Clean separation of Frontend And Backend

What’s complete (done)
Frontend/back-end boundary enforced: the frontend is a thin client that does not perform direct DB access or client-side DB initialization; it only calls backend APIs.
Client secrets removed: Cosmos/AI keys and any server-only secrets were removed from frontend sources and .env.example.
Server owns secrets: all DB and AI credentials are centralized in .env (not checked in).
Vite cleanup: removed server-side use of VITE_* for DB and moved client-safe Vite vars to the frontend example files.
Scripts & tooling updated: backend/scripts/* were updated to use canonical server env names (e.g., ADMIN_SERVER_URL, DEV_SERVER_PORT).
Build / dist rebuilt: backend TypeScript artifacts were rebuilt and patched so no server-side VITE_ fallbacks remain.
Tests fixed: the AI unit tests that were failing due to a bad fetch stub were corrected and all backend unit tests pass locally.
Admin auth scaffolding added: jose was added as a dependency and there is middleware scaffolding in the repo for token verification and actor identification (see the security doc for the filenames added).
What’s not complete / still pending (token/JWT and related)
JWT production configuration (pending): production-grade JWKS endpoint(s) and signing key management are not fully configured or verified in production environments (you need to set AUTH_JWKS_URI / equivalent and secure the signing keys in a vault).
JWKS caching & rotation handling (not implemented): middleware needs JWKS caching, key rotation handling, and robust fallback behaviors for stale/rotating keys.
Token policies (not enforced yet): short-lived access tokens, refresh token design or rotating service credentials, and audience/issuer enforcement need to be established and deployed.
Secure token transport (not completed): using secure, HttpOnly cookies (with SameSite/Secure) for token transport where appropriate is not implemented by default.
Key rotation / secret vaulting (pending): moving signing keys and secrets into an actual secrets manager (Azure Key Vault / HashiCorp Vault), and rotating any keys that may have been exposed during development.
Integration tests for auth (missing): integration tests that assert 401/403 for unauthenticated/unauthorized calls and 200 for valid tokens are not yet in place.
JWKS monitoring / alerting (not implemented): no monitoring/alerts exist for JWKS fetch failures, signature verification anomalies, or unexpected key rotation events.
CI/test token handling (partially done): HS256 fallback for tests may be present, but CI must be configured with secure test secrets (e.g., AUTH_JWT_SECRET) and the tests adjusted to use them safely.
Full admin enforcement audit (partial): some admin routes were tightened, but a full audit to confirm every sensitive endpoint rejects header-only/unsafe identification in production is still recommended.
Quick recommended next steps (concrete, minimal)
Immediately rotate any signing keys that may have been used in development and put production keys into a vault.
Configure and test a production JWKS URI (AUTH_JWKS_URI) in a staging environment and implement JWKS caching with key rotation handling. I can add a small middleware implementation and unit/integration tests for this.
Add integration tests that validate 401/403 behavior for admin endpoints and wire CI to provide a test HS256 secret (only for CI/dev).
Enforce secure transport (HTTPS) and review cookie usage; add SameSite/Secure/HttpOnly on any cookies used for tokens.

v0.1.0 — EngageIQ initial release

Overview

EngageIQ is a full‑stack reference implementation of a community platform that demonstrates robust client/server synchronization, idempotent reward/karma mechanics, moderation tooling, and optional AI-assisted content helpers (rewrite + autotag).
This first release packages the frontend UI, the admin backend, seeding and admin scripts, developer tooling and example data for local demos.
Highlights / key features

Production‑style frontend: React 19 + TypeScript app bootstrapped with Vite and Tailwind.
See: frontend
TypeScript admin backend with Express, Cosmos persistence patterns and developer scripts.
See: backend
Deterministic, idempotent karma awards and anti‑gaming measures (deterministic audit keys + session dedupe).
Client award logic: useKarmaSystem.ts
Server audit/upsert helpers: db.ts
Resilient client/server synchronization with an unsynced queue and retry semantics for offline or failed requests.
Unsynced queue: unsynced.ts
AI‑assisted helpers for improving post quality and discovery:
Server AI adapter (AOAI / Foundry): ai.ts — provides callRewriteProvider and autotag provider functions.
Admin rewrite endpoint wired to AI helper: admin.ts (POST /admin/rewrite now calls callRewriteProvider).
Demo script for rewrite + autotag: demo-rewrite-and-autotag.mjs
Developer tooling & seed data for reproducible demos:
Seeding scripts and helpers under: scripts
Seeding entry: node ./backend/scripts/fresh-seed-all.mjs
What’s included (short checklist)

Frontend app: code, components, hooks and test suite — frontend
Backend server: TypeScript source, API routes and admin scripts — backend
AI helpers: ai.ts (AOAI + Foundry support; uses env to select provider)