Skip to content

Phase 6 PR #18 (backend) — 알림 시스템 + 비밀번호 찾기#22

Merged
haksungjang merged 3 commits into
mainfrom
feature/phase6-pr18-i18n-notifications
May 8, 2026
Merged

Phase 6 PR #18 (backend) — 알림 시스템 + 비밀번호 찾기#22
haksungjang merged 3 commits into
mainfrom
feature/phase6-pr18-i18n-notifications

Conversation

@haksungjang

@haksungjang haksungjang commented May 8, 2026

Copy link
Copy Markdown
Contributor

Summary

Notifications 백엔드

  • 신규 notifications/ 모듈
    • email.py: aiosmtplib + MIME multipart (text/html)
    • slack.py: Slack Webhook (httpx)
    • teams.py: MS Teams MessageCard
    • dispatcher.py: 통합 디스패처 (NotificationKind enum)
  • tasks/notify.py: Celery autoretry_for + exponential backoff (max 5)
  • 채널별 partial-success 보고

Password Reset

  • POST /auth/forgot-password: uniform 204 (CWE-204)
  • POST /auth/reset-password: 토큰 + 새 비밀번호
  • 1회용 토큰 (used_at), 1시간 만료, 기존 unused 토큰 invalidate
  • email channel로 reset link 발송

환경변수

  • SMTP_*, SLACK_WEBHOOK_URL, TEAMS_WEBHOOK_URL — 모두 os.getenv() 런타임

보안

  • token / password / secret 로그 X
  • forgot-password에 timing-attack 방지 (dummy bcrypt)
  • 토큰 평문 미저장 (DB hash만)

Test plan

  • backend ruff + mypy clean (226 files)
  • notifications unit tests
  • password reset integration tests
  • Frontend (다음 PR)
  • CI green (push 후 확인)

🤖 Generated with Claude Code

haksungjang and others added 3 commits May 8, 2026 22:39
@haksungjang @claude
Phase 6 PR #18 (backend) — 알림 시스템 + 비밀번호 찾기
53c238b 
## Summary
### Notifications
- 신규 notifications/ 모듈
  - email.py: aiosmtplib 기반 SMTP 발송, MIME multipart (text + HTML alt)
  - slack.py: Slack Webhook POST (httpx.AsyncClient)
  - teams.py: MS Teams MessageCard
  - dispatcher.py: 통합 디스패처 (NotificationKind enum + per-channel dispatch)
- tasks/notify.py: Celery task with autoretry_for + exponential backoff (max 5회)
- 채널별 partial-success 보고 (어느 채널이 성공/실패했는지)

### Password Reset (Phase 6 미구현 부분)
- POST /auth/forgot-password: uniform 204 (CWE-204) — 이메일 존재 여부 누설 X
- POST /auth/reset-password: 토큰 + 새 비밀번호 (min_length 12)
- services/password_reset_service.py: 1회용 토큰 (used_at), 1시간 만료
- 기존 unused 토큰 invalidate (새 요청 시)
- email channel을 통해 reset link 발송

### 환경변수 (core/config.py)
- SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASSWORD, SMTP_FROM, SMTP_USE_TLS
- SLACK_WEBHOOK_URL, TEAMS_WEBHOOK_URL
- 모두 os.getenv() 런타임 호출 (CLAUDE.md §11)

## 보안
- token, password, secret 로그 X (PII 마스킹)
- timing-attack 방지: forgot-password에서 dummy bcrypt
- 토큰 평문 절대 저장 X (DB는 hash만)
- 1회용 + 만료 검증

## Test plan
- [x] backend ruff clean
- [x] backend mypy clean (226 source files)
- [x] notifications unit tests (slack/teams/email/dispatcher/notify task)
- [x] password reset integration tests
- [ ] Frontend (다음 PR)
- [ ] CI green (push 후 확인)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@haksungjang @claude
fix(test): resolve PR #22 CI failures (notify task, slack log, dispat…
cd2c412 
…cher, password-reset)

- tests/unit/tasks/test_notify.py: Use task.__wrapped__ instead of task.run.
  bind=True auto-injects self via .run; passing _FakeTask() explicitly added a
  6th positional arg.
- tests/unit/notifications/test_slack.py: Silence httpx/httpcore loggers and
  filter caplog records to notifications.* only — httpx's INFO log echoes the
  full webhook URL, which is not our module's leak.
- tests/unit/notifications/test_dispatcher.py: Override _send_email_channel
  with a real "no recipients raises NotificationDisabled" stub instead of
  trying to "restore" the already-noop'd version (autouse fixture had won).
- tests/integration/test_auth_password_reset.py: Replace AsyncSession.expire_all()
  (which needs a greenlet-bound context) with await commit() to force fresh
  reads.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@haksungjang @claude
fix(test): split _run_notification helper for direct unit testing
22efbb0 
Celery's bind=True decorator overrides task.run with self-injection
machinery and does not preserve __wrapped__, so neither approach (run nor
__wrapped__) gives the test a way to call the body with an explicit fake
self.

