverUrlValidate.ts-shaped
isValidProjectLink — http(s) only, same gate as the zod DTO.

Theme tokens are pre-flattened into plain objects once per render
(via useMemo) and applied to leaf primitives directly, per #239's
style-array audit. Tappable links call Linking.openURL — same
external-open helper account.tsx and login.tsx use.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

forgejo-actions commented 2026-06-23 21:06:03 +00:00

Copy link

📊 Test coverage

Patch coverage: no testable lines changed.

Overall (app/, lib/, db/, excluding UI per ADR-0019):

Metric	Value	Soft target
Lines	82.9% ✅	≥ 50%
Branches	75.6% ✅	≥ 75%
Functions	91.9%	informational

Soft thresholds per ADR-0019. Coverage is informational and does not block merge.

<!-- coverage-comment --> ## 📊 Test coverage **Patch coverage:** no testable lines changed. **Overall** (`app/`, `lib/`, `db/`, excluding UI per ADR-0019): | Metric | Value | Soft target | |---|---|---| | Lines | 82.9% ✅ | ≥ 50% | | Branches | 75.6% ✅ | ≥ 75% | | Functions | 91.9% | informational | Soft thresholds per [ADR-0019](docs/adr/0019-coverage-soft-targets.md). Coverage is informational and does not block merge.

james merged commit e8ebebf920 into main 2026-06-23 23:35:36 +00:00

james deleted branch 26-projects-feature 2026-06-23 23:35:36 +00:00

james referenced this pull request from a commit 2026-06-23 23:35:38 +00:00

Merge pull request 'feat(api+client): projects feature (#26)' (#265) from 26-projects-feature into main

james referenced this pull request from a commit 2026-06-24 02:45:16 +00:00

feat(api): organizations routes for detail, links, key-people (#28)

james referenced this pull request 2026-06-24 02:46:53 +00:00

feat(api+client): organizations feature with links and key people (#28) #269

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area:auth

Authentication and authorization

  

area:ci

Forgejo Actions, build, test, security, release

  

area:db

Database abstraction, migrations, persistence

  

area:infra

Containerization, deployment, foundational tooling

  

area:native

React Native app (Android + Linux Flatpak)

  

area:pwa

PWA / web frontend

  

area:service

Backend service, API routes, persistence

  

epic

High-level tracker; links several feature tickets

  

feature

A user-facing feature

  

foundation

Foundational work that other tickets build on

No labels

area:auth

area:ci

area:db

area:infra

area:native

area:pwa

area:service

epic

feature

foundation

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

james/carol!265

No description provided.