Phase 1 foundation: backend, web profile, and mobile app

Greenfield implementation of CardClaws Phase 1 across three surfaces. Backend (Rust/Axum workspace, 67 tests): - cardclaws-types/config/db/auth/api/wallet crates - Auth: register, login + lockout, magic link, refresh rotation, Apple verify - Cards: CRUD, tier-limited publish, duplicate, public handle lookup - Assets: R2 presigned uploads; vCard export - Apple Wallet .pkpass pipeline (PKCS#7 signer behind apple-signing feature) - Analytics ingest + summary with daily-salted IP hashing - Migrations 0001 (incl. cardclaws_sessions) + 0002 analytics Web profile (Astro SSR): cardclaws.com/[handle] hero + flip, contact actions, client-built vCard, visit attribution. Verified end-to-end. Mobile (Expo SDK 51): auth, card list/create, builder v1 (bg/text/logo, palette, undo/redo), Skia/Reanimated viewer (flip + ambient). 22 logic tests. CI: policy/backend/profile/mobile jobs; LOC + no-placeholder lint. Review fixes baked in: `back` (not `cardclaws`) key; strip image is a bundled manifest file (not a URL); sessions table added; NFC reframed; test doubles allowed for external services. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-06-04 10:17:26 -05:00
commit c30d3afeec
128 changed files with 36279 additions and 0 deletions
@@ -0,0 +1,122 @@
+//! Integration tests for analytics ingest + summary (PRD §13.5, §18).
+
+mod common;
+
+use axum::http::StatusCode;
+use serde_json::json;
+
+use common::{unique_handle, TestApp};
+
+async fn create_and_publish(app: &TestApp, token: &str) -> (String, String) {
+    let handle = unique_handle();
+    let def = json!({
+        "face": { "layers": [], "background": { "type": "solid", "value": "#101014" } },
+        "back": { "layers": [] }
+    });
+    let (_, created) = app
+        .request(
+            "POST",
+            "/v1/cards",
+            Some(token),
+            Some(json!({"handle": handle, "definition": def})),
+        )
+        .await;
+    let id = created["id"].as_str().unwrap().to_string();
+    app.request(
+        "POST",
+        &format!("/v1/cards/{id}/publish"),
+        Some(token),
+        None,
+    )
+    .await;
+    (id, handle)
+}
+
+#[tokio::test]
+async fn profile_visit_recorded_on_public_lookup() {
+    let app = require_app!();
+    let token = app.register_and_token().await;
+    let (id, handle) = create_and_publish(&app, &token).await;
+
+    // Two public lookups => two profile visits.
+    app.request("GET", &format!("/v1/cards/handle/{handle}"), None, None)
+        .await;
+    app.request("GET", &format!("/v1/cards/handle/{handle}"), None, None)
+        .await;
+
+    let (status, body) = app
+        .request(
+            "GET",
+            &format!("/v1/cards/{id}/analytics"),
+            Some(&token),
+            None,
+        )
+        .await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body["totalVisits"], 2);
+    assert_eq!(body["visits24h"], 2);
+}
+
+#[tokio::test]
+async fn client_event_ingest_increments_summary() {
+    let app = require_app!();
+    let token = app.register_and_token().await;
+    let (id, _) = create_and_publish(&app, &token).await;
+
+    let (status, _) = app
+        .request(
+            "POST",
+            "/v1/analytics/event",
+            None,
+            Some(json!({"card_id": id, "event_type": "contact_save"})),
+        )
+        .await;
+    assert_eq!(status, StatusCode::OK);
+
+    let (_, body) = app
+        .request(
+            "GET",
+            &format!("/v1/cards/{id}/analytics"),
+            Some(&token),
+            None,
+        )
+        .await;
+    assert_eq!(body["contactSaves"], 1);
+}
+
+#[tokio::test]
+async fn ingest_rejects_server_only_event_type() {
+    let app = require_app!();
+    let token = app.register_and_token().await;
+    let (id, _) = create_and_publish(&app, &token).await;
+
+    // profile_visit is server-originated; clients can't post it.
+    let (status, body) = app
+        .request(
+            "POST",
+            "/v1/analytics/event",
+            None,
+            Some(json!({"card_id": id, "event_type": "profile_visit"})),
+        )
+        .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+    assert_eq!(body["code"], "validation");
+}
+
+#[tokio::test]
+async fn analytics_summary_requires_ownership() {
+    let app = require_app!();
+    let owner = app.register_and_token().await;
+    let (id, _) = create_and_publish(&app, &owner).await;
+
+    let intruder = app.register_and_token().await;
+    let (status, _) = app
+        .request(
+            "GET",
+            &format!("/v1/cards/{id}/analytics"),
+            Some(&intruder),
+            None,
+        )
+        .await;
+    assert_eq!(status, StatusCode::NOT_FOUND);
+}