Review 1/5 — Tooling: CI, ESLint, pure utilities with tests - #25
Merged
Merged
Conversation
…ests
Review tier 1 of 5 — no behavior changes, nothing wired in yet:
- GitHub Actions CI: typecheck, lint, unit tests, production build.
- ESLint flat config (next/core-web-vitals + next/typescript); the
codebase passes with zero errors.
- Pure, unit-tested utilities that later tiers wire in: fixed-window
rate limiter, submission-retention TTL math, form-field validation.
- export {} on the two argv-style scripts so their top-level consts
don't collide in tsc global scope.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BFHkXUuHJME4cF9AJWbavB
This was referenced Jul 12, 2026
The in-memory rate limiter isn't needed at this stage — per-isolate state on the edge runtime made it best-effort anyway, and the input size caps on the public POST routes remain in place. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BFHkXUuHJME4cF9AJWbavB
Deploying inf319-certificate with
|
| Latest commit: |
1ac8467
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://577713d1.inf319-certificate.pages.dev |
| Branch Preview URL: | https://claude-review-1-tooling.inf319-certificate.pages.dev |
Pins the printed-QR contract for legacy /verify (positional string, page-parser emulation, frozen SHA-512 golden digest) and the new /org/<slug>/verify (generateURL → OrgVerifyClient parse → canonicalHash round trip, special-character encoding), plus route-file existence for all four pages/endpoints the printed URLs point at. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BFHkXUuHJME4cF9AJWbavB
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 1 of the review-ordered stack (1 tooling → 2 content → 3 public UX+tests → 4 org features → 5 core & security). This restructures the previous nine draft PRs (#16–#24) so everything can be reviewed in one sitting: easy approvals first, deep-investigation material concentrated in part 5. Merge order: this one first, then cascade.
Contents — no behavior changes, nothing wired in yet
.github/workflows/ci.yml): typecheck, ESLint, vitest, production build on every push/PR.next/core-web-vitals+next/typescript); the existing codebase passes with zero errors.src/util/retention.ts), form-field validation (src/util/validateFormField.ts).src/util/verifyUrlContract.test.ts): pins the printed-QR contract for BOTH verify flows — legacy/verify(positional string round trip through an exact emulation of the page parser + frozen SHA-512 golden digest) and new/org/<slug>/verify(issuer URL → verifier parse → identical canonicalHash, special-character encoding). Also asserts all four route files the printed URLs point at exist on disk. If a future refactor breaks already-printed certificates, these tests fail.export {}on two argv-style scripts so tsc global scope doesn't collide.Per review feedback: the rate limiter was dropped from this PR (and will be stripped from the later PRs that wired it in when we get to them).
Verification
Typecheck, lint, 111 unit tests, production build all pass.
🤖 Generated with Claude Code
https://claude.ai/code/session_01BFHkXUuHJME4cF9AJWbavB