feat: integrate Resend for email, add robust CSRF protection, modularize database access, and implement comprehensive Vitest/Playwright testing infrastructure.

Author: classy-giraffe

.env.example

@@ -0,0 +1,27 @@
+# === REQUIRED ===
+# Stripe secret key (starts with sk_live_ or sk_test_)
+STRIPE_SECRET_KEY="sk_test_..."
+
+# Stripe webhook signing secret (from Stripe Dashboard > Webhooks)
+STRIPE_WEBHOOK_SECRET="whsec_..."
+
+# Better Auth secret key (generate with: openssl rand -hex 32)
+BETTER_AUTH_SECRET="change-me-to-a-random-64-char-hex-string"
+
+# Better Auth base URL (your app's public URL)
+BETTER_AUTH_URL="http://localhost:4321"
+
+# === OPTIONAL ===
+# Stripe publishable key (starts with pk_live_ or pk_test_)
+STRIPE_PUBLISHABLE_KEY="pk_test_..."
+
+# Admin email — used to identify the admin account
+ADMIN_EMAIL="admin@buffbook.com"
+
+# Google Analytics 4 measurement ID (defaults to hardcoded ID if not set)
+GA_MEASUREMENT_ID="G-NG1D7QNQS7"
+
+# Resend API key for transactional emails (password reset, verification)
+# Get it from https://resend.com — emails only send if this is configured
+RESEND_API_KEY="re_..."
+

.github/workflows/test.yml

@@ -0,0 +1,53 @@
+name: Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  unit:
+    name: Unit & Component Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: "npm"
+      - run: npm ci
+      - run: npm run test:coverage
+
+  e2e:
+    name: E2E Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: "npm"
+      - run: npm ci
+      - run: npx playwright install --with-deps chromium
+      - name: Run Playwright tests
+        run: npm run test:e2e
+      - uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 7
+
+  build:
+    name: Build Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: "npm"
+      - run: npm ci
+      - run: npm run build

.gitignore

@@ -14,6 +14,7 @@ pnpm-debug.log*
 
 # ── Environment variables ──────────────────────────────────────────────────
 .env
+.env.local
 .env.production
 .dev.vars
 
@@ -32,3 +33,8 @@ Thumbs.db
 
 # ── Logs ───────────────────────────────────────────────────────────────────
 *.log
+
+# ── Testing ─────────────────────────────────────────────────────────────────
+test-results/
+playwright-report/
+coverage/

astro.config.mjs

@@ -279,7 +279,7 @@ export default defineConfig({
   }), sitemap({
     filter: (page) =>
       page !== "https://buffbook.org/admin" &&
-      page !== "https://buffbook.org/api/admin/setup" &&
+      page !== "https://buffbook.org/api/admin/create-admin" &&
       page !== "https://buffbook.org/api/admin/upload-plan"
   }), react()],
 
@@ -289,6 +289,11 @@ export default defineConfig({
     resolve: {
       alias: {
         '@components': resolve(__dirname, './src/components'),
+        '@lib': resolve(__dirname, './src/lib'),
+        '@db': resolve(__dirname, './src/db'),
+        '@pages': resolve(__dirname, './src/pages'),
+        '@layouts': resolve(__dirname, './src/layouts'),
+        '@data': resolve(__dirname, './src/data'),
       },
     },
     plugins: [tailwindcss()],

drizzle/0005_sweet_sheva_callister.sql

@@ -0,0 +1 @@
+ALTER TABLE `user` ADD `admin` integer DEFAULT false NOT NULL;

drizzle/0006_omniscient_speed.sql

@@ -0,0 +1,6 @@
+ALTER TABLE `plan_requests` ADD `sex` text;--> statement-breakpoint
+ALTER TABLE `plan_requests` ADD `steps` integer;--> statement-breakpoint
+ALTER TABLE `plan_requests` ADD `jobType` text;--> statement-breakpoint
+ALTER TABLE `plan_requests` ADD `jobDescription` text;--> statement-breakpoint
+ALTER TABLE `plan_requests` ADD `hasCardio` text;--> statement-breakpoint
+ALTER TABLE `plan_requests` ADD `cardioDetails` text;