Extract the body into a plain `_run_notification` function and have the
Celery task delegate to it. Tests call `_run_notification` directly with
the _FakeTask self.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@haksungjang haksungjang merged commit 3dbc103 into main May 8, 2026
haksungjang added a commit that referenced this pull request May 8, 2026
@haksungjang
plan: Step 7 DONE (PR #22) → Step 8 IN_PROGRESS
780fad4
haksungjang added a commit that referenced this pull request May 9, 2026
@haksungjang @claude
chore: frontend bundle (Chore A1 + B + C) — password reset wiring, OA…
cc480f5 
…uth buttons, /integrations page

Frontend coverage for backend endpoints already shipped in PR #20/#22/#26.

## Chore A1 — Password reset wiring + i18n parser CI gate
- Wire ForgotPasswordPage to POST /auth/forgot-password (uniform success view)
- New ResetPasswordPage at /reset-password (reads ?token=, POSTs /auth/reset-password)
- i18next-parser dev-dep + scripts (i18n:extract, i18n:check) + CI step
  to fail on EN/KO drift
- New auth.* i18n keys for forgot/reset (EN + KO mirrored)

## Chore B — Frontend OAuth buttons
- "Sign in with GitHub" / "Sign in with Google" buttons on /login
- redirect_after query-param passthrough to /auth/oauth/<provider>/authorize
- ?error=oauth_<reason> mapping to i18n strings (denied / invalid_state /
  failed / user_inactive / no_organization / missing_params / unknown)
- Backend path corrected to /auth/oauth/... (no /v1 prefix — router declares
  prefix="/auth/oauth")

## Chore C — /integrations page (API Key UI)
- /integrations route + AppShell nav (KeyRound icon)
- API Key list (name, scope, prefix, created, expires, revoke)
- Create dialog with one-time plaintext reveal (Copy button + warning)
- Revoke confirmation
- Webhook URLs info section (GitHub HMAC + GitLab token)
- New integrations namespace (EN + KO, 63 keys mirrored)

## Tests
- 26 new unit tests (ResetPasswordPage 7, apiKeysApi 5, IntegrationsPage 14);
  ForgotPasswordPage + LoginPage tests updated
- 4 new E2E scenarios (forgot success view, reset missing-token, login
  ?error=oauth_denied, /integrations smoke + create dialog open/close)
- New IntegrationsHarness; AuthHarness extended with forgot/reset verbs

## Out of scope (deferred)
- In-app notification center (/notifications + bell icon) — requires backend
  /v1/notifications/* (not in PR #22). Tracked as new Chore A2 in
  docs/chore-backlog.md.
- Notification channel ON/OFF preferences — same as above.

## Validation
- npm run lint: 0 errors (16 pre-existing warnings, unchanged)
- npx tsc --noEmit: clean
- npm run test: 483/483 pass; coverage 92.58% lines / 83.9% branches
- npm run i18n:check: OK (locales in sync)

Refs: docs/chore-backlog.md (Chore A1, B, C marked done)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@haksungjang haksungjang mentioned this pull request May 9, 2026
Merged
5 tasks
haksungjang added a commit that referenced this pull request May 9, 2026
@haksungjang @claude
chore: frontend bundle (Chore A1 + B + C) — password reset wiring, OA…
df5bb5e 
…uth buttons, /integrations page (#28)

Frontend coverage for backend endpoints already shipped in PR #20/#22/#26.

## Chore A1 — Password reset wiring + i18n parser CI gate
- Wire ForgotPasswordPage to POST /auth/forgot-password (uniform success view)
- New ResetPasswordPage at /reset-password (reads ?token=, POSTs /auth/reset-password)
- i18next-parser dev-dep + scripts (i18n:extract, i18n:check) + CI step
  to fail on EN/KO drift
- New auth.* i18n keys for forgot/reset (EN + KO mirrored)

## Chore B — Frontend OAuth buttons
- "Sign in with GitHub" / "Sign in with Google" buttons on /login
- redirect_after query-param passthrough to /auth/oauth/<provider>/authorize
- ?error=oauth_<reason> mapping to i18n strings (denied / invalid_state /
  failed / user_inactive / no_organization / missing_params / unknown)
- Backend path corrected to /auth/oauth/... (no /v1 prefix — router declares
  prefix="/auth/oauth")

## Chore C — /integrations page (API Key UI)
- /integrations route + AppShell nav (KeyRound icon)
- API Key list (name, scope, prefix, created, expires, revoke)
- Create dialog with one-time plaintext reveal (Copy button + warning)
- Revoke confirmation
- Webhook URLs info section (GitHub HMAC + GitLab token)
- New integrations namespace (EN + KO, 63 keys mirrored)

## Tests
- 26 new unit tests (ResetPasswordPage 7, apiKeysApi 5, IntegrationsPage 14);
  ForgotPasswordPage + LoginPage tests updated
- 4 new E2E scenarios (forgot success view, reset missing-token, login
  ?error=oauth_denied, /integrations smoke + create dialog open/close)
- New IntegrationsHarness; AuthHarness extended with forgot/reset verbs

## Out of scope (deferred)
- In-app notification center (/notifications + bell icon) — requires backend
  /v1/notifications/* (not in PR #22). Tracked as new Chore A2 in
  docs/chore-backlog.md.
- Notification channel ON/OFF preferences — same as above.

