Add CLAUDE.md with comprehensive codebase documentation - #33
Open
AppleExpl01t wants to merge 16 commits into
Open
AppleExpl01t wants to merge 16 commits into
AppleExpl01t wants to merge 16 commits into
Conversation
Documents project structure, development workflows, architecture conventions, IPC pattern, service layer, testing, CI/CD, and contributing checklist for AI assistants and new developers. https://claude.ai/code/session_01EyWqKDQMfC41FVXRnxE1Fs
New test suites (94 tests total, up from 5): - LogParserService: 30 tests covering all 10 log event types, helpers, and edge cases (pure function, no mocks needed) - AutoModRuleService: 23 tests covering KEYWORD_BLOCK (partial/whole-word, bio/status scanning, keyword whitelist, user-ID whitelist, action types), TRUST_CHECK, BLACKLISTED_GROUPS, multi-rule precedence - WatchlistService: 19 tests covering entity CRUD (create, merge, delete), tag management, and import/export round-trip - InstanceGuardService: 17 tests covering cache helpers (isClosed/markClosed, TTL pruning), event history, and the main enforcement loop (CLOSE_ALL_INSTANCES and INSTANCE_18_GUARD rules, whitelist/blacklist, duplicate-prevention cache) New CI workflow (.github/workflows/ci.yml): - Runs on every push and every PR targeting main/master/develop - Enforces: TypeScript type-check → ESLint lint → Vitest tests - Uploads coverage report as artifact on failure - Uses ubuntu-latest for speed (Electron APIs are all mocked) Updated CLAUDE.md with detailed testing standards, mock conventions, what to test per service category, and the updated contributing checklist. https://claude.ai/code/session_01EyWqKDQMfC41FVXRnxE1Fs
Change trigger from "every push to every branch" to only pull_request events and direct pushes to main/master/develop. The previous config ran twice per commit on any open PR (once for the push, once for the PR event), doubling minute consumption. The PR check is the enforcement gate that matters for branch protection — feature branch pushes don't need it. Also remove the coverage artifact upload step to reduce job duration. https://claude.ai/code/session_01EyWqKDQMfC41FVXRnxE1Fs
Backend: - Create storage/objectStorage.ts — OCI Object Storage implementation; backup service was crashing at runtime with a missing module import - auth/routes: add requireAuth middleware to /auth/refresh (was missing, making refresh always return 401 and leaving the route without auth enforcement) - auth/routes: add tight per-endpoint rate limiters (10 req/15 min on activate+verify; 30/15 min on refresh+status) on top of global limiter - auth/service: fail fast at module load if JWT keys are missing or empty (server now refuses to start rather than silently serving broken auth) - auth/service: validate VRChat userId format (usr_<UUID>) before embedding in any URL, preventing path-injection against the VRChat API - auth/service: cache VRChat API responses for the lifetime of a verification code so repeated /auth/verify calls cannot DDoS-amplify against VRChat - auth/service: cap active verification codes per user at 3 to prevent in-memory store flooding - backup/service: validate backup ID as UUID before building OCI object paths (prevents path-traversal to other users' data) - backup/service: verify ownership inside getBackup/deleteBackup as a second layer after the JWT userId check in the controller - backup/service: enforce per-user backup count limit (default 10, env-configurable) - config: add MAX_BACKUPS_PER_USER env-configurable limit - index: import auth/service at startup to trigger key-loading fail-fast - index: CORS now logs a clear warning when ALLOWED_ORIGINS is unset in prod; origin defaults to false (deny all) instead of the ambiguous empty array App (renderer / main process): - src/config.ts: remove hardcoded production IP address; prod URL must now come from VITE_PROD_API_URL env var — missing value logs a clear error - src/config.ts: lock backend env to 'prod' in production builds; localStorage toggling only available in dev (prevents accidental prod traffic from local) - useHeartbeat: resolve backend URL inside the async function rather than at module load time — prevents localStorage tampering from redirecting heartbeat traffic to an attacker-controlled host - IdentityService: remove hardcoded localhost URL and x-dev-user-id bypass header; service now requires a real session token and reads URL from BACKEND_API_URL env var with a clear error when unconfigured https://claude.ai/code/session_01EyWqKDQMfC41FVXRnxE1Fs
