@johnnyboy11234/esg-idea-contest 0.2.4 → 0.3.1

package/backend/test/matrix/file_test.go

@@ -0,0 +1,52 @@
+package matrix
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"slices"
+	"testing"
+)
+
+// The data file itself is checked without Docker: ids are unique, actors are
+// known, and every expected code exists in the shared error catalogue with the
+// status the catalogue gives it.
+func TestMatrixFileIsConsistent(t *testing.T) {
+	raw, err := os.ReadFile(filepath.Join(testdata, "error-codes.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var cat []struct {
+		Code   string
+		Status int
+	}
+	if err := json.Unmarshal(raw, &cat); err != nil {
+		t.Fatal(err)
+	}
+	status := map[string]int{}
+	for _, c := range cat {
+		status[c.Code] = c.Status
+	}
+
+	seen := map[string]bool{}
+	for _, r := range load(t) {
+		if seen[r.ID] {
+			t.Errorf("duplicate row id %q", r.ID)
+		}
+		seen[r.ID] = true
+		for actor, c := range r.Expect {
+			if !slices.Contains(Actors, actor) {
+				t.Errorf("%s: unknown actor %q", r.ID, actor)
+			}
+			if c.Code == "" {
+				if c.Status >= 400 {
+					t.Errorf("%s/%s: %d needs a code", r.ID, actor, c.Status)
+				}
+				continue
+			}
+			if want, ok := status[c.Code]; !ok || want != c.Status {
+				t.Errorf("%s/%s: %s is %d in the catalogue, row says %d", r.ID, actor, c.Code, want, c.Status)
+			}
+		}
+	}
+}

package/backend/test/matrix/load_test.go

@@ -0,0 +1,62 @@
+// Package matrix runs the permission matrix (PRD §7) from
+// testdata/permission-matrix.json: every cell is one test case.
+package matrix
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+const testdata = "../../../testdata"
+
+// Cell is the expected outcome of one (row, actor) pair.
+type Cell struct {
+	Status int    `json:"status"`
+	Code   string `json:"code"`
+}
+
+// Row is one operation or check-order case.
+type Row struct {
+	ID          string          `json:"id"`
+	Operation   string          `json:"operation"`
+	Method      string          `json:"method"`
+	Path        string          `json:"path"`
+	Body        json.RawMessage `json:"body"`
+	Multipart   *Multipart      `json:"multipart"`
+	CSRF        string          `json:"csrf"`
+	State       string          `json:"state"`
+	OutsideSpec bool            `json:"outsideSpec"`
+	Expect      map[string]Cell `json:"expect"`
+}
+
+// Multipart is a multipart/form-data body: text parts and one file part.
+type Multipart struct {
+	Fields map[string]string `json:"fields"`
+	File   struct {
+		Field    string `json:"field"`
+		Filename string `json:"filename"`
+		Content  string `json:"content"` // "pdf": a minimal valid PDF
+	} `json:"file"`
+}
+
+// Actors in PRD §7 order. The harness has a fixture for each one it lists in
+// fixtures; a row naming any other actor fails loudly instead of passing.
+var Actors = []string{"visitor", "user", "member", "leader", "admin"}
+
+func load(tb testing.TB) []Row {
+	tb.Helper()
+	raw, err := os.ReadFile(filepath.Join(testdata, "permission-matrix.json"))
+	if err != nil {
+		tb.Fatal(err)
+	}
+	var m struct{ Rows []Row }
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&m); err != nil {
+		tb.Fatalf("permission-matrix.json: %v", err)
+	}
+	return m.Rows
+}

