# SnowIT IT consulting company — Sarajevo operations, contracts, clients. # Overview # SnowIT Overview IT consulting company — Sarajevo operations, contracts, clients. **Owner:** John **Last Verified:** 2026-02-17 ## Contents To be populated from SnowIT company documentation # Active Tasks > Last Verified: 2026-02-17 | Owner: John # SnowIT — Active Tasks ## Open Tasks ### Medium Priority - **#1213** — Follow up: Has Asmir posted content on LinkedIn? - **#1267** — DNS and email setup for snowit.ba (MX records) ## Recently Completed - **Website services page** — /usluge page live with full service catalog - **OG image fix** — Text rendering problem resolved - **LinkedIn company page** — Created and ready for content - **Sales playbook** — Detailed sales strategy by AI agent (nicksaraev) - **Content calendar** — 30-day content plan by AI agent (marketer) - **Financial model** — 6-month projections by AI agent (finance) - **Market research** — B&H market analysis completed ## Planned Work - **Outreach campaign** — 5 clients in 30 days (delivery delayed) - **Email setup** — Complete DNS configuration - **Content execution** — Post first batch from content calendar - **Lead generation** — Start executing sales playbook # Key Decisions > Last Verified: 2026-02-17 | Owner: John # SnowIT — Key Decisions ## Strategic Decisions ### Market Focus: Bosnia & Herzegovina (2026-02) **Decision:** SnowIT targets B&H market exclusively (snowit.ba domain). **Rationale:** Local market knowledge, language advantage, untapped AI services market. **Implementation:** Website in Bosnian/Serbian/Croatian, local pricing, B&H payment methods. ### Service Packaging (2026-02) **Decision:** Offer 3-tier packages (Digital Presence 800 KM, 2-4h response) **Rationale:** Predictable pricing, easier sales, scalable delivery. **Source:** Financial model from AI agent (finance). ### Content Marketing Strategy (2026-02) **Decision:** 3 posts per week on LinkedIn (12-13 posts/month) **Rationale:** Consistent presence, thought leadership, organic reach. **Source:** Content calendar from AI agent (marketer). ### Partnership Model (2026-02) **Decision:** Collaborate with Asmir as partner/sales contact. **Status:** Active, awaiting LinkedIn activity confirmation. ## Technical Decisions ### Website Stack - Modern web framework (details in repo) - Hosted on vercel/railway/fly.io (pending deploy strategy task #271) - snowit.ba domain with email (@snowit.ba addresses) ### Sales Process - Sales playbook created by AI agent (nicksaraev) - CRM integration planned - Lead tracking via Mission Control ## Operational Decisions ### Pricing Strategy - **Digital Presence package:** 800 KM (2-4h response time) - Additional tiers defined in financial model - Competitive with local market, premium positioning # Project Overview > Last Verified: 2026-02-17 | Owner: John # SnowIT — Project Overview ## What is SnowIT? SnowIT (snowit.ba) is an AI-driven agency focused on the Bosnia & Herzegovina market. It provides software development, design, security, data, infrastructure, and marketing services under one roof. ## Current Status - **Phase:** Active development - **Website:** snowit.ba (live) - **Market:** Bosnia & Herzegovina (B&H) - **Business Model:** Full-service digital agency ## Recent Work - Website launch with services pages (/usluge) - LinkedIn company page creation - OG image optimization (text rendering fix) - Sales playbook development - 30-day content calendar for LinkedIn - Financial model for first 6 months - Market research for B&H market ## Services Offered 1. **Software Development** — Web, mobile, custom applications 2. **Design** — UI/UX, branding, visual design 3. **Security** — Infrastructure security, compliance 4. **Data** — Analytics, business intelligence 5. **Infrastructure** — Cloud hosting, deployment 6. **Marketing** — Digital marketing, content, campaigns ## Tech Stack - **Website:** Modern web stack (details in project repo) - **Hosting:** TBD (see Deploy & Hosting Strategy task #271) - **Email:** snowit.ba domain (DNS/MX setup in progress) ## Contacts - **Partner:** Asmir (asmirmc@gmail.com) - **Status:** Active collaboration, LinkedIn outreach campaign planned ## Key Documents - **Sales Playbook** — Agent-generated detailed sales strategy - **Content