Commit graph

161 commits

Author SHA1 Message Date
df539f7cb7 test: update unit tests for real vehicle API and fuel field
- HomePage.spec.ts: replace setTimeout fake data with mocked lookupVehicle()
  API call, mock resolved/rejected/pending states, add fuel to mock responses
- VehicleInfo.spec.ts: add fuel field to mockVehicle data,
  update assertion to include Bensin in rendered text
2026-05-19 15:16:52 +02:00
be7775f680 test: add E2E tests for homepage vehicle lookup flow
- enters plate and sees vehicle info with CTA button:
  types HDO732, verifies Peugeot 107 1.0, 2011, Gul, Bensin appear,
  verifies Fortsatt till brevet link has correct href
- shows not found for unknown plate (ZZZ999)
- CTA navigates to compose when authenticated:
  logs in as test@bilhalsning.se, performs lookup, clicks CTA,
  verifies redirect to /compose?plate=HDO732
2026-05-19 15:16:34 +02:00
1b87e15a21 feat: replace fake vehicle data with real API lookup on homepage
- Add typed API module api/vehicles.ts with lookupVehicle(plate) function
- Replace FAKE_VEHICLES record with async API call in HomePage.vue
- Remove setTimeout-based fake lookup, use lookupVehicle() instead
- Handle errors: show not-found for unknown plates, catch network failures
- Add fuel field to VehicleInfo interface and display (e.g. 'Gul, Bensin')
- VehicleInfo now shows make, model, year, color, and fuel from API
2026-05-19 15:16:23 +02:00
3792fdec82 test: add service and controller tests for vehicle lookup
- Add real HTML fixture from biluppgifter.se/fordon/hdo732/ containing:
  summary cards (.info > em + span) for Modellar, Typ, Farg, Bransle
  Fordonsdata section (ul.list with span.label/span.value) for Fabrikat, Modell, Variant, Fordonsar/Modellar
- Add VehicleLookupServiceTest with 6 cases:
  shouldParseAllFieldsFromFixture, shouldParseSummaryFields,
  shouldParseDataSectionFields, shouldReturnEmptyFieldsForEmptyDocument,
  shouldBuildModelWithoutVariant, shouldFallbackToModellarWhenNoFordonsar
- Add VehicleControllerTest with 4 cases:
  shouldReturnVehicleInfoForValidPlate (200 with all fields),
  shouldReturn404WhenVehicleNotFound, shouldBeAccessibleWithoutAuthentication,
  shouldReturnVehicleInfoWithFuelField
2026-05-19 15:15:50 +02:00
18f462c5c1 feat: add real vehicle lookup via biluppgifter.se scraping
- Add VehicleInfoResponse DTO record with make, model, year, color, fuel fields
- Add VehicleNotFoundException for unknown plates (returns 404)
- Add VehicleLookupException for scrape failures (returns 500)
- Add handlers in GlobalExceptionHandler: 404 'Inget fordon hittades', 500 'Ett internt fel uppstod'
- Add VehicleLookupService that fetches biluppgifter.se/fordon/{plate}/ HTML
- Parse summary cards (.info > em + span) for Farg, Bransle, Modellar
- Parse Fordonsdata section (ul.list > li with span.label / span.value) for Fabrikat, Modell, Variant, Fordonsar
- Build model from Modell + Variant, parse year from Fordonsar / Modellar with Modellar fallback
- Filter out 'Logga in' placeholder values from gated fields
- Add VehicleController with GET /api/vehicles/{plate}, public endpoint (already permitAll)
2026-05-19 15:15:20 +02:00
6dc9b6de33 feat: add Jsoup 1.18.1 dependency for HTML parsing
- Add org.jsoup:jsoup:1.18.1 to backend dependencies
- Will be used by VehicleLookupService to scrape vehicle data from biluppgifter.se
2026-05-19 15:11:01 +02:00
2506a0283c test: update Vitest and E2E specs for redesigned UI
- Update HomePage specs: new headline, CTA class from btn--success to btn--primary
- Update ComposePage specs: new button text, brand name in GDPR footer
- Update PaymentRedirect specs: button text, class, and test payment note
- Update TemplatePicker specs: remove emoji icon assertion
- Update AdminDashboard specs: expand button selectors instead of row clicks
- Update AppHeader specs: BilHälsning to Bilhej brand text
- Update AboutPage specs: BilHälsning to Bilhej heading
- Update App specs: new homepage headline text
- Update OrdersPage specs: badge class renames
- Update LoginPage specs: form name/action attribute tests
- Update E2E compose specs: button text, GDPR footer brand name
- Update E2E payment specs: button text and note selectors
- Update E2E admin-dashboard specs: expand button and tracking label selectors
- Update E2E header-auth specs: new test additions for admin visibility
2026-05-16 16:11:58 +02:00
851cd8afa0 refactor: redesign all pages and components with new design system
- Rewrite homepage: practical headline, use-case cards, calm trust note
- Switch from purple to blue brand tokens across all pages
- Replace all CTA buttons with brand-primary, reserve green for success
- Remove emoji from template picker and compose page
- Replace unicode chevrons with SVG expand buttons in admin
- Redesign template picker modal with accessibility semantics
- Add aria-invalid, aria-describedby to form validation
- Add role=status/alert to loading, error, and result messages
- Remove inline styles, replace with scoped utility classes
- Update compose submit text, payment button, order empty state copy
- Remove icon field from letter templates
2026-05-16 16:11:01 +02:00
00327674ed refactor: add design system with CSS tokens, utilities, and app shell
- Add design tokens (colors, spacing, radius, shadows, typography, transitions)
- Add global reset, body/link/focus/typography base styles
- Add utility classes (container, surface-card, btn variants, field, badge, message, divider)
- Replace header ✉ symbol with inline SVG envelope icon
- Update favicon to license-plate shaped mark with blue gradient and bold B
- Rename brand from BilHälsning to Bilhej in header, footer, and HTML title
- Rewrite footer tagline: focus on service, not privacy
- Add theme-color meta tag for browser chrome
2026-05-16 16:09:35 +02:00
8cd7991603 test: add payment flow tests and fix strict-mode e2e violations
Vitest:
  - PaymentRedirect.spec.ts (8 tests): renders heading and 49 kr,
    shows plate from query, Betalt button exists, calls payOrder on
    click, navigates to /orders on success, shows error on failure,
    disables button while paying, shows mock note
  - ComposePage.spec.ts: update navigation test to expect /betalning
    route with orderId param instead of /orders; add payment route
    to test router; add PaymentRedirect import