package/backend/test/matrix/matrix_integration_test.go

@@ -0,0 +1,291 @@
+//go:build integration
+
+package matrix
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/account"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/deadline"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
+	shareddb "github.com/brian-huanggg/AwardRegistration/backend/internal/shared/db"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/storage"
+	"github.com/brian-huanggg/AwardRegistration/backend/test/apispec"
+)
+
+const password = "Correct-Horse-1"
+
+type env struct {
+	db      *sql.DB
+	plain   http.Handler // production chain
+	checked http.Handler // same chain, every response validated against openapi.yaml
+	seq     atomic.Int64
+}
+
+// newEnv wires the same chain as cmd/esg: this harness must fail if the
+// middleware order in production changes, so it must not build its own.
+func newEnv(t *testing.T) *env {
+	t.Helper()
+	db := dbtest.New(t)
+	log := slog.New(slog.DiscardHandler)
+	auditSvc := audit.New(db, log)
+	errs := server.ErrorAdapter{Audit: auditSvc, Log: log}
+	csrf, err := auth.NewCSRF(strings.Repeat("k", 32))
+	if err != nil {
+		t.Fatal(err)
+	}
+	sessions := auth.New(db)
+	logins, err := auth.NewLogins(sessions, auditSvc, auth.NoThrottle{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	si := server.API{
+		Auth:    auth.Handler{CSRF: csrf, Log: log},
+		Logins:  auth.LoginHandler{Logins: logins, Fail: errs.Write},
+		Logouts: auth.LogoutHandler{Logouts: &auth.Logouts{Sessions: sessions, Audit: auditSvc}, Fail: errs.Write},
+		Me:      auth.MeHandler{Sessions: sessions, Fail: errs.Write},
+		Account: account.Handler{
+			Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.DefaultPolicy()},
+			Fail:    errs.Write,
+		},
+		Deadline: deadline.Handler{Store: deadline.SQLStore{DB: db}},
+		Ideas: idea.Handler{
+			Service: &idea.Service{
+				DB: db, Audit: auditSvc,
+				Gate:    deadline.Gate{Store: deadline.SQLStore{DB: db}},
+				Slides:  server.IdeaSlideRules(),
+				Objects: discardObjects{},
+				Aborter: discardObjects{},
+			},
+			ExpectedFilename: storage.ExpectedFilenameBase,
+			Fail:             errs.Write,
+		},
+	}
+	chain := server.NewPublic(log, server.Mount(si),
+		auth.Middleware(sessions, server.IsPublic, log),
+		csrf.Middleware(errs.Write, server.ActionFor))
+	return &env{db: db, plain: chain, checked: apispec.Load(t).Validate(t, chain)}
+}
+
+// discardObjects stands in for MinIO: the matrix is about who may call what,
+// not about storage.
+type discardObjects struct{}
+
+func (discardObjects) Put(_ context.Context, _ string, r io.Reader, _ int64, _ string) error {
+	_, err := io.Copy(io.Discard, r)
+	return err
+}
+
+func (discardObjects) AbortUpload(context.Context, string, shareddb.Outcome) {}
+
+// stateDeadline is the deadline expression that puts the contest in a state.
+var stateDeadline = map[string]string{
+	"NOT_OPEN": "NULL",
+	"OPEN":     "NOW(6) + INTERVAL 1 DAY",
+	"CLOSED":   "NOW(6) - INTERVAL 1 DAY",
+}
+
+func (e *env) setState(t *testing.T, state string) {
+	t.Helper()
+	expr, ok := stateDeadline[state]
+	if !ok {
+		t.Fatalf("unknown state %q", state)
+	}
+	if _, err := e.db.Exec(`UPDATE contest_setting SET deadline = ` + expr + ` WHERE id = 1`); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func (e *env) do(h http.Handler, req *http.Request) *httptest.ResponseRecorder {
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	return rec
+}
+
+func (e *env) addUser(t *testing.T, empNo, role string) {
+	t.Helper()
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var email any = empNo + "@example.com"
+	if role == "ADMIN" {
+		email = nil
+	}
+	if _, err := e.db.Exec(`INSERT INTO app_user (id, emp_no, name, email, password_hash, role, enabled) VALUES (?,?,?,?,?,?,?)`,
+		uuid.NewString(), empNo, "N "+empNo, email, string(hash), role, true); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// actor is one caller of the matrix: its employee number, account name and,
+// when logged in, its session cookie.
+type actor struct {
+	empNo   string
+	name    string
+	session *http.Cookie
+}
+
+// fixtures lists the actors the harness can build. Idea-related actors (member,
+// leader) arrive with the PRs that create Ideas.