Calendar** — 30-day LinkedIn posting schedule (3 posts/week) - **Financial Model** — 6-month revenue projections - **Service Catalog** — Full service offerings at snowit.ba/usluge # Specifications Index > Last Verified: 2026-02-17 | Owner: John # SnowIT — Specifications Index ## Business Documents ### Sales & Marketing - **Sales Playbook** — Detailed sales strategy (AI-generated by nicksaraev agent) - **Content Calendar** — 30-day LinkedIn content plan (AI-generated by marketer agent) - **Financial Model** — 6-month revenue/cost projections (AI-generated by finance agent) - **Market Research** — B&H market analysis ### Service Catalog Located at snowit.ba/usluge: 1. Software Development 2. Design Services 3. Security Consulting 4. Data Analytics 5. Infrastructure Management 6. Digital Marketing ## Technical Documents ### Website - **Stack:** Modern web framework - **Hosting:** TBD (Deploy & Hosting Strategy task #271) - **Domain:** snowit.ba - **Email:** MX records setup (task #1267) ### Infrastructure - DNS configuration (in progress) - Email setup (in progress) - Deployment pipeline (pending) ## Planning Documents - **30-Day Outreach Plan** — 5 clients target (delivery delayed) - **LinkedIn Strategy** — Content themes, posting schedule - **Pricing Strategy** — Package definitions, competitive analysis # SnowIT Tenant Tree (2026-05-15 migration) # SnowIT Tenant Tree (2026-05-15 migration) ## Legal Boundary **SnowIT BA is an independent legal entity.** ALAI Holding AS provides technology and operations support under service agreement. ALAI has ZERO financial share/equity in SnowIT BA. *CEO directive 2026-05-15:* "SnowIT BA = independent legal entity. ALAI = tech-only ZERO financial share." ## New Canonical Layout As of 2026-05-15, SnowIT BA operates under dedicated tenant tree: ``` ~/tenants/SnowIT-BA/ ├── company/ # Corporate operations │ ├── state/ # System state, sessions (was ~/clients-external/snowit-state) │ ├── finances/ │ ├── contracts/ │ └── reports/ ├── legal/ # Legal documents, compliance ├── contacts/ # CRM, stakeholder data ├── calendar/ # Events, deadlines ├── mail/ # Email archives, campaigns ├── forms/ # Templates, intake forms ├── templates/ # Document templates ├── web/ # Web properties │ └── snowit-site/ # Main repo (was ~/clients-external/snowit-site) └── clients/ # SnowIT client projects ``` ## Migration Summary ### What Moved - `~/clients-external/snowit-site` → `~/tenants/SnowIT-BA/web/snowit-site` - `~/clients-external/snowit-state` → `~/tenants/SnowIT-BA/company/state` - Client reference symlink: `~/business/ALAI-Holding-AS/clients/SnowIT` → `~/tenants/SnowIT-BA/_external-tenant-snowit-reference` ### What Stayed in ALAI Tree - `~/business/ALAI-Holding-AS/products/SnowIT/linkedin-cadence/` — ALAI internal tool (CEO directive: stays in ALAI tree) ### Hard Cutover Confirmed Both old directories removed: - `~/clients-external/snowit-site` → *No such file or directory* - `~/clients-external/snowit-state` → *No such file or directory* ## Validation Evidence **Status: PASS (9/9 criteria)**
IDCriterionStatusEvidence
V1snowit.ba serves HTTP/2 200✓ PASS/tmp/proveo-100723/curl-snowit.txt
V2enterprise.snowit.ba serves HTTP/2 200✓ PASS/tmp/proveo-100723/curl-enterprise.txt
V3Playwright screenshot rendered✓ PASS/tmp/proveo-100723/snowit-landing.png (124KB)
V4Vercel projectId intact✓ PASS/tmp/proveo-100723/vercel-project.json
V5LaunchAgents operational✓ PASS3 daemons loaded, path-independent
V6Git remote correct✓ PASSgit@github.com:snowitba/snowit-site.git
V7Repo-local \[user\] config removed✓ PASSGlobal ~/.gitconfig inherits correctly
V8No live functional refs to old path✓ PASS20 mentions are historical/spec/memory only
V9Hard cutover confirmed✓ PASSBoth old directories removed
