Standardize on venv/ for Python virtual environments

.codacy/codacy.yaml

@@ -1,7 +1,8 @@
 runtimes:
-    - node@20.0.0
+    - node@22.2.0
     - python@3.11.11
 tools:
     - eslint@8.57.0
     - pylint@3.3.6
+    - semgrep@1.78.0
     - trivy@0.66.0

.gitattributes

@@ -0,0 +1 @@
+*.sh text eol=lf

.github/instructions/codacy.instructions.md

@@ -6,13 +6,6 @@
 # Codacy Rules
 Configuration for AI behavior when interacting with Codacy's MCP Server
 
-## using any tool that accepts the arguments: `provider`, `organization`, or `repository`
-- ALWAYS use:
- - provider: gh
- - organization: tim-dickey
- - repository: trivia-app
-- Avoid calling `git remote -v` unless really necessary
-
 ## CRITICAL: After ANY successful `edit_file` or `reapply` operation
 - YOU MUST IMMEDIATELY run the `codacy_cli_analyze` tool from Codacy's MCP Server for each file that was edited, with:
  - `rootPath`: set to the workspace path

.gitignore

@@ -20,7 +20,6 @@ wheels/
 .installed.cfg
 *.egg
 venv/
-.venv/
 env/
 ENV/
 
@@ -71,3 +70,8 @@ Thumbs.db
 
 # Alembic
 backend/alembic/versions/*.pyc
+
+# Codacy
+.codacy/cli-config.yaml
+.codacy/tools-configs/
+.codacy/logs/

CHANGELOG.md

@@ -12,7 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 #### Backend
 - **CRITICAL**: Migrated from `python-jose` to `PyJWT` (2.10.1) to address CVE vulnerabilities
 - **CRITICAL**: Updated `fastapi` from 0.109.0 to 0.115.6 (fixes ReDoS vulnerability in Content-Type header parsing)
-- Updated `cryptography` to 44.0.1 (fixes CVE-2024-12797)
+- **CRITICAL**: Updated `cryptography` to 46.0.5 (fixes subgroup validation vulnerability for SECT curves; CVE affecting ≤ 46.0.4)
 - Updated `uvicorn` from 0.27.0 to 0.34.0 (includes security patches)
 - Updated `pydantic-settings` from 2.1.0 to 2.12.0
 - Updated `email-validator` from 2.1.0 to 2.2.0

CONTRIBUTING.md

@@ -53,7 +53,17 @@ Before you begin, ensure you have:
    ```bash
    git remote add upstream https://github.com/ORIGINAL_OWNER/trivia-app.git
    ```
-4. **Follow the setup instructions** in the [README.md](README.md)
+4. **Set up Python virtual environment**:
+   ```bash
+   cd backend
+   # IMPORTANT: Use 'venv' as the directory name (not '.venv')
+   # This project standardizes on 'venv/' for consistency across all environments
+   python -m venv venv
+   source venv/bin/activate  # macOS/Linux
+   # or: venv\Scripts\activate  # Windows
+   pip install -r requirements.txt
+   ```
+5. **Follow the remaining setup instructions** in the [README.md](README.md)
 
 ## 🔨 How to Contribute
 

DEPENDENCY_UPDATE_SUMMARY.md

@@ -11,7 +11,7 @@ Successfully updated all outdated dependencies with security patches as requeste
 1. **python-jose → PyJWT Migration** ✅
    - **Removed**: `python-jose[cryptography]==3.4.0` (had CVE vulnerabilities)
    - **Added**: `PyJWT==2.10.1` (secure, actively maintained)
-   - **Added**: `cryptography==44.0.1` (for PyJWT cryptographic algorithms)
+   - **Added**: `cryptography==46.0.5` (for PyJWT cryptographic algorithms; fixes subgroup validation vulnerability for SECT curves)
    - **Code Changes**: Updated `backend/core/security.py`
      - Changed import: `from jose import jwt, JWTError` → `import jwt` and `from jwt.exceptions import PyJWTError`
      - Updated exception handling to use `PyJWTError` instead of `JWTError`
@@ -24,8 +24,8 @@ Successfully updated all outdated dependencies with security patches as requeste
 