Playwright E2E:
  - payment-redirect.spec.ts (4 tests): compose→payment navigation,
    Betalt→orders flow, auth guard redirects to login, mock note
    visible
  - compose.spec.ts: rename test and update assertion from /orders
    to /betalning/ URL pattern; use getByRole('heading',
    { name: 'Betalning' }) to avoid strict mode violation with
    mock-note paragraph containing the word 'Betalning'
2026-05-15 20:31:16 +02:00
c3c1513ac1 feat: add payment page and wire compose submit to payment flow
- api/payment.ts: payOrder(orderId) calls POST /api/payment/{id}/pay
- api/orders.ts: add amountPaid (number|null) to Order type
- PaymentRedirect.vue: route /betalning/:orderId, shows plate from
  query?plate, amount label (49 kr), green Betalt button, mock note:
  "Detta är en mock-betalning. I framtiden skickas du till Stripe."
  On click: calls payOrder, on success navigates to /orders, on
  failure shows error. Button disables and shows "Bearbetar..." while
  paying.
- ComposePage.vue: after createOrder success, captures returned order
  object and navigates to /betalning/{orderId}?plate=... instead of
  the old direct-to-orders route
- Router: add /betalning/:orderId route (name: payment, component:
  PaymentRedirect, meta: { requiresAuth: true })
2026-05-15 20:30:15 +02:00
d27bde2fbe test: add PaymentControllerTest with 4 cases
- shouldReturn403WhenNotAuthenticated: verifies the endpoint requires
  a valid JWT token (anyRequest().authenticated() enforcement)
- shouldMarkOrderAsPaidSuccessfully: calls POST with @WithMockUser,
  verifies response includes id, status=paid, and amountPaid=49.00
- shouldReturn404WhenOrderNotFound: mocks service to throw
  OrderNotFoundException, expects 404 response
- Test helper creates minimal Order entity with explicitly set id,
  plate, status, and amountPaid for realistic response mapping
2026-05-15 20:30:02 +02:00
744ff00b9d feat: add POST /api/payment/{orderId}/pay mock payment endpoint
- PaymentController: @RestController at /api/payment, requires
  authentication (covered by SecurityConfig.anyRequest().authenticated())
- POST /{orderId}/pay: calls orderService.markAsPaid(orderId) which
  sets status=PAID and amountPaid=49.00, returns updated OrderResponse
- No Stripe integration yet — pure mock simulating what a successful
  Stripe webhook callback would do in Phase 1
- toResponse() mapper reuses the same OrderResponse structure as
  OrderController for consistent API shape
2026-05-15 20:29:42 +02:00
00ada956bf refactor: add amountPaid to OrderResponse and markAsPaid to OrderService
- OrderResponse record: add BigDecimal amountPaid field — null means
  the order hasn't been paid yet; 49.00 when paid via payment page
- OrderService.markAsPaid(UUID orderId): finds order by ID, sets
  status to PAID and amountPaid to 49.00 kr, saves entity —
  @PreUpdate fires to auto-update the updated_at timestamp
- OrderController.toResponse() mapper updated to include
  order.getAmountPaid() in the response DTO
- Existing controller and service tests pass unchanged — the new
  field in the record adds a default null parameter to existing
  constructor calls without breaking
2026-05-15 20:29:31 +02:00
0f34d29a2a test: add tracking entry vitest and e2e tests, fix pre-existing flaky tests
- AdminDashboard.spec.ts (+6 tests):
  - tracking input and save button visible in expanded row
  - PostNord link visible when trackingId is set
  - PostNord link hidden when trackingId is null
  - save button fires PATCH to correct URL
  - tracking error shown on failed save
- admin-dashboard.spec.ts (+4 tests):
  - tracking input and save button visible after row expand
  - PostNord link with postnord href visible for orders with tracking
  - PostNord link hidden for orders without tracking
  - fix row selector to use .last() for deterministic tracking check
    (compose test creates extra ABC123 order that shifts row order)
- compose.spec.ts: fix strict mode violation — getByText('ABC123')
  resolved to 2 elements (strong + preview paragraph) after admin
  test expanded an ABC123 row; use .first()
- order-history.spec.ts: fix strict mode violations — ABC123 and
  Levererat resolve to 2 elements due to compose test creating
  an extra ABC123 order with status changed to delivered; use
  .first() on affected assertions
2026-05-15 19:59:00 +02:00
dcc466439e feat: add tracking input, save button, and PostNord link to admin dashboard
- api/admin.ts: updateTracking(orderId, trackingId) calls PATCH
  /api/admin/orders/{id} with JSON { trackingId }
- AdminPage.vue expanded row: add "Spårnings-ID" section below
  Brevtext with text input, save button, and PostNord link
- trackingInputValues reactive map tracks per-order input state
- toggleExpand initialises trackingInputValues[orderId] from
  order.trackingId on first expand
- handleTrackingSave: PATCH API call with optimistic local update,
  reverts on error, shows red inline error
- PostNord link (<a target="_blank">): https://www.postnord.se/
  verktyg/spara/?id={trackingId}, only visible when trackingId
  is non-null
- trackingError ref for inline error state
- CSS: tracking section styling, input focus ring, blue save button
2026-05-15 19:58:46 +02:00
ebab892e93 feat: add PATCH /api/admin/orders/{id} for manual tracking entry
- UpdateTrackingRequest DTO: optional trackingId string (nullable —
  allows clearing a tracking ID entered incorrectly)
- OrderService.updateTracking(orderId, trackingId): finds order,
  sets trackingId via setter, saves entity — @PreUpdate fires to
  update the updated_at timestamp automatically
- AdminController.PATCH /api/admin/orders/{id}: admin-only endpoint,
  validates request body with @Valid, returns updated AdminOrderResponse
  via the existing toAdminResponse() mapper
- AdminControllerTest: 5 new tests —
  shouldReturn403WhenPatchingTrackingWithoutAuth,
  shouldReturn403WhenPatchingTrackingAsNonAdmin,
  shouldUpdateTrackingSuccessfully (verifies response id and trackingId),
  shouldClearTrackingWhenNull (removes trackingId),
  shouldReturn404WhenOrderNotFoundForTracking
2026-05-15 19:58:33 +02:00
f6825ec885 test: add OrderStatusConverter and SubscriptionConverter unit tests
- OrderStatusConverterTest (6 tests): null-to-null, value-to-string,
  string-to-enum matching, null-to-null reverse, invalid string throws
  IllegalArgumentException, roundtrip all 6 OrderStatus values
- SubscriptionConverterTest (6 tests): same pattern for 3 subscription
  values (NONE/BASIC/PRO)
- Pure unit tests — no Spring context, no database
- Raises backend branch coverage from 45.5% to 77.3% (both converters
  now at 100% branch and line coverage)
- Unblocks ./gradlew check: the 60% branch threshold was previously
  failing due to untested converter logic
2026-05-15 19:58:18 +02:00
3fa4f6831e docs: add coverage thresholds, ./gradlew coverage, and LSP warning discipline
AGENTS.md:
  - Add "./gradlew coverage" to All-in-one quick-start section
  - Add "npm run test:coverage" to Frontend commands
  - Add Coverage section: command, threshold table (70% lines, 60%
    branches, 70% functions), HTML report paths for both layers
  - Note that coverage is enforced during ./gradlew check