## Open Items ### Non-Blocking - **DEPLOY-MAP.md schema upgrade** — Line 32 has stale path `~/projects/snowit-site`. Kelsey-hightower blocked by `blueprint-schema-validator` pre-hook. Requires DEPLOY-BLUEPRINT v2 compliance upgrade. Separate MC opened for schema migration. ## References - **MC:** #100723 - **ADR:** [ADR-026 SnowIT Tenant Tree](https://docs.alai.no/books/system-architecture/page/adr-026-snowit-tenant-tree) - **Spec:** ~/system/specs/snowit-tenant-migration-2026-05-15.md - **Executor:** kelsey-hightower (FlowForge) - **Validator:** angie-jones (Proveo) - **Supersedes:** anvil-fs-d2 (Phase D restructure now complete for SnowIT) - **Canonical Registry:** ~/system/specs/canonical-registry.md # SEO Readiness Portal Cloud Migration — 2026-06-01 # SEO Readiness Portal Cloud Migration — 2026-06-01 Date: 2026-06-01 Owner: john Verdict: DONE ## Live state verified (2026-06-01 05:31 UTC) - `curl -sI https://seo-tools.alai.no/api/health` → HTTP 302 to `alai-no.cloudflareaccess.com/cdn-cgi/access/login/...` (CF Access enforced, no anonymous access) - `curl -sI https://seo-readiness-alai.azurewebsites.net/api/health` → HTTP 403 `x-ms-forbidden-ip: 46.46.245.169` (Azure origin lock to Cloudflare IPs) No traffic to John local host: cloudflared route for `seo-tools.alai.no` and `seo-tools.snowit.ba` set to `http_status:503`. ## Architecture (now) Browser → Cloudflare Access (`seo-tools.alai.no`, alai-no team) → Cloudflare proxied DNS → Azure App Service Linux container `seo-readiness-alai` (Sweden Central, rg `rg-seo-readiness-prod`, asp `asp-seo-readiness-prod` B1) → Next.js standalone in `alairegistry.azurecr.io/seo-readiness-portal:20260531-cloud` (digest `sha256:16c8a40a...`) → persistent `/home/data/workspace.json` App access mode: `SEO_PORTAL_ACCESS_MODE=cf-access`, trusted header `CF-Access-Authenticated-User-Email`, allowed domains `snowit.ba,alai.no`, extra allowed `alembasic@gmail.com`. ## Evidence - Deploy summary: `/tmp/alai/seo-readiness-cloud-migration-20260531/cloud-deploy-summary.md` - Local-disabled proof: `/tmp/alai/seo-readiness-cloud-migration-20260531/local-disabled-evidence.txt` - Azure build + deploy: `azure-build.log`, `azure-webapp-deploy.log`, `azure-hostname-corrected.log`, `azure-role-settings.log` - Origin lock: `azure-access-restrict-cloudflare.log`, `azure-access-restrict-smoke.log` - DNS upsert: `cf-dns-upsert.log` - Public smoke: `public-cloud-smoke.log` - Origin smoke: `azure-smoke.log` - Authenticated UAT (alem@alai.no, end-to-end: partners → add client → intake → audit → report → markdown export): `uat-alem/seo-cloud-uat-result.json` + 8 PNG screenshots `uat-alem/01-cf-login.png` … `08-export.png` - Lesson memo: `lesson-seo-cloud-origin-lock-20260531.md` ## Docs corrected (no localhost as final target) - `DEPLOYMENT-CLOUD.md` L7 — explicit "must not be served from John/local localhost" - `DEPLOYMENT-INTERNAL.md` L7, L26, L102 — Docker steps marked local-dev only; cloud origin required for production; explicit "Do not route `seo-tools.*` to `http://127.0.0.1:*` or any localhost address" - `README.md` L130 — "Azure App Service Linux container origin, not John/local localhost" - `BUILD-BLUEPRINT.md` L54, L70 — Azure runbook section + CEO correction recorded ## Rollback If Azure origin needs rollback: 1. Revert Web App container image: `az webapp config container set -g rg-seo-readiness-prod -n seo-readiness-alai --container-image-name alairegistry.azurecr.io/seo-readiness-portal:` 2. CF Access policy and DNS remain unchanged; no public bypass introduced. 3. Do NOT re-enable cloudflared local route — that violates the CEO correction. ## Open follow-ups (separate MCs, not blockers) - Postgres swap for `/home/data/workspace.json` (durable multi-user storage) — pre-req for external product use. - `seo-tools.snowit.ba` DNS/zone provisioning (currently 503). - Bind Azure custom hostname TLS managed cert (currently CF terminates). ## CEO scope check - "Move off John/local host to real cloud" → DONE (Azure App Service) - "Cloudflare Access trusted-header preserved" → DONE (`SEO_PORTAL_ACCESS_MODE=cf-access`) - "No public unauthenticated access" → DONE (302 to CF Access login on unauth) - "Custom domain toward seo-tools.alai.no" → DONE (CNAME + asuid TXT + Azure binding) - "Concrete deploy URL/origin" → DONE (`seo-readiness-alai.azurewebsites.net` behind `seo-tools.alai.no`) - "UAT evidence" → DONE (alem-authenticated screen-recorded flow) - "Rollback" → documented above - "Fix docs that recommend local host" → DONE (4 docs updated) ## MC / evidence references - MC task: #102653 - Local closure artifact: `/tmp/alai/seo-readiness-cloud-migration-20260531/CLOSURE-102653.md` - Cloud deploy summary: `/tmp/alai/seo-readiness-cloud-migration-20260531/cloud-deploy-summary.md` - Authenticated UAT result: `/tmp/alai/seo-readiness-cloud-migration-20260531/uat-alem/seo-cloud-uat-result.json` - Origin restriction smoke: `/tmp/alai/seo-readiness-cloud-migration-20260531/azure-access-restrict-smoke.log` - P2P verifier PASS: `mesh-thr-50503688-7de8-489c-96ca-3d7d1a165dc2` --- ## See Also — Agent Runbook The canonical end-to-end workflow runbook (intake to John deep-report, anti-pitfalls, trigger checklist): - [SEO Pipeline — Portal Intake to John Deep-Report (agent runbook)](https://docs.alai.no/books/seo-readiness-portal/page/seo-pipeline-portal-intake-john-deep-report-agent-runbook) # QODY CI-CD pipeline fixes 2026-07-08 (MC 105057+105059) # QODY CI/CD demo pipeline fixevi — 2026-07-08 (MC #105057 + #105059) Dokazano zelenim pipeline run **#330** (commit 747c100, deployDemo=true). John live-verifikovao timeline + endpointe; Proveo nezavisna tool-verifikacija PASS. ## Kontekst Run #328 (buildx fail) i raniji Trivy fail (#327) blokirali QODY demo deploy. Oba uzroka su bili **pre-postojeće pipeline rupe**, ne aplikacijski/Monri kod. ## Fix #105059 — idempotent buildx (Build_Images) - **Simptom:** run #328 Build_Images `ERROR: existing instance for "qody-builder" but no append mode`. - **Uzrok:** azure-pipelines.yml demo stage (lin 881) radio goli `docker buildx create --use --name qody-builder`; persistent self-hosted agent (qody-forge-1) zadrži builder instancu između runova → kolizija. - **Fix:** backport idempotentnog patterna s prod stagea (MC #104911): `docker buildx use qody-builder 2>/dev/null || docker buildx create --name qody-builder --use --driver docker-container` (lin 886). ## Fix #105057 — Trivy verify-not-fetch (Security_Image_Scan) - **Simptom:** Trivy install pao na qody-forge-1: `mkdir /usr/local/bin: Permission denied`. - **Uzrok:** curl-based installer piše u /usr/local/bin, koji ne postoji na Apple Silicon self-hosted agentu i traži sudo (kojeg agent nema). - **Fix:** verify-not-fetch — koristi već-instalirani Homebrew Trivy 0.72.0 (`export PATH="/opt/homebrew/bin:$PATH"; which trivy`), isti pattern kao druga dva Trivy stepa (MC #104917). **FORGE agent nije diran.** ## Dokaz (run #330) | Stage | Rezultat | |---|---| | CI Gates | succeeded | | Build_Images → ACR | succeeded (buildx fix radi) | | Security: Trivy image scan (4 images) | succeeded (Trivy fix radi) | | Deploy → QODY demo ACA | succeeded | | Deploy_Prod | skipped (ispravno — nije main) | Timeline: 165 succeeded / **0 failed** / 6 skipped (prod). Live (John curl): `demo.api.qody.ba/health` → 200 (db.connected, RLS PASS); `demo.app.qody.ba` → 200. Evidence: ~/system/evidence/105048/pipeline-330-timeline.json + verdict-105057.json + verdict-105059.json # QODY Monri WebPay integracija — E2E dokaz (MC 105048) # MC #105048 - Monri WebPay Integration - Final E2E Proof ## Result: SUCCESS - real sandbox payment completed end-to-end, guest-facing ## error page RESOLVED (no longer cosmetic) **Orders proven paid (3 separate live sandbox transactions this session):** - e0692760-b2c1-4120-83b9-7480cee6ef00 - payment_status=paid, status=submitted, total=9.9450 BAM (see order-paid-db-proof.txt - first successful E2E run, before the 405 fix) - 7419eee0-ef1d-4c64-b9f2-2724bec0d66c - payment_status=paid (verified via psql during 405-fix re-verification round 1) - 6bf5ef27-9b8a-4a28-9c80-e84d5e8d48bc - payment_status=paid (verified via psql during 405-fix re-verification round 2, final confirmation the same-origin redirect fix works with no regression to the payment flow itself) ## Flow proven live (Playwright, e2e/monri-sandbox-checkout.test.js) 1. Guest lands on demo.app.qody.ba (venue "kafana", Table 1) 2. Adds item to cart (Brusketa, 8.50 BAM) 3. Submits order (POST /guest/order - 200) 4. Proceeds to checkout, selects "Plati odmah" (pay now) 5. POST /guest/payment/intent - 200, provider=monri, real Key-Vault-sealed credentials (not placeholder) 6. Monri Lightbox script (class="lightbox-button", ch_* customer fields) renders "Pay with card" button - screenshot 07 7. Clicks through to Monri's real hosted iframe (ipgtest.monri.com/v2/payment/.../form) - screenshot 08 8. Fills real Monri sandbox test card (4058400000000005, exp 12/30, cvv 123) via keystroke simulation (pressSequentially, not fill - masked-input fix) - screenshot 09 9. Submits - card validates, Monri approves, triggers