 3. **Cryptography Security Fix** ✅
    - **Before**: N/A
-   - **After**: `cryptography==44.0.1`
-   - **Fix**: Addresses CVE-2024-12797 (low severity)
+   - **After**: `cryptography==46.0.5`
+   - **Fix**: Addresses subgroup validation vulnerability for SECT curves (CVE affecting versions ≤ 46.0.4)
 
 #### Other Backend Updates
 4. **uvicorn**: `0.27.0` → `0.34.0` (includes security patches)

ISSUE_CREATION_INSTRUCTIONS.md

@@ -19,13 +19,13 @@ Code review of PR #20 documented critical issues. All necessary files have been
 
 ✅ **Complete**: All infrastructure and documentation
 - Issue JSON files (P0, P1, P2) in `_bmad-output/implementation-artifacts/`
-- **Consolidated Issues Log** in `_bmad-output/implementation-artifacts/issues-log.json` (20 issues)
-- **Recommended**: `scripts/create-issues-from-log.py` - Creates all 20 issues and updates log
-- **Alternative**: `scripts/create-github-issues.py` - Creates only 15 code review issues
+- **Consolidated Issues Log** in `_bmad-output/implementation-artifacts/issues-log.json` (issue count varies; current log has 20)
+- **Recommended**: `scripts/create-issues-from-log.py` - Creates all issues in log (count varies) and updates log
+- **Alternative**: `scripts/create-github-issues.py` - Creates code review issues from JSON files (count varies)
 - Bash scripts in `scripts/` directory
 - Comprehensive documentation in `_bmad-output/implementation-artifacts/issues-creation-guide.md`
 
-❌ **Pending**: Actual GitHub issues creation (20 issues total: 15 from code review + 5 from PRD validation)
+❌ **Pending**: Actual GitHub issues creation (count varies; current log has 20: 15 from code review + 5 from PRD validation)
 
 ## Why Issues Weren't Created Automatically
 
@@ -43,14 +43,14 @@ The automated scripts require GitHub CLI (`gh`) authentication, which is not ava
    gh auth login
    ```
 
-2. **Run the consolidated log script** (creates all 20 issues):
+2. **Run the consolidated log script** (creates all issues in log; count varies):
    ```bash
    cd /home/runner/work/trivia-app/trivia-app
    python3 scripts/create-issues-from-log.py
    ```
 
    This will:
-   - Create all 20 issues automatically (15 code review + 5 PRD validation)
+   - Create all issues automatically (count varies; current log has 20: 15 code review + 5 PRD validation)
    - Apply correct labels (priority:critical, priority:high, priority:medium, etc.)
    - Update `issues-log.json` with GitHub issue numbers automatically
    - Update status and date fields in the log
@@ -62,23 +62,23 @@ The automated scripts require GitHub CLI (`gh`) authentication, which is not ava
    python3 scripts/create-github-issues.py
    ```
 
-   This creates only the 15 code review issues and generates a separate tracking file. Does not update `issues-log.json` or include PRD validation issues.
+   This creates the code review issues from JSON files (count varies) and generates a separate tracking file. Does not update `issues-log.json` or include PRD validation issues.
 
 ### Option 2: Manual Creation via Web UI
 
 Visit https://github.com/tim-dickey/trivia-app/issues/new for each issue and use the content from:
 
 1. **Consolidated Issues Log** (RECOMMENDED): `_bmad-output/implementation-artifacts/issues-log.md`
-   - Contains all 20 issues (15 code review + 5 PRD validation)
+   - Contains all issues in log (count varies; current log has 20: 15 code review + 5 PRD validation)
    - Well-formatted with all details
    - Organized by priority (P0, P1, P2)
 
 2. **Detailed Documentation**: `_bmad-output/implementation-artifacts/all-issues-to-create.md`
-   - Contains 15 code review issues with full body text
+   - Contains the code review issues with full body text (count varies)
    - Each issue separated by `---ISSUE-SEPARATOR---`
 