CODING_GUIDELINES.md:
  - Section 1 (General Principles): add "Treat warnings as mistakes"
    rule — LSP diagnostics, compiler warnings, and lint warnings are
    bugs that must be fixed before commit
  - Known false positives (Lombok, getActivePinia) must be suppressed
    explicitly at the narrowest scope with a comment explaining why
  - Uncommented suppressions are treated as errors
  - Section 7 (Testing): add Coverage subsection with thresholds table,
    command reference, report paths, and enforcement rule (PRs must
    maintain or improve coverage)
2026-05-15 12:16:16 +02:00
7e6124ce4a chore: add root gradle coverage and frontendCoverage tasks
- frontendCoverage: runs 'npm run test:coverage' in frontend directory
  (vitest with coverage, enforces thresholds internally)
- coverage: group='verification', runs backend jacocoTestReport and
  frontendCoverage sequentially — single command for both layers:
  ./gradlew coverage
- check task continues to run only: frontendLint → frontendTest
  (coverage verification is added per-module: jacocoTestCoverage
  Verification on backend, vitest thresholds on frontend)
2026-05-15 12:16:04 +02:00
e654d42a4f chore: add vitest coverage enforcement to frontend
- Install @vitest/coverage-v8 as devDependency (13 packages)
- Add coverage block to vite.config.ts test config:
  - provider: 'v8' (Node.js native coverage, faster than istanbul)
  - reporters: text, html, lcov, json
  - thresholds: 70% lines, 60% branches, 70% functions, 70% statements
  - exclude: test files and e2e directory
- Add "test:coverage": "vitest run --coverage" script to package.json
- Coverage report output: frontend/coverage/index.html
  JSON output:     frontend/coverage/coverage-final.json
- Thresholds are enforced by vitest itself — build exits non-zero
  if any threshold is not met
2026-05-15 12:15:55 +02:00
fc5e9ddda7 chore: add JaCoCo coverage enforcement to backend
- Add jacoco plugin (bundled with Gradle, no extra dependency)
- jacocoTestReport: generates HTML + XML reports, runs after test
- jacocoTestCoverageVerification: enforces 70% line coverage and
  60% branch coverage at the bundle level
- Wire jacocoTestCoverageVerification into tasks.named('check') so
  ./gradlew check blocks if coverage drops below thresholds
- HTML report output: backend/build/reports/jacoco/index.html
- test task finalizedBy jacocoTestReport so report is always
  available after running tests
2026-05-15 12:15:45 +02:00
668cd023be test: add admin dashboard Vitest and Playwright E2E tests
Vitest (14 tests) — AdminDashboard.spec.ts:
  - renders heading, subtitle, table columns, order data in rows
  - shows loading, empty, and error states
  - fetches GET /api/admin/orders on mount
  - expands row on click to reveal letter content (Brevtext label)
  - collapses row on second click
  - only one row expanded at a time (clicking row 2 closes row 1)
  - status dropdown change fires PATCH /api/admin/orders/{id}/status
    with correct URL, method, and JSON body
  - shows error message on failed status update

