# Implementation audit

Baseline: Laravel 12, Filament 5, Blade/jQuery/Bootstrap, Laravel Mix, MySQL 8 in Docker. Local home and admin login respond with HTTP 200. No production writes are authorized.

## Architecture and entities

- Public routes use client controllers, listing/view-data services, Blade templates and a global view composer.
- Admin uses Filament resources; media and invoice endpoints also exist outside the panel.
- Users use Spatie roles (`admin`, `client`). Filament's user contract is missing, causing non-local 403 responses.
- Products belong to one product category. Categories already have `parent_category_id`; children and breadcrumb relations are incorrect.
- Blogs, reviews, media and Filament editor already exist, including Git history. Reuse these rather than recovering obsolete code.
- `menus` currently stores menu items, while public navigation is generated from categories in the view composer.
- Guest carts use an encrypted cookie; authenticated carts use database rows. Checkout creates orders/invoices and requests SEP tokens.
- SEO uses layout variables, SeoSchemaService and SitemapGenerator. Product/category routes are `/products/{category}/{slug}` and `/products/{category}`; blog routes use `/blogs`.

## Migrations and tests

Existing migrations cover users, categories, products, menus, blogs, reviews, orders, invoices and payments. New schema must extend these structures. Historical price migration is destructive if replayed on imported products; verify migration history before snapshot upgrades.

Existing tests cover price imports, product matching and PDF/CSV export; no dedicated admin, cart, blog, menu or SEO regression suite exists. Some tests reference moved spec fixtures. Use an isolated test database, never the imported snapshot.

## Bug register

| ID | Severity | Reproduction / cause | Required verification |
| --- | --- | --- | --- |
| AUTH-01 | P0 | Admin request outside local fails because User lacks FilamentUser | Active admin succeeds; inactive/client denied in all environments |
| AUTH-02 | P0 | Import endpoints mutate data through unauthenticated GET | Admin-only POST with CSRF |
| PAY-01 | P0 | Callback marks invoice/order paid before bank verification | Verification failure/mismatch never marks paid; replay idempotent |
| PAY-02 | P0 | Address and old-invoice ownership not enforced | Cross-user access denied |
| CAT-01 | P1 | Wrong children relation and nonexistent parent breadcrumb relation | Recursive ancestry, cycle rejection and safe deletion |
| BLOG-01 | P1 | Public listing/detail exposes inactive posts; search uses product fields | Publication scope and title/content search |
| SEO-01 | P1 | Fabricated ratings and unsupported stock attribute in schema | Real reviews and inventory only |
| SEO-02 | P1 | Missing products/categories return 200 | Real 404 and canonical redirect coverage |
| CART-01 | P1 | Quantity update tests nonexistent product quantity; missing image dereference | Stock limits, absent media, stale cart |

## Reuse and rollout

Reuse Filament RichEditor/MediaPicker, HasMedia, category/blog services, existing cart totals and payment DTOs. Deliver authorization fix independently without a migration. Feature migrations are additive, accompanied by validation, backfill, regression tests and deployment notes. Local external delivery/payment must use fakes before exercising checkout.

## Verification update — 2026-09-17

- AUTH-01/02: environment-independent active-admin access, actual production-mode login, persistent Livewire checks, protected imports and resource rendering pass automated tests.
- CAT-01/BLOG-01/SEO-01/02/CART-01: feature regression tests pass; desktop/mobile browsing and guest cart interactions produce no JavaScript exceptions.
- PAY-01/02: mocked verification, amount mismatch, replay/stock-once and ownership tests pass. Real SEP verification remains a release gate, not a verified production integration.
- COUPON-01 (P1): lookup used a nonexistent relation, discount enum names differed from the database, and fixed-amount/validity/usage checks were missing. Repaired and tested, including rollback on token failure. Coupon use is reserved when the order gets a token; cancellation recredit is not automatic.
- REVIEW-01 (P1): blog requests entered the product-only review service; the shared form sent `item_id` instead of the entity key. Repaired and tested with publication/purchase boundaries and rating cache invalidation.
- UI-01 (P2): quick-view referenced a missing thumbnail container, mobile images covered its close control, and product detail duplicated the cart drawer ID. Desktop/mobile interaction tests pass after repair.
- DATA-01: snapshot has five approved payment rows sharing one legacy reference. Preserved without deduplication; accounting reconciliation is required separately.
- MEDIA-01: production media files are absent from local storage, causing image 403 responses. Full visual/image QA remains pending media transfer.
- Clean MySQL migrations, snapshot upgrade, rollback/re-apply of the three new migrations, and business-table count comparison passed. No production database was modified.

Detailed local setup, release gates, deployment, rollback and manual QA are in `IMPLEMENTATION.md`; the implementation file inventory is in `CHANGED-FILES.md`.