From b7ef11f31e73b5fecb56ccb80600b645b345c77b Mon Sep 17 00:00:00 2001 From: metatroncubeswdev Date: Thu, 15 Oct 2026 16:33:35 -0400 Subject: [PATCH] docs: session handoff for finishing the App Store submission Co-Authored-By: Claude Opus 5.5 --- HANDOFF.md | 80 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 HANDOFF.md diff --git a/HANDOFF.md b/HANDOFF.md new file mode 100644 index 0000000..253eac8 --- /dev/null +++ b/HANDOFF.md @@ -0,0 +1,80 @@ +# Datewise: session handoff (2026-10-15) + +Read this first in a new session. It covers everything needed to finish the Shopify App Store submission. +Process: follow the `shopify-app-launch` skill (Offerlyst was the first app through it). + +## What Datewise is + +Shopify app **"Datewise: Delivery & Pickup"**: customers choose store pickup, local delivery or shipping, then a date and a time slot, in the cart. Capacity holds, rush days and waitlist, checkout guard on every plan, reminders, run sheets. +Forked from the SlotSure reference build (`../slotsure/`); some features were ported from the old app (`../shipping-app/`). + +## Key facts + +| | | +|---|---| +| Repo | https://git.metatroncube.in/MetatroncubeSoftwareSolutions/datewise.git (branch `main`) | +| Local path | `D:\MCS_Repos\2026\claude_shopify_shipping_app\datewise` | +| Production | https://datewise.metatronlabz.com (VPS `/opt/datewise`, Nginx → `127.0.0.1:3320`; runbook `deploy/README.md`) | +| Shopify app | name "Datewise: Delivery & Pickup", **handle `datewise-delivery`** (`datewise` is taken), client_id `7e7c4baa00daac7fc6909336039d40b5` | +| Partner Dashboard | partners.shopify.com/2451848/apps/435762528257 | +| Dev Dashboard | dev.shopify.com/dashboard/129011982/apps/435762528257 | +| Dev store | `veloxautomotive` (storefront password protected: **the user types the password**) | +| Latest released version | `datewise-delivery-5` | +| API version | 2026-01 (upgrade after launch) | +| Stack | React Router 7, Polaris web components, Prisma + Postgres, JS Functions, theme app extension | + +## Done + +- **Code:** all features working end to end. Fixes this round: CSRF origin behind Nginx (`react-router.config.ts` `allowedActionOrigins`); shop-record self-heal and install race; plan location limit counts switched-on locations; widget empty state, width and contrast; bookings list polish; Shopify `userErrors` logged. +- **Security:** customer PII encrypted at rest (AES-256-GCM via Prisma extension, `app/lib/pii.server.ts`); keyed-hash lookups; **access log** of staff views (`DataAccessLog`); `SECURITY.md`; privacy/terms pages live. +- **Server:** latest code deployed, migrations 0001–0003 applied, **encrypted nightly backups** (cron 3 AM, key `/root/.datewise-backup-key`). +- **Partner Dashboard:** + - **Public distribution** selected (irreversible). + - **Protected customer data:** step 1 done (Name/Email/Phone/Address; reasons Store management + App functionality); step 2 done (16/16). + - **Network access** for UI extensions enabled. +- **Dev store setup:** + - App installed. + - "Shop location" taking bookings; Shopify **Local pickup** on at that location (the user's home address: **never show it unblurred in public assets**). + - Theme block + app embed saved. + - Checkout guard, delivery label and payment rules on. + - **Bogus test gateway** active. +- **Verified:** + - Test order #1001 (pickup Oct 15, 12–1 PM) → booking confirmed, pickup line renamed "Shop location — Thu, Oct 15, 12 PM–1 PM", order attributes and tags. + - Checkout blocked without a time ("Please choose a delivery or pickup time…"). +- **Listing assets (`brand/`):** + - `shopify/app-icon-1200x1200.png`, `shopify/feature-image-1600x900.png`. + - 6 screenshots in `screenshots/listing/` + `alt-text.txt`. + - `LISTING.md` (all listing text + reviewer testing steps). + - `SCREENCAST.md` (14 scenes, captions, YouTube title/description). + +## Left, in order + +1. **Verify the cancellation:** the user cancelled order #1001. Check Datewise → Bookings (Show: All) shows it **cancelled**, and Today's capacity for Oct 15 is back to 0. +2. **Uninstall + reinstall test** (approved): uninstall Datewise from veloxautomotive, reinstall from Dev Dashboard → Install app (**user approves the permissions screen**), confirm data is back and there are no errors. +3. **Fill the App Store listing** (approved): Partner Dashboard → Distribution → Manage submission → listing (English). Use `brand/LISTING.md` and upload the icon, feature image and 6 screenshots with alt text. Demo store URL `https://veloxautomotive.myshopify.com`; **the user types the storefront password.** Save, then check for listing issues. +4. **Screencast** (approved): + - The user records with Snipping Tool (`Win+Shift+R`) over the page area; Claude drives Chrome through `brand/SCREENCAST.md`, injecting a caption div per scene (see the skill's Offerlyst example). + - Hide cookie banners and popups with JS; **never click Accept**. + - At the payment step **the user** enters Bogus card `1` (Claude never types card numbers). + - Check whether the "Claude is controlling the browser" banner is in-page (hide with JS) or Chrome UI (record the page region only / F11). + - The user uploads to YouTube **Unlisted**, "not made for kids", and sends the URL; paste it into the listing's screencast field. +5. **Pre-submit gate** (skill Phase 10): + - Run the `app-store-review` self-check. + - Confirm `curl` against prod (no shop-domain form on `/`, privacy/terms 200). + - Confirm `shopify app deploy` is current. + - Testing instructions have no placeholders; the screencast URL opens signed-out. + - Emergency contact is set. + - Then **ask the user for an explicit yes** before clicking **Submit for review**. + +## Known notes / follow-ups (not blockers) + +- Theme check warns `AssetSizeAppBlockJavaScript` (18 KB raw, ~7 KB gzipped). Non-blocking. +- Shopify's own pickup card shows its "Usually ready in 24 hours" estimate; the setup guide tells merchants to set the shortest pickup time. +- Billing plan test (choose Growth → test charge → **user clicks Approve**) not yet done; worth doing before or with the screencast scene 13. +- Webhook API version 2026-01; upgrade within ~12 months. + +## Rules for the next session + +- Secrets never in chat or Git. The user types every password and card number. +- Ask before irreversible clicks: Submit for review, deleting apps or orders, OAuth/permission approvals not already approved. +- After code changes: `npx tsc --noEmit`, `npx vitest run`, commit + push, then the user runs on the server: `cd /opt/datewise && git pull && docker compose -f docker-compose.yml -f docker-compose.nginx.yml up -d --build app worker`. Extension changes: `CI=1 shopify app deploy --allow-updates --message "..."` from `datewise/`.