Playwright E2E (8 tests) — admin-dashboard.spec.ts:
  - admin login (admin@bilhalsning.se / test1234) before each test
  - admin can navigate to /admin and see heading
  - non-admin user (test@bilhalsning.se) is redirected away from /admin
  - table renders Datum/E-post/Regnr/Status column headers
  - seeded order plates visible (ABC123, DEF456, GHI789)
  - click row expands letter content
  - click again collapses letter content
  - status dropdown change persists (selectOption delivered)
  - unauthenticated access redirects to login with ?redirect=/admin
2026-05-15 12:15:36 +02:00
9b4f08469c feat: build admin dashboard with orders table and status dropdown
- api/admin.ts: AdminOrder interface (id, email, plate, letterText,
  status, trackingId, amountPaid, createdAt), fetchAllOrders() calls
  GET /api/admin/orders, updateOrderStatus(orderId, status) calls
  PATCH /api/admin/orders/{id}/status
- AdminPage.vue replaces placeholder with full dashboard:
  - Table columns: Datum, E-post, Regnr, Status, expand chevron
  - Click any row to toggle expanded letter preview below the row
  - Only one row expanded at a time; second click collapses
  - Status column has a <select> dropdown showing Swedish labels
  - Changing dropdown fires PATCH API immediately (no save button)
  - On API failure the dropdown reverts to previous value and a
    red inline error "Kunde inte uppdatera status" appears
  - Loading, empty, and API error states with Swedish messages
  - Responsive table wrapper for horizontal scroll on small screens
  - Expanded rows use a separate <tr> with colspan(5) for clean
    table semantics
2026-05-15 12:15:19 +02:00
5df7c97977 test: add AdminControllerTest with 10 role-enforcement and validation cases
- GET /api/admin/orders:
  - shouldReturn403WhenNotAuthenticated
  - shouldReturn403ForNonAdminUser (roles = USER)
  - shouldReturnAllOrdersForAdmin (roles = ADMIN, checks all response fields
    including email, plate, letterText, status)
  - shouldReturnEmptyArrayWhenNoOrders
- PATCH /api/admin/orders/{id}/status:
  - shouldReturn403WhenPatchingStatusWithoutAuth
  - shouldReturn403WhenPatchingStatusAsNonAdmin
  - shouldUpdateOrderStatusSuccessfully (verifies response id matches
    path variable, status reflects update)
  - shouldReturn400WhenStatusIsInvalid (invalid_status rejected by
    @Pattern validator)
  - shouldReturn400WhenStatusIsBlank
  - shouldReturn404WhenOrderNotFound
- Helper createOrder(UUID orderId, String plate, String email,
  OrderStatus) builds domain objects with User relationship for
  realistic response mapping
2026-05-15 12:15:06 +02:00
76028fa94d feat: add GET /api/admin/orders and PATCH /api/admin/orders/{id}/status
- AdminOrderResponse DTO: extends OrderResponse with email (from User
  relation) and letterText fields, exposing the full order for admin review
- UpdateStatusRequest DTO: single "status" field validated against all
  six OrderStatus values (pending_payment|paid|lookup_started|sent|
  delivered|failed) with Swedish error messages
- OrderService.getAllOrders(): delegates to OrderRepository
  .findAllByOrderByCreatedAtDesc() which uses @EntityGraph to eagerly
  fetch the user relationship in a single query
- OrderService.updateOrderStatus(orderId, statusString): looks up order,
  converts status string to OrderStatus enum via case-insensitive
  valueOf(), saves updated entity
- AdminController /api/admin:
  GET  /orders              → list all orders with user email (admin only)
  PATCH /orders/{id}/status → update order status (admin only)
- toAdminResponse() mapper safely handles null user (empty email fallback)
2026-05-15 12:14:53 +02:00
8217b9c038 feat: wire role-based authorities from JWT into Spring Security
- JwtAuthenticationFilter now extracts the "role" claim from the JWT
  token and creates a SimpleGrantedAuthority("ROLE_" + role.toUpperCase())
  on the authentication token. Previously the authorities list was
  always empty (only userDetails.getAuthorities() which returned List.of())
- SecurityConfig adds .requestMatchers("/api/admin/**").hasRole("ADMIN")
  so admin endpoints require the ROLE_ADMIN authority
- All existing endpoints remain authenticated() only — no existing user
  flow is affected
- Public endpoints (auth, webhooks, vehicles) still permitAll()
2026-05-15 12:14:39 +02:00
fefdea089d refactor: add @ManyToOne User relation to Order entity and @EntityGraph query
- Add @ManyToOne(fetch = LAZY) + @JoinColumn(name = "user_id",
  insertable = false, updatable = false) to Order entity so ORM can
  navigate order.getUser().getEmail() for admin responses
- Keep userId as writable UUID field; the relationship is read-only
  to preserve backward compatibility with existing setUserId() calls
- Add getUser() / setUser() accessors
- Replace handwritten @Query JOIN FETCH with Spring Data derived method
  findAllByOrderByCreatedAtDesc() annotated with @EntityGraph(attributePaths
  = {"user"}) — same eager-load behavior, zero custom JPQL
- No database schema change: user_id FK already exists
2026-05-15 12:14:28 +02:00
96508d63cd feat: add template picker modal to compose page
- Add LetterTemplate.icon field and 7th template 'Mindre parkeringsskada' (🅿️)
- Create TemplatePicker.vue component: modal overlay with 2-column card grid,
  emits 'select' and 'close' events, closes on overlay click
- Add ' Visa mallar' pill button above textarea in ComposePage
- Clicking button opens TemplatePicker modal, selecting a template fills
  textarea and closes modal
- Style button as pill/badge with light blue background and icon
- Add 7 Vitest tests for TemplatePicker (renders cards, emits events, close
  behavior, parking damage template)
- Add 4 Vitest tests for ComposePage template picker integration
- Add 2 Playwright E2E tests (opens picker, fills textarea and closes)
2026-05-14 17:39:21 +02:00
6ab5e2f707 refactor: remove template from order flow
Templates serve as a brand shield (showing the platform facilitates all
kinds of messaging), not as a compose-flow form control. Remove them from
the data model and compose page. Templates will live as branding elements
on the landing page in a future commit.

