a1f056e6a5
Flow docs updated (11 files): - Delivery Confirmation: reversed actor roles (buyer generates, seller verifies), fixed endpoint paths (/delivery-code/generate, /delivery-code/verify) - Passkey (WebAuthn): removed stub/simulated-key claims; real @simplewebauthn/server attestation is implemented; refresh tokens are persisted - Dispute: corrected resolve schema (action enum), removed non-existent statuses, documented security gaps (no role guards on status/resolve/assign), route shadowing, all socket events are TODO stubs - Seller Offer: corrected all endpoint paths, removed 'active' status, documented withdraw dead code, missing seller history page, select-offer notification gap - Notification: corrected mark-all-read method+path, fixed GET /:id broken lookup, added unread-count-update socket event - Authentication: corrected rate limiter (counts all attempts), axios 403 not handled, deleteAccount wrong endpoint bug, changePassword no UI - Password Reset: corrected 6-digit code (not 8), documented no-complexity gap on reset-with-code vs token reset - Payment Flow DePay: /create→/save, removed phantom sub-routes, SIM_ bypass risk, PaymentProvider type gap, getProviderIntentEndpoint routing bug - Payment Flow SHKeeper: removed phantom polling endpoint, fixed release/refund paths - Purchase Request: added pending_payment/active statuses, fixed sellers/attachments endpoints, corrected socket events, PUT→PATCH bug - Escrow: documented dispute resolve does not touch escrow, route shadowing, confirm-delivery auth gap Issues created (35 files in Issues/): - 9 security issues (critical) including: dispute privilege escalation ×4, unauthenticated payment/scanner endpoints ×2, SIM_ production bypass, confirm-delivery ownership gap - 26 additional major/critical bugs covering broken endpoints, missing features, data integrity gaps, and frontend-backend mismatches Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1.6 KiB
1.6 KiB
issue, title, severity, domain, labels, status, created, source
| issue | title | severity | domain | labels | status | created | source | ||
|---|---|---|---|---|---|---|---|---|---|
| 031 | Points/referral system missing 5 frontend pages — redemption, levels, referrals, transactions, admin | major | points |
|
open | 2026-05-29 | Doc vs Code Audit 2026-05-29 |
🟠 Points/referral system missing 5 frontend pages — redemption, levels, referrals, transactions, admin
Severity: major Domain: points Labels: frontend, missing-feature
Description
The following routes return 404 because no frontend pages exist:
| Route | Backend Endpoint | Status |
|---|---|---|
/dashboard/points/referrals |
GET /api/points/referrals |
Page missing |
/dashboard/points/transactions |
GET /api/points/transactions |
Page missing |
/dashboard/points/levels |
GET /api/points/levels |
Page missing |
/dashboard/points/redeem (or any UI) |
POST /api/points/redeem |
No redemption UI anywhere |
| Admin points management | POST /api/points/admin/add |
No admin page |
redeemPoints() and generateReferralCode() actions are defined but have no call sites in any component.
Current Behavior
All points features beyond the basic balance display are inaccessible from the UI.
Expected Behavior
Implement frontend pages for: referral history, transaction history, levels display, points redemption flow, and admin points management.
Affected Files
- Missing pages in
frontend/src/app/dashboard/points/ frontend/src/actions/points.ts—redeemPoints,generateReferralCode(defined, no callers)