Conversation
…ow a stale dashboard After logout, pressing Back restored the authenticated dashboard from the browser's back/forward cache (bfcache). The session is already invalidated server-side (any interaction 401s -> redirect), so this is a defense-in-depth + UX gap, not an auth bypass. Root cause: dashboard pages are dynamically rendered (cookies/headers) and Next owns their Cache-Control — it serves `no-cache, must-revalidate`, not `no-store`. Only `no-store` disables bfcache in Chromium/Firefox, and neither next.config headers() nor the edge proxy can override a dynamic route's Cache-Control (verified empirically — both are dropped/replaced). Fix: a client BfcacheGuard in the dashboard layout reloads any page restored from bfcache (`pageshow` with `persisted`); the reload re-hits the auth check and a logged-out visitor is redirected to /login (MDN's documented pattern for this exact problem). Scoped to the dashboard; the static marketing/landing stays cacheable (Phase 3 LCP work untouched). e2e: pins that a logged-out reload of the dashboard lands on /login (real bfcache Back is verified manually — headless bfcache is unreliable to trigger and window.location.reload can't be spied in Chromium). Verified: biome, next build (31 routes), full e2e 12/12. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PA9EzergAZ12Dy1QBqx5kp
…shboard
Follow-up to the BfcacheGuard: that alone was insufficient. The logout handlers
did `await signOut(); router.push("/login")` — a SOFT (client-side) navigation.
A soft nav leaves the dashboard SPA and Next's client Router Cache alive, so
after logout, Back restored the still-mounted dashboard and its prefetched
authenticated RSC — the logged-out user could not just VIEW it but navigate and
interact via cached soft navigations (no server round-trip, so the dead session
was never re-checked).
Fix: `window.location.href = "/login"` — a hard navigation that tears down the
SPA and discards the Router Cache. Combined with the BfcacheGuard (browser
bfcache restore → reload) and the edge proxy (no cookie → /login), Back after
logout now lands on /login through every path. Dropped the now-unused useRouter.
e2e: the auth flow test now presses Back after logout and asserts /login (it
reproduced the bug on the soft-nav version). Full suite 12/12; build green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PA9EzergAZ12Dy1QBqx5kp
Nova Analytics v1.0.0. Aligns the package version (inherited 2.2.0 from the arhamkhnz template) with the v1.0.0 release tag. Version field only — no dependency or lockfile-format changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PA9EzergAZ12Dy1QBqx5kp
fix: logout + Back no longer views/interacts with the dashboard (hard-nav + bfcache guard)
Focus the product on its coherent analytics story ahead of the review: - Hide off-brand sidebar modules (Academy, Logistics, Infrastructure) and the Legacy V1 dashboards (personal-finance template demos) from the nav; the routes remain in the build (a production build would drop them) — noted in limitations. - Remove the consumer 'Credit score updated' card from the Usage & Billing page. - Rename the sidebar item 'Finance' -> 'Usage & Billing' to match the page title. - Drop the footer 'Security'/'Docs' placeholder links (both pointed at /login). Nav/copy only; no secondary-page content rewritten. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HNyEN55Dz175WWRhrJidAc
…fix false claims Pre-submission audit gate (Phase 6): a 10-dimension multi-agent audit with adversarial verification against the PRD, docs, diagrams and process files. 0 critical findings; the product substantially meets the PRD. Integrity fixes (false claims): - README: SEED_PASSWORD is required/fail-closed, not 'optional'. - SUBMISSION + ROADMAP: Lighthouse numbers are the real landing-v2 figures (desktop 100, mobile ~89-90, CLS 0); '94 mobile' was the retired v1 landing. - fail2ban count reconciled to one figure (9 banned / 96 attempts, first hour). Canonical state made current (ROADMAP/BRAIN/SESSION-LOG): landing v2, coherent dashboard metrics, login-polish, the bfcache fix and the v1.0.0 release (the state files had stalled at 'Phase 6 delivery docs'). - Reconcile the two divergent design-spec copies into one canonical PRD (aurora-tech v2 palette + repo-steward role; sections 7/8 updated to reality). - Add COST-REPORT.md (model-strategist output, promised in section 7) and AUDIT-PRE-SUBMISSION.md (closes the Phase-6 audit gate). - Document, don't chase: CD-not-gated-on-CI, e2e-against-dev, diagram simplifications, and residual template scaffolding in limitations.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HNyEN55Dz175WWRhrJidAc
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promueve
develop→mainpara liberar v1.0.0. El árbol es limpio (merge-tree reporta 0 conflictos) y produce la unión de ambas ramas:fix(dashboard): recarga páginas restauradas por bfcache para que logout + Back no muestren un dashboard stale.fix(auth): hard-navigate en logout para que Back no pueda navegar el dashboard cacheado.chore(release): bump de versión a 1.0.0 (la versión intencional de Nova;mainarrastraba2.2.0residual del template upstream).mainconserva su feature propia ya mergeada por PR feat(auth): premium aurora background + trust badges on login #15 (feat(auth): aurora background + trust badges en login) — el merge no la pierde.Nota de estado (divergencia)
mainydevelophabían divergido:maintenía login-polish (PR #15) quedevelopno;developtiene el fix de bfcache + v1.0.0 quemainno. Este merge reconcilia ambas. Tras mergear conviene un back-mergemain → developpara resincronizar.Deploy
Push a
maindisparadeploy.yml: build de imagen → GHCR → SCP/SSH deploy al VPS. Este merge despliega v1.0.0 a producción.Test plan
develop(quality + e2e) — run previo exitosomain(último push)merge-treesin conflictosGenerated with Claude Code