Skip to content

1.0.0

Choose a tag to compare

View all tags
@tdrabikdev tdrabikdev released this 15 Jul 12:01
v1.0.0
ebe9361
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Storefront design system — and the eight pages that turned out to be hard-500.

1202 tests pass, 0 skipped. Every surface screenshotted and read at desktop and mobile.

Versioning note. This release deliberately restarts the version line. The previous release was v13.0.0, whose tag tracked the Laravel major. Composer orders 13.0.0 above 1.0.0, so a ^13 constraint will not resolve this tag, and v13.0.0 may continue to show as "Latest". If you install by version, pin 1.0.0 explicitly.

Fixed: eight pages were 500ing

<x-guest-layout> and <x-app-layout> were referenced throughout but never existed:

  • Two-factor challenge. Fortify has twoFactorAuthentication() enabled, so anyone who turned 2FA on was locked out permanently.
  • Password reset from the emailed link — the escape hatch from exactly that lockout.
  • Email verification, confirm password.
  • Profile, teams, API tokens (the missing app-layout).

The only page that can enable 2FA is /user/profile, which was also crashing — the lockout was unreachable purely because the door to it was broken too.

Security

  • Removed a "Demo Credentials" panel that rendered unconditionally in production, advertising admin@example.com and staff@example.com beside the word "password". The seeder randomises that password, so it was useless to honest visitors and a free username list for everyone else.
  • Social login is now opt-in (SOCIALSTREAM_PROVIDERS, default empty). Nine providers were enabled with credentials configured for none, so every button threw DriverMissingConfigurationException on click.

Removed fabricated content

A default theme ships as somebody else's real store, which makes this material:

  • Three hardcoded testimonials ("John Doe", "Sarah Smith", five stars each) — every merchant published fake reviews.
  • A hardcoded "Summer Sale — 50% off" pointing at an image that cannot exist.
  • Four invented categories, replaced with real ProductCategory data.
  • Four simulated navbar features — including an addToWishlist that made no request and reported "Added to wishlist!" anyway.
  • product.blade.php, orphaned and carrying a fake gallery and fake "Related Product 1..N".

Design system

Workshop Moss in app.css's @theme. No blue (the first-order ecommerce reflex). No second green — moss doubles as the affirmative signal. Inter + IBM Plex Mono, self-hosted; mono reserved for prices, quantities and 2FA codes. PaletteContrastTest holds all 25 tokens inside the sRGB gamut with every pair clearing WCAG 2.2 AA.

products/show was Bootstrap markup inside a Tailwind app, so stock status rendered as plain black text. Rebuilt.

Known issues

  • /user/profile renders only because social login now defaults off. With providers enabled it still 500s: app/Models/User.php:35 has // use HasConnectedAccounts; commented out. config/socialstream.php warns at the point of enabling.
  • 105 blue literals remain in contact/checkout/categories.
  • The seeder sets inventory_count = 0 on every product, so the demo storefront ships sold-out.
  • The Dependency Security Audit workflow is red and has been since before this work: it runs composer audit with no composer install and no --locked.

Full changelog: v13.0.0...v1.0.0

Assets 2
Loading