Backend:
- Remove template field from Order entity (getter/setter removed)
- Remove template from CreateOrderRequest DTO
- Remove template from OrderResponse DTO
- Remove template param from OrderService.createOrder()
- Remove template passthrough in OrderController
- Remove /api/templates permitAll from SecurityConfig
- Edit V5 migration: remove template column from orders table
- Edit V6 migration: remove template from seed data
- Update OrderControllerTest (remove template from assertions/requests)
- Update OrderServiceTest (remove template from createOrder calls)

Frontend:
- Remove template from Order interface in api/orders.ts
- Remove template param from createOrder() function
- Remove template display from OrdersPage.vue cards
- Rewrite ComposePage.vue: remove template selector, keep textarea + preview + submit
- Update ComposePage.spec.ts (remove template tests, add preview/GDPR tests)
- Update OrdersPage.spec.ts (remove template from mock data and display test)
- Update compose.spec.ts E2E (remove template selector interactions)
- Update order-history.spec.ts E2E (remove template names test)
- Fix unused import in Router.spec.ts
- Also includes minor Prettier formatting in AppHeader.spec.ts, AdminPage.vue, authStore.ts
2026-05-14 16:55:59 +02:00
5fa903d9af feat: build out compose page with template selector, letter editor, and preview
- Add createOrder(plate, template, letterText) to frontend api/orders.ts
- Create data/templates.ts with 6 Swedish letter templates (Komplimang,
  Jag vill köpa din bil, Tips / servicebehov, Synpunkter på körbeteende,
  Tuta / frustration, Fritt meddelande) with pre-filled body text
- Rewrite ComposePage.vue with full compose flow:
  - Template selector dropdown (Fritt meddelande selected by default)
  - Textarea with 1000-char limit and live character counter
  - Inline A4 letter preview with plate, body, and GDPR Art. 14 footer
  - 'Skicka brev (49 kr)' submit button, disabled when empty
  - On success: redirects to /orders; on error: shows error message
  - Shows error with back link if no plate in route query
- Add 12 Vitest tests for ComposePage (template fill, char counter, submit
  validation, createOrder call, navigation, null template for Fritt meddelande)
- Add 8 Playwright E2E tests (auth guard, no-plate error, template selection,
  textarea edit, submit button state, order creation, preview content)
2026-05-14 16:02:14 +02:00
55f0fd8771 feat: add POST /api/orders endpoint with validation
- Create CreateOrderRequest DTO with jakarta.validation annotations
- Validate plate format (ABC123 or ABC12A) via @Pattern regex
- Validate letter text: @NotBlank, @Size(min=1, max=1000)
- Validate template name: optional, @Size(max=50)
- Add POST /api/orders endpoint to OrderController (auth required)
- Return 201 Created with OrderResponse on success
- Add 5 controller tests: no auth (403), create success, invalid plate,
  empty text, text over 1000 chars
- All messages in Swedish (Ogiltigt registreringsnummer, Brevtext krävs, etc.)
2026-05-14 15:45:47 +02:00
0c62d7e60a feat: add orders link to header nav for authenticated users
- Add 'Mina beställningar' RouterLink to AppHeader in authenticated template
- Add Vitest tests: link visible when authenticated, hidden when not
- Add Playwright E2E test: shows orders link when authenticated
- Add Playwright E2E test: can navigate from home to orders via header link
2026-05-14 15:31:06 +02:00
32b315654e feat: add order history page with API endpoint and seeded test data
- Create OrderController with GET /api/orders endpoint (authenticated)
- Add OrderResponse DTO (id, plate, template, status, trackingId, createdAt)
- Seed 3 test orders for test@bilhalsning.se via V6 migration (sent, pending_payment, delivered)
- Create OrderControllerTest with 4 tests (auth, empty list, full fields, user not found)
- Create frontend api/orders.ts with typed fetchOrders() client
- Build out OrdersPage.vue with card list: plate, template, status badge, tracking link
- Add 12 Vitest tests for OrdersPage (loading, data, badges, links, empty, error)
- Add 5 Playwright E2E tests (auth guard, seeded data, badges, tracking, templates)
2026-05-14 15:30:36 +02:00
a74bb89824 feat: add Order entity, repository, and service with TDD tests
- Create V5__create_orders_table.sql migration with orders table
  - UUID primary key, user_id FK to users, status CHECK constraint
  - Indexes on user_id and status columns
- Add OrderStatus enum (PENDING_PAYMENT, PAID, LOOKUP_STARTED, SENT, DELIVERED, FAILED)
- Add OrderStatusConverter for JPA VARCHAR persistence
- Create Order entity with fields: id, userId, plate, template, letterText, status, amountPaid, trackingId, timestamps
- Create OrderRepository with findByUserIdOrderByCreatedAtDesc and findByStatus queries
- Create OrderService with createOrder (normalizes plate, sets PENDING_PAYMENT), getOrdersByUserId, getOrderById
- Add OrderNotFoundException with 404 handler in GlobalExceptionHandler
- Write OrderServiceTest with 8 unit tests covering status, UUID generation, plate normalization, and error handling
2026-05-14 14:34:14 +02:00
6f23368749 feat: show auth state in header with conditional nav links
Update AppHeader to reflect authentication state. When not authenticated,
show Logga in and Registrera links. When authenticated, show the user's
email address and a Logga ut button. Uses v-if/v-else with template blocks
for clean conditional rendering without wrapper elements.

