Develop - #81
Merged
Merged
Conversation
- Add require_onboarded_mobile_user dependency: every mobile endpoint except /auth/* and /enroll now returns 403 until the user completes face enrollment (users.face_embedding is set). - Add is_onboarded to GET /user/auth/me and the avatar upload response so clients can branch on a single field instead of parsing 403s. - Fix asyncpg/SQLAlchemy jsonb handling: register a jsonb type codec on connect so dict params bind correctly and jsonb columns decode back to dict (was crashing audit_events writes, and silently mismatched on notifications/staff_notifications reads). - Add a dev-env fixed OTP (DEV_OTP_BYPASS_CODE) for registration so local/mobile testing doesn't require a real inbox or NATS email flow.
…audit-fixes feat: gate mobile endpoints behind face enrollment, fix jsonb round-trip
- Add events.end_date (nullable timestamptz) via migration. - Add ActivateDueEvents / ArchiveEndedEvents queries: draft -> scheduled when event_date has passed, scheduled -> archived (+ archived_at) when end_date has passed. - Add a polling worker (app/worker/event_lifecycle) that runs both transitions every EVENT_LIFECYCLE_POLL_INTERVAL_SECONDS (default 60s), wired into make run-workers. - Thread end_date through EventCreate/EventResponse/UserEventResponse and CreateEvent/GetUserEvents. Events with no end_date set are never auto-archived and stay in scheduled until archived manually via the existing endpoint.
…cycle feat: automate event lifecycle transitions on start/end time
Adds a per-photo face count (subquery over photo_faces) to
ListUserPhotos and ListEventPhotosForUser, and surfaces it as
face_count on GET /photos and GET /photos/event/{event_id}. Lets
clients distinguish solo photos (one face) from group photos
(multiple faces) without an extra request per photo.
…ource/transfer_status columns
…adRequestsService
Feat/direct bulk upload
…uto-approval for direct uploads
…ediate scheduling
ListUserPhotos (GET /user/photos) was missing the status='approved' filter that ListEventPhotosForUser already has, so a photo a user was still pending/rejected on could leak into the general gallery while correctly staying hidden from the event-scoped view — same photo, inconsistent visibility depending on which endpoint you hit.
PATCH /user/auth/me/profile lets a mobile user update their own display name, reusing AuthService.update_user which already existed but was only wired for admin/internal use.
- Switch NATS pub/sub to JetStream for persistent message queues - Update all workers to use JetStream subscriptions and proper exception propagation (nak) - Remove outdated duplicated test folder (app/worker/photo_worker/tests) which caused global state leakage - Fix CreatePhotoParams missing source argument in tests - Ensure 100% test pass rate
- TTL 30s → 120s to survive slow Drive API calls - Lock value = unique UUID per acquisition (prevent foreign release) - Async heartbeat refreshes TTL every 40s to avoid expiry mid-operation - Extract _resolve_drive_folder to stay under ruff C901 limit - Add missing logger import in staff_drive.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of Changes (Release Candidate)
This Pull Request merges all validated features and fixes from
developintomainfor production deployment.It includes major improvements in robustness (Drive Sync, JetStream), new upload features (Direct Upload), and security enhancements.
New Features
Robustness & Stability Improvements
Security & Integrity
Code Quality & CI/CD