chore(canary-phase0): bootstrap & cleanup complete

Phase 0 deliverables (audited via superpowers:code-reviewer + general-purpose):

Implementation (8 commits + 1 audit-fix commit):
- 5ccabe00  Comprehensive .gitignore (Go, Node, env, OS, builds, caches)
- 382890cb  Rebrand no-auth-template → canary-token-generator across compose
- 7fa2861e  Strip JWT/users, rename module to project-local path, rewrite main
- 8b70bfbb  Merge backend compose into project-root (single deployment unit)
- a5c8d171  canary.dev (Air) + canary.prod (distroless static) Dockerfiles
- 369c9548  Unified Justfile with frontend/backend/lint/compose/tunnel groups
- a2d6f09a  Project-root .env.example + idempotent init.sh
- a4811d1c  Import operator's React + Vite frontend template
- 98c00689  Address audit findings (vite.prod paths, broken backend/Dockerfile,
            backend/Justfile, admin AuthService residue, header glyphs)

Verification at phase boundary:
- go build ./... + go vet ./...    clean
- docker compose -f compose.yml config + dev.compose.yml config + cloudflared overlay  all parse
- just --list parses, randomized host ports preserved (22784, 58495, 15723, 5447, 6022, 16686, 4317, 4318)
- grep returns zero hits for: react-scss, carterperez-dev/templates, JWTConfig,
  JWT_PRIVATE, lestrrat, InvalidateAllSessions
- backend has no host port in production compose
- module path: github.com/CarterPerez-dev/cybersecurity-projects/canary-token-generator/backend

Deliberately deferred (logged for later phases):
- Template-imported Go files (server.go, logging.go, request_id.go, headers.go,
  ratelimit.go, health/handler.go, core/*.go, config/config.go) carry
  '// AngelaMos | 2026' headers without ©. Out of Phase 0 scope. Bulk hygiene
  pass possible later.
- frontend/vite.config.ts and frontend/stylelint.config.js carry 2025 in their
  headers (operator-imported template files). Same deferred bucket.
- backend/internal/admin/handler.go now has handler-only structure; OperatorBearer
  middleware wiring is Phase 12.
- Recovery middleware not yet present in main.go middleware chain — Phase 9
  introduces it alongside the token domain.
- config.go envKeyMap does not yet know about canary-specific env vars
  (PUBLIC_BASE_URL, TURNSTILE_SECRET, OPERATOR_TOKEN, GEOLITE_PATH,
  WEBHOOK_HMAC_SECRET, MYSQL_FAKE_ENABLED). compose.yml passes them in via
  ENV but config.go cannot read them yet — Phase 9 extends this.

Phase 0 complete. Next: Phase 1 (database schema + repositories).

This commit is contained in:

CarterPerez-dev

2026-05-10 05:38:27 -04:00

parent 98c006897d

commit a86939f412

chore(canary-phase0): bootstrap & cleanup complete

Diff Content Not Available