redirect - screenshot 10 10. Monri's server-to-server Callback (webhook) arrives at /webhooks/payment/monri, resolves venue, verifies signature (valid SHA512(merchant_key+body) digest, WP3-callback scheme), marks payment succeeded - confirmed via qody-api logs (200 OK, 36ms) 11. Order flips to payment_status=paid in Postgres - confirmed via psql (3x, see order IDs above) ## 405 Not Allowed after payment - RESOLVED (was previously mis-called "cosmetic") This was correctly flagged as a real launch-blocker, not cosmetic: a real guest who pays would have seen nginx's raw "405 Not Allowed" error page immediately after paying - even though the order was genuinely marked paid via the webhook, the guest had no way to know that. This is the same "deploy 200 hides dead flow" trap this session avoided elsewhere, applied to the guest-facing side. Root cause and fix, found through 3 live-verified iterations (code review alone could not have caught any of these - Monri's actual runtime behavior differs from what the docs literally show): 1. Attempt 1 (insufficient): added preventDefault() in a 'submit' event listener on the payment form. Deployed clean, but Monri's lightbox.js calls form.submit() programmatically, which bypasses all 'submit' event listeners entirely (only .requestSubmit() fires them) - a genuine DOM API quirk, invisible from code review. 2. Attempt 2 (partial fix, new bug): pointed the form's action at a real server-side route per Monri's documented pattern. This fixed the 405, but introduced a cross-origin CORS 403 (demo.app.qody.ba POSTing to demo.api.qody.ba) - Ktor's CORS plugin rejects the Origin header on a plain HTML form POST even when the origin is in the allowed list. 3. Attempt 3 (working, verified live 2x): made the redirect target same-origin - added an nginx location = /payment/monri-return { return 303 /; } block on the guest app's own domain, and pointed the form's action at the relative path /payment/monri-return. Verified via curl -X POST https://demo.app.qody.ba/payment/monri-return -> 303, and via 2 full live Playwright E2E re-runs: card validated, payment succeeded, redirect worked (no 405, no 403, FINAL_URL: https://demo.app.qody.ba/), and both resulting orders (7419eee0, 6bf5ef27) confirmed paid in Postgres. Guest sees the normal venue menu after redirect, not an error page. The order is genuinely paid. Guest does not yet see an explicit "payment confirmed" screen on that same redirect (they'd need to re-check the order status manually, e.g. via the handover QR flow) - that gap is a separate, non-blocking UX improvement, tracked as MC #105069 (session-resume across the redirect so OrderStatusPage's existing confirmation UI shows automatically). A candidate fix for #105069 is already built and committed (commit 0a525e5, branch feat/qody-monri-checkout-105048) but is out of scope for #105048's launch-blocker bar per team-lead decision. ## Negative webhook test (webhook-negative-test.txt) POST /webhooks/payment/monri with Authorization: WP3-callback -> HTTP 400 {"error":"Invalid Monri webhook signature"} ## Bugs found and fixed during this live E2E session (none catchable by ## static review or isolated unit tests - required a real transaction against ## Monri's actual sandbox server): 1. class="lightbox-button" missing on injected script tag (c94a640) 2. ch_full_name/ch_address/ch_city/ch_zip/ch_country/ch_email/ch_phone customer fields required by lightbox.js validation (caf30df) 3. Digest must use merchant "Key" (Kljuc), not authenticity_token - inverted from the isolated docs example (e38e9c0) 4. "N/A" placeholder rejected as invalid ch_address/ch_phone (1132edd) 5. ch_phone must be local format, no country-code prefix (74ae0ff) 6. 