Commit Graph

4 Commits

Author SHA1 Message Date
copilot-swe-agent[bot] fdc48c7fe9 feat(notifications): admin push notifications and webhooks for user signup, plan changes, and payment issues
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-07 20:15:39 +00:00
copilot-swe-agent[bot] d0cd4c89f0 security: fix CodeQL CWE-312 clear-text logging of sensitive information
Remove user_id (and Stripe-metadata-sourced plan_id/billing_cycle) from
logger.info calls in billing.py (_on_checkout_completed, _on_subscription_updated)
and onboarding.py (save_plan). Operations are still logged with non-identifying
tier/billing-cycle details; user identity is no longer written to the log stream.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-07 15:15:00 +00:00
copilot-swe-agent[bot] e0de0fd6fb feat: add multi-step user onboarding wizard
- 5-step wizard: Welcome → Profile → Plan → Storage → All Set!
- New migration 017: onboarding_completed, contact_email, preferred_destination fields
- REST API at /api/onboarding/{status,profile,plan,storage,complete}
- GET /onboarding view with configured-destinations helper
- OAuth callback redirects first-time users to onboarding
- 16 unit tests for all endpoints; 65 total tests pass

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-07 11:12:21 +00:00
copilot-swe-agent[bot] 99df0816b0 feat(onboarding): add multi-step user onboarding wizard
Add a 5-step onboarding flow for new users:
- Migration 017: adds onboarding_completed, onboarding_completed_at,
  contact_email, preferred_destination to user_profiles
- app/api/onboarding.py: REST endpoints (status, profile, plan, storage,
  complete) with session-based auth using sub/preferred_username/email/id
  priority chain
- app/views/onboarding.py: GET /onboarding view with configured-destination
  detection helper for all 8 supported storage providers
- frontend/templates/onboarding.html: Alpine.js wizard with progress
  indicator, tier cards (server-rendered), storage destination cards,
  accessible markup (WCAG AA), and all fetch() API calls
- app/auth.py: redirect first-time OAuth users (onboarding_completed=False)
  to /onboarding after login
- 16 unit tests covering all endpoints, auth enforcement, and edge cases

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-07 11:04:53 +00:00