Changes:
- authStore: add email computed that extracts sub claim from JWT payload
- AppHeader: conditional nav with v-if/v-else (guest vs authenticated)
- AppHeader: add email display and logout button with styles
- App.spec.ts: add Pinia to test setup (required by AppHeader now)
- AppHeader.spec.ts: rewrite with tests for both auth states
- authStore.spec.ts: add tests for email extraction and clearing
- header-auth.spec.ts: 5 Playwright E2E tests for header auth state
2026-05-14 13:11:11 +02:00
0d7e672bc3 chore: add Docker build volume and configure OpenCode
Add a named volume for backend build artifacts to prevent root-owned files
created inside the container from blocking host Gradle builds. This follows
the same pattern as the existing backend-gradle-project volume.

Configure OpenCode with LSP, formatter, auto-compaction, and file watcher
settings for improved development experience.

Changes:
- docker-compose.yml: add backend-build:/app/backend/build volume
- opencode.json: enable lsp, formatter, auto-compaction, prune, and
  file watcher with ignore patterns for node_modules, .git, dist, build
2026-05-14 12:39:34 +02:00
8d07bb7ab1 feat: add Vue Router auth guards with admin role support
Implement client-side route protection with role-based access control. The auth
store now extracts the role claim from JWT tokens and exposes isAdmin. Router
guards enforce three levels of access: guestOnly (redirect authenticated users),
requiresAuth (redirect unauthenticated to login with redirect param), and
requiresAdmin (redirect non-admin users to home).

Changes:
- utils/jwt.ts: JWT payload parser using base64url decode (new file)
- authStore: add role ref, isAdmin computed, extractRole from JWT payload
- router: add route metadata (requiresAuth, requiresAdmin, guestOnly) and
  beforeEach guard with getActivePinia() safety for test environments
- OrdersPage.vue, AdminPage.vue: placeholder pages (new files)
- LoginPage.vue, RegisterPage.vue: use route.query.redirect after auth
- Router.spec.ts: 14 tests covering all guard scenarios
- authStore.spec.ts: tests for role extraction, isAdmin, role persistence
- LoginPage.spec.ts: test for redirect query param after login
- auth-guards.spec.ts: 7 Playwright E2E tests for guard behavior
- login.spec.ts: fix seed user credentials (test@bilhalsning.se)
2026-05-14 12:39:17 +02:00
8a95483fb8 feat: add admin role support to backend JWT authentication
Add role-based access control to the backend authentication system. The User
entity now carries a role field (default 'user'), JWT tokens include a 'role'
claim, and the login endpoint populates it from the database.

Changes:
- User entity: add role column (VARCHAR(20), default 'user') with getter/setter
- JwtService: add generateToken(email, role) overload and extractRole(token)
- AuthController: pass user.getRole() on login, 'user' on register
- Flyway V3: ALTER TABLE users ADD COLUMN role
- Flyway V4: seed admin user (admin@bilhalsning.se, role='admin')
- AuthControllerTest: add tests for admin role in token, role from DB on login
- JwtServiceTest: add tests for role extraction and default role
- UserServiceTest: assert role defaults to 'user' on createUser
2026-05-14 12:38:55 +02:00
bb4bb0c6c6 docs: add TDD policy, update Spring Boot 4 references, configure OpenCode tools
Update project documentation to reflect the Test-Driven Development
approach, Playwright E2E testing setup, and Spring Boot 4.