405 Not Allowed post-payment - 3-round fix, see section above (3c296b8, d2e1d78, d38935e) 7. Test-harness-only: Playwright .fill() bypasses Monri's input mask; switched to pressSequentially() (b1bda91, e2e test file) ## Infra issues found and fixed during this session (separate from Monri code) - CI pipeline buildx builder not idempotent on demo stage (#105059, fixed) - Trivy install failing on qody-forge-1 self-hosted agent (#105057, fixed by another parallel session) - MFE Container Apps (qody-guest/admin/staff-kitchen) stuck on stale canary revisions since 2026-07-06, silently ignoring all new deploys (#105065, flagged separately) - Zombie revision accumulation causing Postgres connection pool exhaustion (qody-api crashed once during this session; fixed by deactivating 9 stale revisions on qody-api, 6 on qody-guest, 4 on qody-staff-kitchen - flagged as a systemic deploy-runbook gap, separate ticket recommended) ## Merchant configuration change (Monri sandbox, Asmir's account) Set "Callback URL" on merchants/4988 (SnowIT) to https://demo.api.qody.ba/webhooks/payment/monri - was blank before, which is why no webhook could ever have arrived prior to this fix. This is the webhook delivery destination, required for any Monri integration to work at all, sandbox or production. Full detail, including confirmation that Asmir's password was NOT touched: see asmir-account-changes.md. ## Backend test suite 277/277 tests passing, 0 failures, 0 errors - re-verified fresh this turn via ./gradlew test (JDK 21, apps/api), BUILD SUCCESSFUL, all tasks UP-TO-DATE (no backend/Kotlin changes since the last full run - commit 0a525e5 only touches frontend TypeScript). Cross-checked against CI pipeline run 330, which independently ran "Backend: Gradle tests (Java 21)" -> succeeded and "Backend: integration tests (Testcontainers)" -> succeeded. ## Final commit and branch Branch: feat/qody-monri-checkout-105048 Latest commit: 0a525e5 (session-resume candidate fix for #105069 - not required for #105048's launch-blocker bar, but harmless and already built) Full commit list (oldest to newest): - dfd71fc - feat(payments): wire Monri WebPay into guest checkout - f31803d - fix(payments): correct Monri digest/signature per verified docs, venue-aware webhook, fail-closed (Proveo review round 1 fixes) - 6b3b535 - docs(env): add MONRI_* stubs to .env.example - 86f5508 - fix(ci): Security_Image_Scan Trivy install fails on qody-forge-1 (#105057) - 747c100 - fix(ci): idempotent buildx create for demo build stage (#105059) - c94a640 - fix(guest): Monri lightbox.js requires class="lightbox-button" on script tag - caf30df - fix(payments): add Monri lightbox.js required ch_* customer fields - e38e9c0 - fix(payments): Monri digest must use merchant key, not authenticity token - 1132edd - fix(payments): Monri rejects placeholder ch_address/ch_phone as invalid - 74ae0ff - fix(payments): Monri ch_phone must be local format, no country-code prefix - b1bda91 - test(e2e): add Monri sandbox checkout Playwright test - 3c296b8 - fix(guest): prevent 405 error page after successful Monri payment (attempt 1) - d2e1d78 - fix(payments): Monri Lightbox form needs a real server-side action URL (attempt 2) - d38935e - fix(guest): Monri return redirect must be same-origin, not cross-origin API (attempt 3, working) - 0a525e5 - fix(qody-guest): resume order-in-progress across the Monri redirect (candidate for #105069, not required for #105048) # QODY Admin UX Redesign — ZAVRSEN (MC 105067) # QODY Admin + Super-Admin UX Redesign — ZAVRŠEN (MC #105067) **Datum:** 2026-07-08 | **Vodio:** Vizu (Brad Frost + Lea Verou), UX validacija Angie Jones (Proveo), sigurnost Parisa Tabriz (Securion) **Živo:** demo.admin.qody.ba (revizija qody-admin--uxfinal801b2d7, 100% traffic) | Branch feat/qody-admin-design-system-105067, commit 801b2d7 ## Root cause (zašto je bilo loše) Onboarding wizard i super-admin (#104856) vođeni kao "Petter Graff lead" — **arhitekta, ne dizajner**. Nijedan UI/UX dizajner nikad nije bio glavni; UI bio Phase-2 dodatak inženjerskog toka. Rezultat: **nijedan design system** — 19 admin views (11.660 linija) svaki hand-roll inline stilove; super-admin "kreiraj lokal" bio flat 7-poljni 480px modal bez wizard strukture ni a11y. ## Šta je urađeno (CEO odluka: čisto frontend, backend contract netaknut) **Tier A — design system + super-admin wizard:** - Novi shared design system (apps/admin/src/ui/): Button, Modal (focus-trap + role=dialog + ESC), StatusPill (kanonski status→boja), Card, Table, Field, Switch - Super-admin "kreiraj lokal" → guided 3-koračni wizard (Poslovanje→Vlasnik→Pregled) + success dialog - Uklonjeni mrtvi no-op elementi (provisioningState kolona — bonus: pendingOnly filter bio BUG koji bi skrivao svaki merchant) **Tier B — admin dashboard:** VenuesView, MenusView (popravljeni pravi focus-trap/ESC na