## Validation
- npm run lint: 0 errors (16 pre-existing warnings, unchanged)
- npx tsc --noEmit: clean
- npm run test: 483/483 pass; coverage 92.58% lines / 83.9% branches
- npm run i18n:check: OK (locales in sync)

Refs: docs/chore-backlog.md (Chore A1, B, C marked done)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@haksungjang haksungjang deleted the feature/phase6-pr18-i18n-notifications branch May 10, 2026 13:04
haksungjang added a commit that referenced this pull request May 26, 2026
@haksungjang @claude
docs(tracker,session): §0.5 W4 라벨 라인 제거 + 인테이크 모드로 전환
654dfc5 
- 트래커 §0.5: 의도 불명확 라벨 라인 "W4 후속/위생 | #26·#27·#19~#22" 제거.
  `Wave 1~4` → `Wave 1~3`, §0 대시보드에 §0.5 행 + 인테이크 모드 안내 추가,
  §9 핸드오프 규약에 "라벨 단독 금지" + "다음 세션 인테이크 모드" 문구 반영.
- 핸드오프 갱신: 다음 세션 섹션을 사용자 발견 불편/버그 인테이크 패턴으로 재작성.
  알려진 부속(#32c · #30 정렬 정정)은 인테이크 우선순위 결정 후 채택 여부 정함.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This was referenced May 26, 2026
Merged
Merged
haksungjang added a commit that referenced this pull request May 26, 2026
@haksungjang @claude
feat(W4-C #20/#21/#22): tab IA reorganize — 11 tabs → 8 (#189)
65eede7 
Per docs/plan-w4-ui-ia-overhaul.md §3, collapse the project-detail tab strip
into eight top-level surfaces by absorbing the four legacy domain tabs into
the surface where the next user action lives:

  - #20 Licenses + Obligations → new "Compliance" tab. ComplianceTab is a
    sub-tab wrapper (`?cview=licenses|obligations`, default = licenses) that
    re-uses LicensesTab/ObligationsTab verbatim so existing virtual list,
    drawer, NOTICE download, and unit-test surface area stay intact.
  - #21 SBOM → Reports tab. SbomTab is embedded as an in-page section with
    its own anchor (`reports-sbom-section`); a new `?rpt_section=sbom` URL
    flag auto-scrolls the section into view so legacy deeplinks land
    correctly. The 4 generate cards stay; the SBOM card now scrolls
    in-page (no tab change), the NOTICE card deep-links to Compliance.
  - #22 Remediation → Vulnerabilities tab. New collapsible
    VulnerabilitiesRemediationPanel embeds RemediationTab behind an
    expand/collapse affordance (`?vuln_section=remediation`). The detail
    component is split into its own file so VulnerabilitiesTab stays at
    its current size. Skipped in historical/read-only snapshot mode.

ProjectDetailPage:
  - ALLOWED_TABS narrowed to the 8-tab strip: overview / releases /
    components / vulnerabilities / source / compliance / reports / settings.
  - `redirectLegacyTab(raw)` helper + useEffect rewrite a legacy `?tab=`
    token (licenses / obligations / sbom / remediation) to its W4-C
    successor URL (replace navigation) so old bookmarks land correctly.
  - `setTab` drop-filter logic updated to clear the new sub-view selectors
    (`cview` / `rpt_section` / `vuln_section`) when leaving the host tab.

OverviewTab:
  - License chart segment deep-link now targets the Compliance tab's
    Licenses sub-view (`?tab=compliance&cview=licenses&license_category=…`)
    so existing chart-drill UX survives the IA change.

i18n (EN + KO):
  - Added: `tabs.compliance`, `compliance.subtab.{licenses,obligations}`,
    `reports.sbom.{heading,subheading}`,
    `vulnerabilities.remediation.{heading,subheading,expand,collapse}`.
  - Removed: `tabs.{licenses,obligations,sbom,remediation}`.
  - Updated: `reports.cards.notice.action`, `reports.cards.sbom.action`.
  - No plural keys (per [[feedback-frontend-i18n-no-plural-check]]).

Harness (`PortalPage`):
  - `selectLicensesTab` / `selectObligationsTab` now click the Compliance
    tab and switch to the correct sub-view so existing E2E specs keep
    working without a sweep.
  - `selectSbomTab` now navigates to Reports and scrolls to the embedded
    SBOM section.

Tests:
  - New `ComplianceTab.test.tsx` (5 cases — wrapper renders, default
    sub-view, URL hydration, sub-tab click switches surface, default
    sub-view does not persist `?cview=`).
  - `ProjectDetailPage.test.tsx` — updated tab-strip case to assert the
    8-tab layout + 4 new legacy-redirect cases
    (?tab={licenses,obligations,sbom,remediation} → new IA).
  - `OverviewTab.test.tsx` + `ReportsTab.test.tsx` — deeplink targets
    updated to the new IA.

Gates: typecheck clean · lint 0 errors (18 pre-existing warnings) ·
vitest 967 (+9) · i18n:check OK.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@haksungjang