AGENTS.md:
- Add TDD policy section requiring tests alongside every feature PR
- Add Playwright E2E docs with local and Docker CI run commands
- Update Lombok policy: @Getter, @Setter, @NoArgsConstructor are fine
- Fix Spring Boot 3 → 4 references

CODING_GUIDELINES.md:
- Add TDD policy section mirroring AGENTS.md
- Add Playwright E2E docs in testing section
- Update Lombok policy to allow @Getter, @Setter, @NoArgsConstructor
- Fix Spring Boot 3 → 4 references

REQUIREMENTS.md:
- Fix Spring Boot 3 → 4 in tech stack, architecture diagram, and
  tech summary sections

opencode.json:
- Enable websearch and codesearch tools
2026-05-13 19:18:43 +02:00
ca21c5b659 feat: add seed test user migration
Add Flyway migration V2 that inserts a pre-seeded test user for manual
testing. This avoids having to register a new account every time the
environment is reset.

- Email: test@bilhalsning.se
- Password: test1234
- Password hash: bcrypt ($2b$12$)

The migration uses a plain INSERT (no ON CONFLICT) since it runs on
fresh databases only. H2-compatible — no PostgreSQL-specific syntax.
To re-seed after deletion: docker compose down -v && docker compose up -d
2026-05-13 19:18:19 +02:00
e05f74bd82 chore: add Docker CI compose, Gradle E2E task, and .dockerignore
Add infrastructure for running Playwright E2E tests in Docker and fix
Gradle lock conflicts between host and container builds.

Changes:
- Add docker-compose.ci.yml that starts postgres, backend, frontend,
  and a Playwright service for CI pipelines. Uses official
  mcr.microsoft.com/playwright:v1.60.0-noble image.
- Add backend-gradle-project named volume to docker-compose.yml so the
  container's .gradle/ directory is isolated from the host's. This
  prevents stale lock files from host Gradle builds (e.g. ./gradlew
  :backend:test) crashing the container's bootRun.
- Add .dockerignore excluding .gradle, .env, .git, frontend/node_modules,
  and backend/build from the Docker build context.
- Add frontendE2E Gradle task that runs npm run test:e2e:ci.
2026-05-13 19:17:55 +02:00
491dc99c55 feat: add login page with Playwright E2E tests
Add the frontend login page (LoginPage.vue) with email and password
fields, Swedish UI strings, and integration with the backend login
endpoint. Also sets up Playwright as the E2E testing framework with
browser tests for both login and registration flows.

Frontend login implementation:
- Add LoginPage.vue with form validation, error handling, and link to
  registration page
- Add login() API function in auth.ts
- Add loginUser() method to authStore that stores JWT token
- Add /logga-in route to Vue Router
- Add 'Logga in' nav link to AppHeader alongside existing 'Registrera'
- Add 10 unit tests for LoginPage component
- Add 4 unit tests for loginUser auth store method
- Add 1 route resolution test and 1 AppHeader link test

Playwright E2E setup and tests:
- Install @playwright/test and configure playwright.config.ts
- Add npm scripts: test:e2e (local) and test:e2e:ci (Docker CI)
- Exclude e2e/ directory from Vitest to prevent test runner conflicts
- Add .gitignore entries for test-results/ and playwright-report/
- Add 5 E2E tests for login (navigation, invalid credentials, success
  redirect, navigation to register, input types)
- Add 6 E2E tests for register (navigation, success redirect, validation
  errors for invalid email/short password/mismatched passwords,
  navigation to login)
2026-05-13 19:17:29 +02:00
3d4a6daee9 feat: add login endpoint with JWT authentication
Add POST /api/auth/login endpoint that authenticates users by email and
password, returning a JWT token on success. Also fixes a critical bug
where expired or malformed JWT tokens in the Authorization header caused
unhandled exceptions, crashing requests to all endpoints including public
ones like registration.

Changes:
- Add AuthController.login() endpoint with LoginRequest DTO
- Add UserService.authenticate() that validates credentials and throws
  InvalidCredentialsException on failure
- Add InvalidCredentialsException and GlobalExceptionHandler handler
  that maps it to 401 with Swedish error message
- Fix JwtAuthenticationFilter to catch JwtException (expired, malformed)
  and pass through without crashing — the filter now acts as a graceful
  enricher rather than a gatekeeper
- Add 5 controller tests for login endpoint (success, 401, validation)
- Add 4 service tests for authenticate() (success, email not found,
  password mismatch, email normalization)
- Add 2 filter tests for expired and malformed token pass-through
2026-05-13 19:16:19 +02:00
8e495672d3 feat: add user registration flow (backend + frontend)
Implement end-to-end registration: POST /api/auth/register creates a
user, returns a JWT, and the frontend RegisterPage stores the token
and redirects to home.