backend/src/modules/backup/service.ts: - Extract backupPaths() helper to DRY up repeated path construction - Parallelise createBackup writes with Promise.all - Parallelise listBackups reads with Promise.all; use type-safe filter - deleteBackup: read only metadata for ownership check (avoids fetching full data object before deleting) electron/services/AuthService.ts: - Remove redundant duplicate credentialsToSet block; merge into single loginOptions object passed to both setCredentials and login - Remove dead comment blocks and duplicate logger.debug calls - Remove unreachable sanitize-user-ID block (was a no-op with a comment acknowledging it did nothing) electron/services/FriendshipService.ts: - Extract mapApiFriendToLocation() helper to centralise repeated field-extraction logic across the service - Import VRCFriend type explicitly for type safety electron/services/GroupService.ts: - Remove duplicate comment lines introduced by a merge - Fix typo: "Broadacst" → "Broadcast" src/stores/authStore.ts: - Replace local User interface with imported VRChatUser type from src/types/electron (single source of truth) - Use getErrorMessage() from errorUtils instead of unsafe `as` cast on unknown errors in catch blocks - Collapse redundant noCredentials / else branches (both did the same thing) https://claude.ai/code/session_01EyWqKDQMfC41FVXRnxE1Fs
- GroupAuthorizationService: extract helper, reduce duplication - GroupService: parallelize independent API calls, remove redundancy - AuthService.test.ts: use getErrorMessage utility, fix mock ordering - LoginView/SetupView: remove redundant state, simplify handlers https://claude.ai/code/session_01EyWqKDQMfC41FVXRnxE1Fs
- KNOWN_BUGS.md: 3 confirmed bugs found during requirements alignment (AutoMod processes when disabled, Instance Guard silent whitelist/blacklist conflict, Watchlist override ignores AutoMod toggle) - REVIEW_STATUS.md: full file-by-file checklist of what has and hasn't been through the simplify review pass https://claude.ai/code/session_01EyWqKDQMfC41FVXRnxE1Fs
- AuthService: reduce duplication, improve error handling consistency - PipelineService: simplify reconnect logic and message routing - SessionService: collapse redundant branches - InstanceGuardService: minor cleanup - InstanceService: remove unnecessary indirection https://claude.ai/code/session_01EyWqKDQMfC41FVXRnxE1Fs
- CredentialsService: remove fs.existsSync guard before unlinkSync (TOCTOU), fix indentation on defaults block, remove dead comment - StorageService: drop redundant fs.existsSync check before mkdirSync (already idempotent with recursive:true), remove existsSync guard in openStorageFolder (shell.openPath handles missing paths), fix typo in comment - SettingsService: remove fs.existsSync guard before readFileSync in getAudioData (TOCTOU), add missing blank line before isTosAccepted https://claude.ai/code/session_01EyWqKDQMfC41FVXRnxE1Fs
… code - Import parseLogTimestamp and extractNameAndId from LogParserService, removing the duplicate private extractTimestamp, parseJoin, and parseLeave methods - Eliminate the second full-file pass for fileTimestamp by capturing the first valid timestamp during the main scan loop - Remove unused SessionEvent interface - Drop stale task-note comments and what-comments throughout; keep the transaction-vs-sequential-upserts tradeoff note and the old-log userId caveat https://claude.ai/code/session_01EyWqKDQMfC41FVXRnxE1Fs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents project structure, development workflows, architecture conventions,
IPC pattern, service layer, testing, CI/CD, and contributing checklist for
AI assistants and new developers.
https://claude.ai/code/session_01EyWqKDQMfC41FVXRnxE1Fs