+var fixtures = map[string]string{"visitor": "", "user": "USER", "admin": "ADMIN"}
+
+// newActor creates a fresh account (logout and login change session state, so
+// no two cells share one) and logs in through the API.
+func (e *env) newActor(t *testing.T, name string) actor {
+	t.Helper()
+	role, ok := fixtures[name]
+	if !ok {
+		t.Fatalf("matrix actor %q has no fixture; add one before adding cells for it", name)
+	}
+	if role == "" {
+		return actor{empNo: "000000"}
+	}
+	empNo := fmt.Sprintf("%06d", 100000+e.seq.Add(1))
+	e.addUser(t, empNo, role)
+	tok, ck := e.csrf(t, nil)
+	body := fmt.Sprintf(`{"empNo":%q,"password":%q}`, empNo, password)
+	req := httptest.NewRequest("POST", "/api/v1/auth/login", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set(auth.CSRFHeader, tok)
+	req.AddCookie(ck)
+	rec := e.do(e.plain, req)
+	if rec.Code != 200 {
+		t.Fatalf("login %s: %d %s", name, rec.Code, rec.Body)
+	}
+	return actor{empNo: empNo, name: "N " + empNo, session: cookie(rec, auth.SessionCookie)}
+}
+
+func cookie(rec *httptest.ResponseRecorder, name string) *http.Cookie {
+	for _, c := range rec.Result().Cookies() {
+		if c.Name == name {
+			return c
+		}
+	}
+	return nil
+}
+
+func (e *env) csrf(t *testing.T, session *http.Cookie) (string, *http.Cookie) {
+	t.Helper()
+	req := httptest.NewRequest("GET", "/api/v1/auth/csrf", nil)
+	if session != nil {
+		req.AddCookie(session)
+	}
+	rec := e.do(e.plain, req)
+	var b struct{ Token string }
+	if err := json.Unmarshal(rec.Body.Bytes(), &b); err != nil || rec.Code != 200 {
+		t.Fatalf("csrf: %d %s", rec.Code, rec.Body)
+	}
+	return b.Token, cookie(rec, auth.CSRFCookie)
+}
+
+func (e *env) request(t *testing.T, r Row, a actor) *http.Request {
+	t.Helper()
+	var body *strings.Reader
+	if r.Body != nil {
+		s := string(r.Body)
+		s = strings.ReplaceAll(s, "${password}", password)
+		s = strings.ReplaceAll(s, "${actorEmpNo}", a.empNo)
+		s = strings.ReplaceAll(s, "${newEmpNo}", fmt.Sprintf("%06d", 500000+e.seq.Add(1)))
+		body = strings.NewReader(s)
+	}
+	var req *http.Request
+	if r.Multipart != nil {
+		buf, ct := multipartBody(t, r.Multipart, a)
+		req = httptest.NewRequest(r.Method, r.Path, buf)
+		req.Header.Set("Content-Type", ct)
+	} else if body != nil {
+		req = httptest.NewRequest(r.Method, r.Path, body)
+		req.Header.Set("Content-Type", "application/json")
+	} else {
+		req = httptest.NewRequest(r.Method, r.Path, nil)
+	}
+	req.RemoteAddr = "192.0.2.9:4000"
+	req.Header.Set("User-Agent", "matrix/1")
+	if a.session != nil {
+		req.AddCookie(a.session)
+	}
+	if r.Method != http.MethodGet && r.CSRF != "none" {
+		tok, ck := e.csrf(t, a.session)
+		req.Header.Set(auth.CSRFHeader, tok)
+		req.AddCookie(ck)
+	}
+	return req
+}
+
+func multipartBody(t *testing.T, m *Multipart, a actor) (*bytes.Buffer, string) {
+	t.Helper()
+	sub := strings.NewReplacer("${actorEmpNo}", a.empNo, "${actorName}", a.name)
+	var buf bytes.Buffer
+	mw := multipart.NewWriter(&buf)
+	for k, v := range m.Fields {
+		if err := mw.WriteField(k, sub.Replace(v)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	w, err := mw.CreateFormFile(m.File.Field, sub.Replace(m.File.Filename))
+	if err != nil {
+		t.Fatal(err)
+	}
+	switch m.File.Content {
+	case "pdf":
+		_, _ = w.Write([]byte("%PDF-1.7\nmatrix\n%%EOF\n"))
+	default:
+		t.Fatalf("unknown file content %q", m.File.Content)
+	}
+	if err := mw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return &buf, mw.FormDataContentType()
+}
+
+func TestPermissionMatrix(t *testing.T) {
+	e := newEnv(t)
+	for _, r := range load(t) {
+		if r.State != "" {
+			e.setState(t, r.State)
+		}
+		for _, name := range Actors {
+			want, ok := r.Expect[name]
+			if !ok {
+				continue
+			}
+			t.Run(r.ID+"/"+name, func(t *testing.T) {
+				a := e.newActor(t, name)
+				h := e.checked
+				if r.OutsideSpec {
+					h = e.plain
+				}
+				rec := e.do(h, e.request(t, r, a))
+				if rec.Code != want.Status {
+					t.Fatalf("%s %s as %s: status %d, want %d (%s)", r.Method, r.Path, name, rec.Code, want.Status, rec.Body)
+				}
+				if want.Code != "" {
+					var p struct{ Code string }
+					if err := json.Unmarshal(rec.Body.Bytes(), &p); err != nil || p.Code != want.Code {
+						t.Fatalf("%s %s as %s: code %q, want %q (%s)", r.Method, r.Path, name, p.Code, want.Code, rec.Body)
+					}
+				}
+			})
+		}
+	}
+}

