What's new

v0.1.12

2026-06-10

Security

• – God admin seed: rimosso il fallback password password123. Fuori da development la password proviene ESCLUSIVAMENTE da GOD_PASSWORD (Doppler → Kamal env.secret); il seed fallisce loud se assente. Niente credenziali di default in staging/produzione.

Changed

• – CI/CD migrata al reusable workflow condiviso bussolabs/ci-templates (ci.yml = caller ~12 righe): scan/lint/test/deploy/smoke/uptime uniformi alla fleet. Idle-sleep Sablier su staging. Nessun cambiamento di comportamento dell'applicazione.
• – deploy_timeout Kamal a 90s + Docker HEALTHCHECK start-period 90s: il cold boot esegue db:prepare (tutte le migration) + db:seed prima di puma; 30s (default) non bastavano al primo deploy.

Fixed

• – Seed prod-safe (gotcha #9): gli account demo (owner@/manager@/… con password deboli) sono ora caricati solo in development — in staging/produzione resta il solo god admin. Niente più fixture demo in produzione.
• – Suite test in CI sbloccata (il job test esegue l'intera rspec): .env.test dummy per il boot + correzioni applicative latenti — analytics render_ok con hash literal (keyword args Ruby 3) e namespace ::, feature flags ordinati per name, profili Instagram attributo handle, route onboarding con controller esplicito, paginazione ellissi destra, associazione event_event_types, validazione venue_search senza venue (422 con details.venue_id). Spec approve/location_step allineate al comportamento corrente.

v0.1.10

2026-06-09

Changed

• – Error tracking allineato al template GlitchTip completo: structured logs (enable_logs), scrub PII (ErrorTracking::PiiScrubber) su eventi e log, log bridge Rails.logger → GlitchTip con livello minimo WARN (SENTRY_LOGS_MIN_LEVEL), staging abilitato.
• – Migrazione error tracking da sentry.io SaaS a GlitchTip self-hosted (DSN su Doppler).

v0.1.8

2026-06-02

Added

• – Endpoint GET /version (top-level, no auth): espone tag/sha/build_time/environment della build deployata. Build identity iniettata via Docker ARG → Kamal builder.args → CI. Gli smoke-test staging/production verificano che la versione live corrisponda al tag (fail su mismatch).

Fixed

• – Deploy CI dopo lockdown SSH (infra 2026-06-02): la porta 22 di tutti i server è stata chiusa alla rete privata 10.0.0.0/16. La CI ora passa per il gateway-bastion (167.233.61.97) via SSH ProxyJump, con i server referenziati per IP privato (web 10.0.1.3, worker 10.0.1.2, staging 10.0.1.6). Nessun cambiamento di comportamento dell'applicazione.

v0.1.7

2026-05-28

Added — Role Expansion Wizards backend

• – Member::CrewRequest model + join tables member_crew_request_music_types / _artist_types
• – Member::PromoterRequest model + join member_promoter_request_music_types
• – pg_trgm PostgreSQL extension + GIN indexes su lower(name) per fuzzy matching
• – RoleExpansion::DuplicateDetectionService — match exact (VAT/instagram/email) + fuzzy name+city via pg_trgm
• – RoleExpansion::SubmitDraftService dispatcher + 3 strategie kind-specific (venue/crew/promoter)
• – API Api::V1::Member::CrewRequestsController (show/create/destroy + step actions info/contacts/media/submit)
• – API Api::V1::Member::PromoterRequestsController (analoga)
• – API Api::V1::RoleExpansion::DuplicatesController#check con rate limit
• – Form objects Member::CrewRequestForms::ContactsForm + Member::PromoterRequestForms::ContactsForm
• – Estensione Member::CrewRequestForms::InfoForm e PromoterRequestForms::InfoForm con city/province presence
• – ViewComponent Member::WizardHeaderComponent (title + description + entity icon + step indicator)
• – ViewComponent Member::InlineDuplicateBannerComponent + Stimulus member--duplicate-check
• – ViewComponent Member::DraftResumeBannerComponent
• – Locale config/locales/role_expansion/{it,en}.yml + config/locales/wizard/{it,en}.yml
• – Spec coverage: model + service + request + component (60+ examples)