 3. **JSON Data Files** (for API/automation):
-   - `_bmad-output/implementation-artifacts/issues-log.json` - All 20 issues consolidated
+   - `_bmad-output/implementation-artifacts/issues-log.json` - consolidated issues (count varies; current log has 20)
    - `_bmad-output/implementation-artifacts/code-review-issues-p0.json` - 5 P0 Critical issues
    - `_bmad-output/implementation-artifacts/code-review-issues-p1.json` - 5 P1 High priority issues
    - `_bmad-output/implementation-artifacts/code-review-issues-p2.json` - 5 P2 Medium priority issues
@@ -98,11 +98,11 @@ curl -X POST \
 
 ## Issue Summary
 
-**Total: 20 issues - 5.4 days effort**
+**Total: Example from 2026-02-02 review (future reviews may differ)**
 
 ### Sources
-- **Code Review 2026-02-02**: 15 issues (PR #20 findings)
-- **PRD Validation 2026-01-24**: 5 issues (requirements improvements)
+- **Code Review 2026-02-02**: Example issues from PR #20 findings
+- **PRD Validation 2026-01-24**: Example issues from requirements improvements
 
 ### P0 (Critical) - 5 issues - 2.6 days effort
 1. **[P0] Consolidate CI/CD Workflows** (3h) - Eliminate duplicate test runs
@@ -139,7 +139,7 @@ curl -X POST \
 ## Verification
 
 After creating the issues, verify:
-- [ ] All 20 issues created
+- [ ] All issues created (count varies)
 - [ ] Correct labels applied (priority:critical, priority:high, priority:medium, etc.)
 - [ ] Issue numbers tracked in `issues-log.json`
 - [ ] Issues are properly linked in project board (if applicable)
@@ -155,7 +155,7 @@ After creating the issues, verify:
 
 ## Additional Resources
 
-- **Consolidated Issues Log**: `_bmad-output/implementation-artifacts/issues-log.md` (all 20 issues)
+- **Consolidated Issues Log**: `_bmad-output/implementation-artifacts/issues-log.md` (all issues in log; current log has 20)
 - **Issues Log JSON**: `_bmad-output/implementation-artifacts/issues-log.json` (machine-readable)
 - **Full documentation**: `_bmad-output/implementation-artifacts/issues-creation-guide.md`
 - **Action items detail**: `_bmad-output/implementation-artifacts/action-items-2026-02-02.md` (916 lines)

README.md

@@ -174,6 +174,8 @@ This starts only PostgreSQL and Redis containers.
 cd backend
 
 # Create virtual environment
+# IMPORTANT: Use 'venv' as the directory name (not '.venv')
+# This project standardizes on 'venv/' for consistency
 python -m venv venv
 
 # Activate virtual environment

VENV_SETUP.md

@@ -111,6 +111,7 @@ pytest
 
 ## Notes
 
+- **Naming Convention**: This project uses `venv/` as the standard virtual environment directory name (NOT `.venv/`). Please use `python -m venv venv` to maintain consistency.
 - **Global Installation**: The global Python installation has NOT been modified. All dependencies are isolated in the venv directory.
 - **Compatibility**: SQLAlchemy and Pydantic were upgraded to versions compatible with Python 3.13.
 - **.gitignore**: The `venv/` directory is already configured in `.gitignore` and will not be committed to the repository.

_bmad-output/implementation-artifacts/code-review-issues-tracking.md

@@ -0,0 +1,24 @@
+# Code Review Issues Tracking
+
+Generated: 2026-02-07 16:51:44
+Source: Code Review 2026-02-02
+
+## Created Issues
+
+**Note**: P0-3 (Implement WebSocket Infrastructure for Real-Time Features) from the source JSON was not created as a GitHub issue during the initial creation run. This may have been intentional or an oversight during the creation process.
+
+### P0 (Critical)
+
+- [ ] #61 - [P0] Consolidate CI/CD Workflows to Eliminate Duplicate Test Runs
+- [ ] #62 - [P0] Implement Organization Scoping Middleware for Multi-Tenancy
+- [ ] #63 - [P0] Fix Test Database Configuration (PostgreSQL in CI)
+- [ ] #64 - [P0] Document Required GitHub Secrets for CI/CD
+
+### P1 (High)
+
+- [ ] #65 - [P1] Update Outdated Dependencies with Security Patches
+- [ ] #66 - [P1] Add Frontend CI Workflow for Quality Validation
+- [ ] #67 - [P1] Expand CodeQL Security Analysis to Python and TypeScript
+- [ ] #68 - [P1] Add Application Services to Docker Compose
+- [ ] #69 - [P1] Add Security Headers Middleware
+

backend/docker-entrypoint.sh

@@ -8,9 +8,14 @@ echo "==================================="
 echo "Starting Trivia App Backend..."
 echo "==================================="
 