package/backend/test/migration/pending_file_deletion_test.go

@@ -0,0 +1,46 @@
+//go:build integration
+
+package migration_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+)
+
+func TestPendingFileDeletionRules(t *testing.T) {
+	d := dbtest.New(t)
+	ins := func(key, reason string) error {
+		_, err := d.Exec(`INSERT INTO pending_file_deletion (object_key, reason) VALUES (?, ?)`, key, reason)
+		return err
+	}
+	for _, r := range []string{"REPLACED", "DELETED", "UPLOAD_ABORTED"} {
+		if err := ins("slides/a/b.pdf", r); err != nil {
+			t.Errorf("reason %s (same key again): want accepted, got %v", r, err)
+		}
+	}
+	if err := ins(strings.Repeat("k", 128), "DELETED"); err != nil {
+		t.Errorf("128-char key: %v", err)
+	}
+	for name, c := range map[string][2]string{
+		"unknown reason":    {"slides/x.pdf", "EXPIRED"},
+		"lower-case reason": {"slides/x.pdf", "replaced"},
+		"empty key":         {"", "DELETED"},
+		"129-char key":      {strings.Repeat("k", 129), "DELETED"},
+	} {
+		if err := ins(c[0], c[1]); err == nil {
+			t.Errorf("%s: want rejected", name)
+		}
+	}
+
+	var attempts int
+	var due bool
+	if err := d.QueryRow(`SELECT attempts, next_attempt_at <= NOW(6) AND created_at <= NOW(6)
+	                        FROM pending_file_deletion WHERE reason = 'DELETED' LIMIT 1`).Scan(&attempts, &due); err != nil {
+		t.Fatal(err)
+	}
+	if attempts != 0 || !due {
+		t.Errorf("defaults: attempts=%d due=%v, want 0 and due now", attempts, due)
+	}
+}

package/docs/API/api-endpoints.md

@@ -40,6 +40,6 @@ Every write (`POST`, `PUT`, `DELETE`, including login, register and logout) MUST
 Notes:
  
 - `DELETE /ideas/{id}/members/{empNo}` works on both `PENDING` and `ACCEPTED` rows (reject or remove); `DELETE …/members/me` works on the caller's own row (withdraw or leave). `me` is never a 6-digit employee ID, so the two paths cannot collide (PRD §6.7).
-- List endpoints enforce a maximum page size of 100 (`GET /ideas`: `page`, `size`, filters, `sort`, `order`; PRD §6.6). `GET /admin/audit-logs` uses keyset pagination with `cursor` and `limit` (PRD §6.11).
+- List endpoints enforce a maximum page size of 100 (`GET /ideas`: `page`, `size`, filters, `q`, `sort`, `order`; PRD §6.6). `GET /admin/audit-logs` uses keyset pagination with `cursor` and `limit` (PRD §6.11).
 - Unknown paths: 401 without a session, 404 with one; wrong method 405; unsupported `Accept` 406 (PRD §6.1, OI-15).
 - Operations endpoints are on the management port and are not routed by the public ingress (PRD §8.3).

package/docs/API/error-codes.md

@@ -37,7 +37,7 @@ Format: RFC 9457 `application/problem+json`.
  
