Development History

Development History

Completed Phases

Phase	Topic	Status
A	Project Setup (Blazor, MudBlazor, SQLite)	Done
B	Database (entities, migrations, seed data)	Done
C	Authentication (parent login, picture password)	Done
D	Child Features (dashboard, requests)	Done
E	Parent Features (approve/deny, transactions)	Done
F	Scheduled Allowance (BackgroundService)	Done
G	Email Infrastructure (password reset)	Done
H	Docker & Deployment	Done
I	Polish (responsive, UX refinements)	Done
J	Multi-Child Support	Done
K	First-Run Setup Wizard	Done

---

Feature Details

First-Run Setup Wizard (Phase K)

• 4-step wizard: Admin → Partner (optional) → Children → Email → Confirmation
• ISetupService with IsSetupRequiredAsync(), HasAdminAsync(), CompleteSetupAsync()
• PictureGridSetup component for child picture password creation
• DbInitializer only seeds demo data when JUNO_SEED_DEMO=true

Parent Login Rate Limiting

• 5 failed attempts → 5-minute lockout
• Countdown timer display on login page

Security Hardening

• Admin authorization on sensitive service methods
• Cookie hardening (HttpOnly, SameSite=Strict, 8-hour sliding expiration)
• Timing-safe picture password comparison
• Anti-enumeration (dummy BCrypt on unknown email)
• Security headers (X-Content-Type-Options, X-Frame-Options, etc.)
• Audit logging for login attempts, lockouts, admin actions

Password Recovery (Three Layers)

1. Email reset — SMTP via Setup Wizard, "Forgot Password?" link
2. Admin resets other parent — ResetParentPasswordAsync in AdminPanel
3. CLI emergency reset — docker exec junobank dotnet JunoBank.Web.dll reset-password

Shared Component Extraction

• MoneyInput, ErrorAlert, SubmitButton, DescriptionField, PasswordFields
• All in Components/Shared/, documented in docs/COMPONENTS.md

SMTP Email Fix

• STARTTLS for port 587 (was incorrectly using full SSL)
• Runtime DI factory so setup wizard config takes effect without restart

Browser Timezone Support

• IBrowserTimeService detects browser timezone via JS interop
• All UTC timestamps converted to local time
• ScheduledAllowance stores TimeZoneId for background service

Dialog Conversions

• ManualTransactionDialog, OrderEditorDialog, ResetPicturePasswordDialog
• Replaced full-page forms with MudDialog overlays
• Picture password reset and child lockout management

Email Settings Outside Wizard

• IEmailConfigService for read/write/test SMTP config
• EmailSettingsDialog accessible from Settings page (admin-only)
• Password never exposed; blank on save preserves existing

Weekly Summary Notifications

• NotificationPreference entity with schedule (day, time, IANA timezone)
• NotificationService with IsDueToSend logic (10-min window, 6-day guard)
• WeeklySummaryEmailBuilder — dark-themed HTML email
• NotificationBackgroundService (5-min check interval)
• NotificationSettingsDialog — per-parent, all parents can configure