+# Extract database connection details from DATABASE_URL or use defaults
+DB_HOST="${PGHOST:-postgres}"
+DB_USER="${PGUSER:-trivia_user}"
+DB_NAME="${PGDATABASE:-trivia_db}"
+
 # Wait for PostgreSQL to be ready
 echo "Waiting for PostgreSQL to be ready..."
-until pg_isready -h postgres -U trivia_user -d trivia_db; do
+until pg_isready -h "$DB_HOST" -U "$DB_USER" -d "$DB_NAME"; do
   echo "PostgreSQL is unavailable - sleeping"
   sleep 2
 done

backend/requirements.txt

@@ -12,7 +12,7 @@ psycopg[binary]==3.3.2  # PostgreSQL adapter
 
 # Authentication & Security
 pyjwt==2.10.1
-cryptography==44.0.1  # For PyJWT cryptographic algorithms
+cryptography==46.0.5  # For PyJWT cryptographic algorithms
 passlib[bcrypt]==1.7.4
 bcrypt==4.0.1
 python-multipart==0.0.22
@@ -22,9 +22,9 @@ celery==5.3.4
 redis==5.0.1 #Ensure actual Redis server version (container or cloud) is reasonably current
 
 # Validation & Settings
-pydantic==2.12.5
+pydantic==2.12.5 # Track FastAPI reasonably closely; upgrade Pydantic within the same major version when needed, not arbitrarily
 pydantic-settings==2.12.0
-email-validator==2.2.0 # Track FastAPI reasonably closely; upgrade Pydantic within the same major version when needed, not arbitrarily
+email-validator==2.2.0
 
 # Testing
 pytest==9.0.2

docker-compose.yml

@@ -43,7 +43,7 @@ services:
     environment:
       - DATABASE_URL=postgresql://trivia_user:trivia_pass@postgres:5432/trivia_db
       - REDIS_URL=redis://redis:6379/0
-      - SECRET_KEY=dev-secret-key-change-in-production-use-openssl-rand-hex-32
+      - SECRET_KEY=${SECRET_KEY:-dev-secret-key-change-in-production-use-openssl-rand-hex-32}
       - DEBUG=True
       - CORS_ORIGINS=["http://localhost:5173","http://localhost:3000"]
       - APP_NAME=trivia-app

docs/CI_CD.md

@@ -1,7 +1,9 @@
 # CI/CD Pipeline Documentation
 
-> **Last Updated**: February 5, 2026  
+> **Last Updated**: February 7, 2026  
 > **Status**: Consolidated workflows - Single CI for PRs, scheduled security scans
+> 
+> **Recent Change**: Removed `.venv/` support from project. Only `venv/` should be used for Python virtual environments. This standardization supersedes any previous configurations or documentation that mentioned `.venv/`.
 
 ## Overview
 
@@ -46,8 +48,10 @@ The following tools are configured for code analysis:
 
 To optimize analysis time, the following paths are excluded from Codacy analysis:
 
+**Note**: As of February 7, 2026, the project has standardized on `venv/` for Python virtual environments. While `venv/` is the standard, both `venv/` and `.venv/` should remain in `.gitignore` to prevent accidental commits of local environments.
+
 - `node_modules/**` - Node.js dependencies
-- `venv/**` - Python virtual environments
+- `venv/**`, `.venv/**` - Python virtual environments (**use `venv/` only**)
 - `__pycache__/**` - Python bytecode cache
 - `.pytest_cache/**` - Pytest cache
 - `backend/alembic/versions/**` - Auto-generated database migrations
@@ -524,6 +528,7 @@ Set these in: **Repository Settings** → **Secrets and variables** → **Action
 