 - `code` is the stable contract; `detail` is English and not for display (the UI localizes by `code`).
 - With several field errors, `errors[]` lists all of them in form-field order; the top-level `code` equals `errors[0].code` when that is a registered specific code, otherwise `VALIDATION_FAILED`.
-- Generic field codes: `REQUIRED`, `INVALID_FORMAT`, `OUT_OF_RANGE`, `INVALID_ENUM`. Per-field rules (which error a field reports first) are in PRD §6.2. The password is the exception: `errors[]` lists every violated rule (PRD §6.4).
+- Generic field codes: `REQUIRED`, `INVALID_FORMAT`, `OUT_OF_RANGE`, `INVALID_ENUM`. Per-field rules (which error a field reports first) are in PRD §6.2. The password is the exception: `errors[]` lists every violated rule (PRD §6.4), each as `{ "field": "password", "code": "PASSWORD_POLICY", "rule": "<rule id>" }` in table order. `rule` appears only on these entries.
 - `requestId` is a server-generated UUID. An incoming `X-Request-Id` is reused only if it is a valid UUID. It is returned in the response header and the error body.
 - 500 responses carry only `INTERNAL_ERROR` and `requestId`: no stack traces, SQL or paths.
 - A malformed ID in a path is a 404, not a 400.

package/frontend/src/app/App.test.tsx

@@ -1,5 +1,5 @@
 import { QueryClient } from '@tanstack/react-query';
-import { render, screen, waitFor, within } from '@testing-library/react';
+import { render, screen, waitFor } from '@testing-library/react';
 import { http, HttpResponse } from 'msw';
 import { createMemoryRouter } from 'react-router';
 import { axe } from 'vitest-axe';
@@ -9,7 +9,7 @@ import { initI18n } from '@/shared/i18n';
 import { App } from './App';
 import { safeNext } from './access';
 import { PAGES, routes } from './router';
-import { ROUTES, navFor, type Role } from './routes';
+import { ROUTES, type Role } from './routes';
 
 const API = 'http://localhost:3000/api/v1';
 const me = (role: Role | null) =>
@@ -32,31 +32,6 @@ async function open(path: string, role: Role | null, state: 'NOT_OPEN' | 'OPEN'
 /** A concrete URL for a route pattern. */
 const concrete = (p: string) => p.replace(':id', '11111111-1111-4111-8111-111111111111');
 
-describe('deadline banner (3 states)', () => {
-  it.each([
-    ['NOT_OPEN', 'Submissions are not open yet.'],
-    ['OPEN', 'Submissions are open.'],
-    ['CLOSED', 'Submissions are closed.'],
-  ] as const)('%s', async (state, text) => {
-    await open('/login', null, state);
-    const region = await screen.findByRole('region', { name: 'Submission status' });
-    expect(await within(region).findByText(new RegExp(text))).toBeInTheDocument();
-    expect(region).toHaveAttribute('data-state', state);
-  });
-
-  it('shows an error state when the deadline cannot be loaded', async () => {
-    server.use(me(null), http.get(`${API}/deadline`, () => problem(503, 'SERVICE_UNAVAILABLE')));
-    await initI18n('en');
-    render(<App router={createMemoryRouter(routes, { initialEntries: ['/login'] })} client={new QueryClient()} />);
-    expect(await screen.findByText('The submission status could not be loaded.')).toBeInTheDocument();
-  });
-
-  it('is present in AppShell too', async () => {
-    await open('/ideas', 'USER', 'CLOSED');
-    expect(await screen.findByRole('region', { name: 'Submission status' })).toBeInTheDocument();
-  });
-});
-
 describe('route access (Frontend.md §6.3)', () => {
   const nonPublic = ROUTES.filter((r) => r.access !== 'public');
 