modalima), SettingsView + StaffView + ReportsView (bio 100% raw hex) + TablesView — svi na design system. **Tier C — super-admin konzola:** Transactions/Refunds/Subscriptions/Audit tabovi → q-data-table + Button komponenta, ~40 raw hex → tokeni. ## Verifikacija (sva 3 gejta + bugfix) - **Securion PASS ×2**: contract netaknut (api.ts backend diff prazan, 14 onClick handlera byte-identical, 0 dangerouslySetInnerHTML, 0 secret logova) - **Angie Jones UAT**: Tier A PASS ("clears smiešan→top bar"). Tier B+C CONCERNS → našla 2 buga (StaffView reset-password id/staffId mismatch, VenuesView grid overlap) prije sign-off-a - **Bugfix (801b2d7)** + Angie re-verify: B1 PASS (reset-password POST na pravi UUID → 200), B4 PASS (geometrijski overlap check 0 parova), #4 stale banner PASS ## Napomene - Deploy: sve preko az acr build (lokalni Docker hung + git-author-guard #104976 blokira pushove) - Preskočeno (opciono): raw "reports.advanced" label (pre-postojeći tech tag, ne regresija) - Evidence: ~/system/evidence/105067/ (plan, securion-verify ×2, uat + uat-bc + uat-bc-reverify, screenshotovi) # QODY Phase 1 Provisioning Gate + Integracioni Deploy (MC 105075+105077) # QODY Phase 1 Provisioning Gate + Integracioni Deploy — ZAVRŠENO (MC #105075 + #105077) **Datum:** 2026-07-08 | **Live demo:** rg-qody-demo, revizije int105077 (api--int105077b, guest--int105077, admin--int105077), sve 100% traffic, sve 200. ## Šta je deployano (integrisano, jedan konzistentan build) Spojene 3 feature-grane u jedan qody-api/guest/admin build (merge branch feat/qody-105077-integration, commit 27a8250): - **Monri plaćanje** (#105048) — per-venue, webhook, potpis - **SSE payment confirmation** (#105069 BUG B) — gost vidi "plaćeno" potvrdu - **nginx :8080 fix** (#105069 BUG A) — gost više ne vidi chrome-error nakon plaćanja - **Provisioning gate** (#105075) — concierge model - **Admin redesign** (#105067) + owner lock screen + super-admin wizard Migracije: V25 → V26_monri → V27_provisioning_gate (čist redoslijed). ## Concierge model (CEO odluka 2026-07-08) — LIVE - Super-admin (SnowIT) postavlja SVE (org+venue+meni+stolovi+QR+plaćanje) preko 6 superadmin-scoped ruta - Vlasnikov admin ZAKLJUČAN ("u pripremi") dok venue nije ACTIVE; server-side gate 403 na owner /admin/* - Cash-only može ACTIVE bez Monri (Monri opcija, ne uslov) - activate re-validira checklist server-side (meni+stolovi/QR+radno vrijeme+payment-decision) ## Proveo cross-role UAT + adversarial bypass — PASS 6/6 (raw HTTP, teži od browsera) 1. Provisioning flow end-to-end: onboard→invite→menu→tables→hours→cash-only→activate ACTIVE ✓ 2. Checklist enforcement: activate prije kompletiranja → 422 missing[] (server-side) ✓ 3. Owner lock: 403 non-ACTIVE, 200 nakon aktivacije ✓ 4. **Adversarial bypass (kritično): owner JWT → /admin/* non-ACTIVE = 403; owner → /superadmin/* = 403 (ne može escalirati); impersonation PENDING = blokiran** ✓ 5. Regresija: Monri webhook 400 (živ), guest menu, health/RLS PASS — NEregresirano ✓ 6. Cash-only reaches ACTIVE bez Monri ✓ ## Incident tokom deploya (uhvaćen, vraćen) Prvi pokušaj: api build iz pogrešnog konteksta (repo-root umjesto apps/api) → deployao mrtav image → qody-api health 000 → rollback na 0000080 (Monri) u minuti → rebuild iz ispravnog apps/api konteksta → uspjeh. Ranije: gate-only api (iz main, bez Monri) regresirao Monri → rollback. Pouka: qody-api build-grana MORA imati sve žive feature; api build kontekst = apps/api. ## Follow-up (ne-blokirajuće) - Concern 4c: impersonation PENDING vraća generic 404 (short-circuit prije guard poruke); security property drži (bez tokena), ali poruka ne stiže — developer 5min trace. - Demo cleanup (#105068): UAT-105077-Venue (2f21abce), UAT-105077-Venue-B (31605010) suspended; + stray #105067 (Basic Cafe ...003, UAT-105067bc f7028415). - #105077 merge NIJE pushan na azdo (guard #104976) — image-only deploy; kod na feat/qody-105077-integration lokalno. Evidence: ~/system/evidence/105077/uat/uat-report.md # QODY Demo — MASTER Bug Registar (pun cross-role UAT 2026-07-08) # QODY DEMO — MASTER BUG REGISTAR (kompletan cross-role UAT, 2026-07-08/09) 8 agenata (4 happy-path po ulozi + 4 kombinatorne matrice). 