- assertPetOwnership enforces petId ownership (T-02-20)
- getFeedPage reads Redis sorted set with cursor pagination
- Block filter applied at Prisma hydration layer (T-02-21)
- Post order restored to Redis score order after Prisma findMany (Pitfall 7)
- FEED-01 tests green
- Empty feed: returns [] and null nextCursor for pet with no follows
- Cursor pagination: nextCursor passed through from getFeedPage
- Block filter: blocked pets excluded from hydration
- Ownership: throws FORBIDDEN when petId is not owned by requester
vi.mock() is vitest-hoisted at runtime but TypeScript requires explicit import.
Adds: import { vi } from "vitest" to all 7 new test scaffolds.
npx tsc --noEmit now exits 0.
- Append PostType, MilestoneType (16 values), ReportReason enums
- Add Post, PostImage, Milestone, Story, StoryView, Follow, Block, Report models
- Add Pet back-relations for all Phase 2 social graph relations
- Explicit named relations on all self-referential models (Follower/Followee, Blocker/Blocked, StoryViewer, Reporter)
- StoryView.storyId has NO onDelete cascade per D-08 (views survive story expiry)
- npx prisma validate + generate + db push all succeeded
Complete research for Phase 2 — Content Core covering Prisma 7 schema
design for all new models (Post, PostImage, Story, StoryView, Follow,
Block, Report, Milestone), Upstash Redis fan-out feed pattern with
sorted set cursor pagination, Supabase Storage extension for post
images, shadcn Carousel integration, tRPC v11 infinite query pattern,
and security threat model for content mutations.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Test 1: getPresignedUrl generates URL with correct contentType and avatars/-scoped key
- Test 2: getPresignedUrl rejects non-owner with FORBIDDEN (T-4-01)
- Test 3: getPresignedUrl rejects image/gif (Zod enum validation, T-4-02)
- Test 4: getPresignedUrl rejects 11MB file (T-4-06 fileSize limit)
- Test 5: confirmUpload writes avatarKey to DB with correct update call
- Test 6: confirmUpload rejects path traversal key (T-4-05)
- Bonus: confirmUpload rejects non-owner with FORBIDDEN (T-4-01)
- Mock getPresignedUploadUrl via vi.mock — no real R2 calls
- pets/[petId]/page.tsx: replace /api/avatar stub with NEXT_PUBLIC_R2_PUBLIC_URL CDN URL
- pets/[petId]/edit/page.tsx: pass initialAvatarKey to PetForm so AvatarUpload shows current photo
- Sidebar.tsx: add avatarKey to Pet type; show AvatarImage from CDN for active pet and dropdown list
- MobileNav.tsx: same CDN avatar pattern for mobile pet switcher
- next.config.ts: add images.remotePatterns for R2 CDN hostname (T-4-04 safeguard)
- Create AvatarUpload.tsx: idle/dragging/uploading/error/idle-with-avatar states
- XHR PUT to R2 presigned URL with progress tracking (Content-Type must match presignedUrl)
- Two-step upload: getPresignedUrl -> XHR PUT -> confirmUpload -> CDN URL display
- Client-side validation: size <= 10MB, type jpeg/png/webp
- Disabled state in create mode (no petId) with tooltip
- Drag and drop: dragOver/dragLeave/onDrop handlers; orange border in dragging state
- Wire AvatarUpload into PetForm replacing AvatarUploadZone stub
- Add initialAvatarKey prop and currentAvatarKey state to PetForm
- onUploadComplete invalidates React Query cache (pets.byId + pets.list)
- Type CallerCtx explicitly to avoid union type inference error
- petsRouter.createCaller accepts Context | (() => Context); explicit type avoids TS error
- PET-01: create stores pet with ownerId, validates name<=30, upserts owner FK
- PET-02: update FORBIDDEN for non-owner, succeeds for owner
- PET-03: delete by owner succeeds ({ success: true }); FORBIDDEN for non-owner
- PET-05: adoptionStory persists to DB; validates max 500 chars
- Ownership assertion: FORBIDDEN tested for both update and delete (T-3-01)
- All 11 tests passing; no real DB calls (mocked via createMockPrisma)
- My Pets: server-fetched list + PetGrid client island for active pet selection
- Pet profile view: avatar/name/species badge, "Managed by @owner" subordination
- Edit pet: PetForm in edit mode + delete confirmation dialog (UI-SPEC copy)
- Delete dialog: "Delete pet profile?", "Yes, delete", "Keep pet" per UI-SPEC
- Onboarding page: replaced stub with PetForm mode=create, redirects to /pets/[petId]
- Used buttonVariants for Link-as-button (base-nova lacks asChild)
- PetForm: create/edit mode, species/breed from DB (never hardcoded)
- Species selector wired to listSpecies tRPC query
- Breed selector wired to listBreeds, resets on species change
- Bio (maxLength=150) + adoption story (maxLength=500) with char counters
- Pet name maxLength=30 with Zod validation via react-hook-form
- AvatarUploadZone stub (Plan 04 wires upload; disabled in create mode)
- PetCard: avatar with active orange ring, species badge, hover shadow
- (app)/layout.tsx: server component with auth() check + pets.list + redirect to /onboarding/pet if no pets
- Sidebar.tsx: 240px desktop nav (lg:), pet switcher with active state, nav links with orange-500 active indicator
- MobileNav.tsx: fixed bottom bar (h-16, lg:hidden), pet switcher above tabs, orange-500 center post button
- onboarding/pet/page.tsx: stub with Plan 03 placeholder (replaces walking skeleton client form)
- Deviation: base-nova shadcn uses @base-ui/react/menu (no asChild support) — used onClick+useRouter
- Deviation: Clerk 7 UserButton no longer accepts afterSignOutUrl
admin