Added — i18n IT+EN completo webapp

• – Gem i18n-tasks (dev/test) + config/i18n-tasks.yml per audit missing/unused
• – 6 mailer (account, event, event_participation, invitation, venue_claim, requests/city) refactor con I18n.with_locale(account.locale) — utenti EN ricevono email in inglese
• – ApplicationMailer#with_recipient_locale helper per dispatch locale-aware
• – Espansi config/locales/mailers/{it,en}.yml: tutte le 22 view mailer (.html + .text) i18n-izzate con chiavi subject/heading/body/body_html
• – Drawer profile, home hero mockup, events/venues/promoters/crews detail, pwa/offline, map top bar — tutti i testi hardcoded estratti in website.* keys IT+EN
• – actions.close + auth.show_password per aria-label accessibility
• – Fix struttura: website.shared.god_managed.*, website.city_requests.* spostati sotto path corretto

Fixed

• – errors.invalid_resource da "Invalid resource" → "Risorsa non valida" in locale IT
• – Website::CityRequestsController#create flash usa website.city_requests.success (era city_requests.success orfano)
• – 3 chiavi map legend localizzate: "Locale con eventi", "Locale senza eventi", "Evento in corso"
• – System spec crew_upgrade_flow + promoter_upgrade_flow: aggiornati con city/province (InfoForm aveva acquisito validates :city, presence: true senza aggiornamento spec)

v0.1.6

2026-05-27

Added

• – Spec coverage estesa: system specs per crew/promoter/venue/onboarding/valhalla, serializers Alba, ViewComponent UI, db seeds, requests notifications/lookups
• – Helper test condivisi: system_dom_helpers, management_team_helpers, query_counter, google_maps_stub, google_places_stub, vcr
• – Account E2E dedicato per testing cross-repo (db/seeds/e2e_account.rb)
• – Documentazione: DESIGN.md (design system tokens), app/components/COMPONENTS.md

Changed

• – Design system Management: refactor componenti card event/crew/promoter/venue, page header, filtri, panel list
• – Localizzazione: aggiornamenti IT/EN su auth, management, member, onboarding, valhalla
• – Map redesign + clustering MarkerClusterer (specs in docs/superpowers/)

Fixed

• – Security: aggiornate gem con CVE — net-imap (4 CVE 2026), yard (path traversal), view_component (sibling escape), jwt (empty-key HMAC bypass), faraday (protocol-relative URI), css_parser (cert validation)
• – Test: ordine DatabaseCleaner.clean + Capybara.reset_sessions! invertito in spec/support/database_cleaner.rb (deadlock DB su system spec)
• – Repo hygiene: .playwright-mcp/ artifact rimossi da tracking, .gitignore esteso (.DS_Store, .simplecov, .playwright-mcp/)

v0.1.5

2026-05-04

Fixed

• – Deploy: aggiunto assets:precompile nel Dockerfile (tailwind.css non veniva generato → 500 su tutte le pagine)

v0.1.4

2026-05-04

Fixed

• – Deploy: rimosso solid:prepare da docker-entrypoint (comando inesistente, db:migrate gestisce già tutti i database)

v0.1.3

2026-05-04

Fixed

• – Deploy: image in deploy.yml senza prefisso ghcr.io (Kamal 2.x aggiunge registry.server automaticamente, doppio prefisso causava build failure)

v0.1.2

2026-05-04

Fixed

• – Test: logout_from_sidebar_spec usa have_current_path + have_text invece di data-test DOM (flaky in CI per timing Turbo)

v0.1.1

2026-05-03

Fixed

• – Deploy: migration enable_extensions gestisce PG::InsufficientPrivilege per cube/earthdistance (richiedono superuser, pre-create manualmente in produzione)