7/8 gotovo; kitchen KDS pending (blokiran reset-pw bugom — sam po sebi nalaz). Evidence po agentu u ~/system/evidence/uat-full/{owner,guest,superadmin,matrix-A-perms,matrix-B-state,matrix-C-payment,matrix-D-edge}/. ## 🔴 CRITICAL / BLOKERI (5) **C1 — Cross-ORG data leak (#105076)** [backend, sec] — POTVRĐEN LIVE iz 2 ugla (matrix-A + owner). GET /admin/venues + /admin/venues/{id} vraćaju SVE venue-ove SVIH organizacija bilo kojoj autentifikovanoj sesiji (bilo koja uloga, nema role/tenant check). Leak: fee, branding, slug cross-org. Root: AdminRoutes.kt:74-99 (fix pattern već na PUT 101-118). NAJVIŠI prioritet. **C2 — Reset-password modal PRAZAN** [frontend] — owner + kitchen UAT. POST /admin/staff/{id}/reset-password vraća 200 s temporaryPassword, ali UI modal display div prazan, "Kopiraj" kopira ništa. Owner nema način dobiti novi pw. (Ranija "PASS" verifikacija gledala network 200, ne UI prikaz — lekcija.) Blokirao i kitchen UAT. **C3 — Monri plaćanje mrtvo** [external/config] — guest UAT. Monri injected iframe.js pravi malformed URL "ipgtest.monri.com:/v2/" (kolon bez porta) → iframe se ne učita → guest ne može platiti, checkout dead-end. Naš kod (lightbox.js src) ispravan. Treba istražiti Monri merchant config/authenticity token (možda loš base URL u Monri postavkama). **C4 — Add-to-cart prekriven AI-chat FAB-om** [frontend] — guest UAT (mobile). "DODAJ" dugme fizički ispod "Pitajte nas" FAB-a → tap otvara chat umjesto dodavanja. Blokira naručivanje na telefonu. Fix: z-index/pozicija. **C5 — SUSPEND je lažan** [backend] — matrix-B. suspend samo set deleted_at, NE provisioning_state (koji gate provjerava). Suspendovan venue: owner postojeća sesija radi (200), GUEST NASTAVLJA naručivati (GuestRoutes bez provjere). SUSPENDED+PENDING_PAYMENT stanja dokumentovana ali nikad build-ana. ## 🟠 MAJOR (3) **M1 — Suspend/activate bez potvrde** [frontend/superadmin] — misklik mijenja live status merchanta, nema "jesi siguran", nema undo. **M2 — Audit log ne bilježi activate/suspend** [backend] — status se tiho flipne bez traga (kombinovano s M1 = opasno). **M3 — Raw error poruke korisniku** [frontend/backend] — (a) dupli slug → raw PSQLException 500 u UI (leak DB constraint, izgleda kao crash); (b) super-admin wrong-pw → raw JSON "401:{...}" u banneru; (c) merchant wrong-pw → netačno "session expired". Login banner postoji (Vizu fix) ali sadržaj sirov. ## 🟡 MEDIUM (5) - MED1 — raw i18n/feature-flag keys leak u UI: MENU.MODIFIERS, BRAND.WHITELABEL ("brand.whitelabel: ukljuceno"), REPORTS.ADVANCED (shared component bug) - MED2 — Monri pay dugme hardcoded EN (data-language="en"), ignoriše locale - MED3 — nema dup-table-label check (2 stola isto ime, različit QR = floor confusion) - MED4 — nema max-length org/venue name (500 char overflow u review + listi) - MED5 — /guest/splitbill 403 + /guest/payment/intent 404 na svaki guest load (leftover Stripe-era + feature-flag) ## 🟢 LOW (7) - merchant tabela overflow 6236px @1440 (Akcije off-screen) · nema edit menu-itema · AI describe 404×18 · Stripe Connect ne lokalizuje + stale "2%" fee · dashboard quick-actions ne prevode (HR/SR) · pretplate venue-ID identični truncated · search bez empty-state · invite venueSlug ne validiran vs token (ne bypass) ## ČISTO / RADI (verifikovano) Gate PENDING→ACTIVE airtight (12 ruta 403, cash-only ACTIVE radi); XSS escaped svuda; price/email/empty validacija; JWT verify + brute-force lockout; superadmin rute odbijaju owner (403); menu CRUD; QR gen/regen; operating hours; tips; CSV export; 4-jezik switch (osim navedenih); logout/session invalidation; modal focus-trap/ESC. ## HOUSEKEEPING ~15 leftover UAT test orgova + XSS-probe org u demo listi → cleanup (#105068). ## BATCH FIX PLAN (nakon konsolidacije → jedan merge → jedan deploy → re-UAT) - **CodeCraft backend:** C1 (tenant-scope 2 GET), C5 (suspend→provisioning_state + GuestRoutes block + session revoke), M2 (audit activate/suspend), M3a (dup-slug friendly error), MED5 (guest 403/404), reset-pw response već radi (C2 je FE) - **Vizu frontend:** C2 (reset-pw modal display), C4 (add-to-cart z-index), M1 (confirm dialog suspend/activate), M3b/c (friendly login/error poruke), MED1 (i18n keys), MED2 (Monri locale), MED3/4 (validacije) + VEĆ SPREMNO: invite-display (7609855), login-tabovi (2c71867) - **Istražiti:** C3 (Monri malformed iframe URL — merchant config/authenticity token) - **Cleanup:** #105068 (leftover test data)