 | Date | Change | Author |
 |------|--------|--------|
+| 2026-02-07 | **Removed `.venv/` support - standardized on `venv/` only** | PR #58 (supersedes prior `.venv` guidance) |
 | 2026-02-02 | Initial CI/CD documentation | Documentation update |
 | 2026-02-01 | Added Codacy and CodeQL workflows | PR #21 |
 

docs/CODE_REVIEW_TEST_RESULTS.md

@@ -66,7 +66,7 @@ Success Rate: 100% (for completed files)
 
 | Test | Status | Details |
 |------|--------|----------|
-| `test_acceptance_criteria_present` | ✅ PASS | All 15 issues have acceptance criteria |
+| `test_acceptance_criteria_present` | ✅ PASS | All 15 issues (2026-02-02 review) have acceptance criteria |
 | `test_acceptance_criteria_format` | ✅ PASS | Criteria use proper checkbox format |
 
 **Summary**: All acceptance criteria are properly formatted with minimum 2 criteria per issue.
@@ -109,7 +109,7 @@ Success Rate: 100% (for completed files)
 |------|--------|----------|
 | No duplicate IDs | ✅ | All IDs unique |
 | Sequential numbering | ✅ | P0-1 through P2-5, properly sequenced |
-| Total distribution | ✅ | 15 issues across 3 complete files |
+| Total distribution | ✅ | 15 issues across 3 files for the 2026-02-02 review |
 
 ## Quality Metrics
 
@@ -143,7 +143,7 @@ Average effort estimate: 3.8 hours
 ### Issue Generation Process
 
 ✅ **JSON → GitHub Issues Conversion**
-- All 15 issues successfully converted to GitHub issues
+- All 15 issues from the 2026-02-02 review successfully converted to GitHub issues
 - Labels properly applied
 - Body content correctly formatted as Markdown
 - Priority levels reflected in labels
@@ -162,9 +162,9 @@ Average effort estimate: 3.8 hours
 - Clear connection between review and created issues
 
 ✅ **Completeness**
-- 5 P0 issues covering critical blockers
-- 5 P1 issues covering high-priority work
-- 5 P2 issues covering improvements
+- 5 P0 issues covering critical blockers (2026-02-02 review)
+- 5 P1 issues covering high-priority work (2026-02-02 review)
+- 5 P2 issues covering improvements (2026-02-02 review)
 - P3 template ready for additional issues
 
 ## Workflow Process Verification
@@ -186,7 +186,7 @@ Average effort estimate: 3.8 hours
 
 ### Phase 4: Issue Creation ✅
 - Script: [scripts/create-github-issues.py](../../scripts/create-github-issues.py)
-- All 15 issues created successfully
+- All 15 issues from the 2026-02-02 review created successfully
 - Labels and metadata correct
 
 ### Phase 5: Documentation ✅

docs/ISSUE_GENERATION_PROCESS.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-This document describes the complete process for generating GitHub issues from JSON files, supporting all 4 priority levels (P0-P3).
+This document describes the complete process for generating GitHub issues from JSON files, supporting all 4 priority levels (P0-P3). The issue count varies based on BMAD review results.
 
 ## Priority Levels
 
@@ -75,6 +75,17 @@ cd trivia-app
 python3 scripts/create-github-issues.py
 ```
 
+```powershell
+# Method 3: PowerShell wrapper
+cd trivia-app
+./scripts/run-issue-creation.ps1
+```
+
+**WSL Notes**:
+- Run `gh auth login` inside WSL (Windows auth does not carry over).
+- If you see `^M` or `command not found`, convert line endings:
+  `sed -i 's/\r$//' scripts/run-issue-creation.sh`
+
 ### Output
 
 The script provides:

docs/TEST_FRAMEWORK.md

@@ -6,7 +6,7 @@ This document describes the test framework configuration for the trivia-app back
 
 ## Testing Dependencies
 
-The source of truth for backend test dependencies is `backend/requirements.txt`. Use the project `venv` and install dependencies before running tests.
+The source of truth for backend test dependencies is `backend/requirements.txt`. Use the project `venv` (not `.venv`) and install dependencies before running tests.
 
 Key testing-related packages (current requirements):
 - `pytest==9.0.2`