Backend:
- Add AuthController with POST /api/auth/register endpoint
- Add RegisterRequest record (@Email, @NotBlank, @Size(min=8))
- Add AuthResponse and ErrorResponse DTOs
- Add GlobalExceptionHandler (@RestControllerAdvice with logging)
  - EmailAlreadyExistsException -> 409 (Swedish message)
  - MethodArgumentNotValidException -> 400 (field errors)
  - Generic Exception -> 500 (Swedish message + server-side log)

Frontend:
- Add api/client.ts: centralized fetch wrapper with Bearer token
  interceptor, ApiError class, JSON error parsing
- Add api/auth.ts: register() function
- Add stores/authStore.ts: Pinia store with token persistence via
  localStorage, registerUser/logout/isAuthenticated
- Add pages/RegisterPage.vue: email + password + confirm password
  form with client-side validation, submit handler, error display,
  redirect to home on success
- Add route /registrera pointing to RegisterPage
- Add 'Registrera' link to AppHeader navigation

Infrastructure:
- Add __tests__/setup.ts: localStorage polyfill for jsdom 29
  (jsdom 29 lacks standard Storage method implementations)
- Register polyfill via vitest config setupFiles

Tests (17 new, 2 extended):
- AuthControllerTest (@SpringBootTest + @AutoConfigureMockMvc):
  5 backend tests (success 201, duplicate 409, invalid email 400,
  short password 400, missing email 400)
- authStore.spec.ts: 5 tests (unauthenticated start, localStorage
  restore, register success, register failure, logout)
- RegisterPage.spec.ts: 12 tests (render, validation, submit,
  redirect, error display, login link)
- AppHeader.spec.ts: added 'Registrera' link test
- Router.spec.ts: added /registrera route resolution test

Build: 95 tests pass (57 frontend + 38 backend), lint clean.
2026-05-01 19:37:39 +02:00
c7d443f236 docs: update README for Gradle at root, add convenience task docs
Update all references to match the new repo-root Gradle layout
after moving the wrapper out of backend/.

- Quick Start: add ./gradlew up alternative and hint at ./gradlew check
- Spring profiles: ./gradlew bootRun → ./gradlew :backend:bootRun
- Development section: add All-in-one subsection with check/up/down/reset
- Backend dev: cd backend && ./gradlew bootRun → ./gradlew :backend:bootRun
- Development vs Production table: ./gradlew bootRun → ./gradlew :backend:bootRun
- Project Structure tree: add gradlew, gradle/, settings.gradle, build.gradle
- Remove ARCHITECTURE.md reference (file never existed)
- Add Database reset section with ./gradlew reset

Also add .gradle/ and build/ to .gitignore with gradle-wrapper.jar
exception (was staged but not committed with previous refactor).
2026-05-01 18:44:05 +02:00
d70196112d refactor: move Gradle wrapper to repo root, add convenience tasks
Move gradlew, gradle/wrapper, and settings.gradle from backend/ to
the repo root so build commands run from the top-level directory.
This follows the standard multi-project Gradle layout where the build
tool lives alongside docker-compose.yml and all submodules.

- Move gradlew + gradle/wrapper/* from backend/ to repo root
- Move settings.gradle to root with rootProject.name and include 'backend'
- Create root build.gradle with convenience tasks: check, up, down, reset
- check task chains frontend lint → frontend test → backend check
- Update docker-compose.yml backend volume from ./backend:/app to .:/app
- Update backend.Dockerfile entrypoint to ./gradlew :backend:bootRun
- Update AGENTS.md: document ./gradlew check, up, down, reset
- Delete backend/settings.gradle (now at root)
- Add .gradle/ and build/ to .gitignore
- Add !gradle/wrapper/gradle-wrapper.jar exception (blocked by *.jar rule)

All 38 frontend tests and 33 backend tests pass via ./gradlew check.
2026-05-01 18:40:18 +02:00
4c6094446b feat: add app shell with header, footer, and compose flow
Add AppHeader and AppFooter to give the site a consistent chrome
around the core page content. Add ComposePage stub reachable via
"Skicka ett brev till ägaren" CTA on HomePage after vehicle lookup
succeeds. Add stub pages for about, contact, and privacy.

- Create AppHeader.vue with logo link (BilHälsning) and Hem nav link
- Create AppFooter.vue with 4 links: Om oss, Kontakt, Integritetspolicy, Villkor
- Create ComposePage.vue stub that reads plate from route query params
- Create AboutPage.vue and ContactPage.vue stub pages
- Add 4 new routes: /compose, /om, /kontakt, /integritetspolicy
- Update App.vue to render AppHeader + <main> + AppFooter around RouterView
- Add home__cta RouterLink button to HomePage, visible only when vehicle
  lookup succeeds, linking to /compose?plate=<plate>
- Remove BilHälsning h1 from HomePage (moved to header)
- Add 17 new tests: AppHeader (2), AppFooter (1), ComposePage (3),
  AboutPage (1), ContactPage (1), HomePage rewrite (6), App update (2)
- Update App.spec.ts to verify header/footer components render
2026-05-01 18:19:53 +02:00
210ac87ede feat: extract VehicleInfo component from HomePage
Move vehicle-info display logic out of HomePage into a reusable
VehicleInfo component. The component accepts vehicle, loading,
notFound, and plate props and renders the correct state with
priority: vehicle card > loading > not found. Follows the
small-page-component pattern from CODING_GUIDELINES.md.

- Create VehicleInfo.vue with 3-state v-if chain and scoped styles
- Define and export VehicleInfo interface (make/model/year/color)
- Add VehicleInfo.spec.ts with 7 tests covering all states and
  priority edge cases
- Update HomePage.vue to use VehicleInfo, replacing 3 inline
  v-if/else-if blocks with a single component tag
- Remove 5 unused CSS classes from HomePage (home__status,
  home__vehicle, home__vehicle-text, home__not-found,
  home__not-found p)
- Update AGENTS.md to require thorough commit messages with bullet
  points
2026-05-01 18:06:04 +02:00
078f07f2ac feat: add PlateInput component with Swedish plate validation and fake vehicle lookup 2026-05-01 17:38:28 +02:00