@@ -98,19 +73,6 @@ describe('route access (Frontend.md §6.3)', () => {
   });
 });
 
-describe('navigation matches the route table', () => {
-  it.each([
-    ['USER', ['Ideas', 'Join requests']],
-    ['ADMIN', ['Ideas', 'Deadline', 'Statistics']],
-  ] as const)('%s', async (role, labels) => {
-    await open('/ideas', role);
-    const nav = await screen.findByRole('navigation', { name: 'Main navigation' });
-    expect(within(nav).getAllByRole('link').map((a) => a.textContent)).toEqual(labels);
-    expect(within(nav).getAllByRole('link').map((a) => a.getAttribute('href'))).toEqual(navFor(role).map((r) => r.path));
-    expect(!!screen.queryByText('Administrator')).toBe(role === 'ADMIN');
-  });
-});
-
 describe('safeNext (§6.4)', () => {
   it.each([
     ['/ideas?page=2', 'USER', '/ideas?page=2'],
@@ -137,7 +99,6 @@ describe('every route has a page', () => {
     async (path, role) => {
       const { container } = await open(concrete(path), role);
       expect(await screen.findAllByRole('heading', { level: 1 })).toHaveLength(1);
-      await screen.findByRole('region', { name: 'Submission status' });
       expect((await axe(container)).violations).toEqual([]);
     },
   );
@@ -157,7 +118,6 @@ describe('accessibility', () => {
   ] as const)('%s as %s has no axe violations', async (path, role) => {
     const { container } = await open(path, role);
     await screen.findByRole('heading', { level: 1 });
-    await screen.findByRole('region', { name: 'Submission status' });
     expect((await axe(container)).violations).toEqual([]);
   });
 });

package/frontend/src/app/App.tsx

@@ -1,18 +1,27 @@
-import { useEffect } from 'react';
+import { useCallback, useEffect } from 'react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { RouterProvider, createBrowserRouter, type DataRouter } from 'react-router';
 import { setUnauthenticatedHandler } from '@/shared/api';
 import { routes } from './router';
-import { handleSessionEnded } from './session';
+import { IdleWarning } from '@/features/auth/IdleWarning';
+import { handleSessionEnded, useMe } from './session';
 
 const queryClient = new QueryClient();
 const browserRouter = createBrowserRouter(routes);
 
+/** Mounted inside the providers so it can read `me`; ends the session like a 401 when the idle time is up. */
+function Idle({ router, client }: { router: DataRouter; client: QueryClient }) {
+  const { data: me } = useMe();
+  const onExpire = useCallback(() => handleSessionEnded(client, router), [client, router]);
+  return <IdleWarning signedIn={!!me} onExpire={onExpire} />;
+}
+
 export function App({ router = browserRouter, client = queryClient }: { router?: DataRouter; client?: QueryClient }) {
   useEffect(() => setUnauthenticatedHandler(() => handleSessionEnded(client, router)), [client, router]);
   return (
     <QueryClientProvider client={client}>
       <RouterProvider router={router} />
+      <Idle router={router} client={client} />
     </QueryClientProvider>
   );
 }

package/frontend/src/app/index.css

@@ -12,18 +12,18 @@
   --card-foreground: oklch(0.2046 0 0);
   --popover: oklch(0.9911 0 0);
   --popover-foreground: oklch(0.4386 0 0);
-  --primary: oklch(0.8348 0.1302 160.9080);
-  --primary-foreground: oklch(0.2626 0.0147 166.4589);
+  --primary: oklch(0.5203 0.1364 144.2);
+  --primary-foreground: oklch(0.9911 0 0);
   --secondary: oklch(0.9940 0 0);
   --secondary-foreground: oklch(0.2046 0 0);
   --muted: oklch(0.9461 0 0);
-  --muted-foreground: oklch(0.2435 0 0);
+  --muted-foreground: oklch(0.4386 0 0);
   --accent: oklch(0.9461 0 0);
   --accent-foreground: oklch(0.2435 0 0);
   --destructive: oklch(0.5523 0.1927 32.7272);
   --border: oklch(0.9037 0 0);
   --input: oklch(0.9731 0 0);
-  --ring: oklch(0.8348 0.1302 160.9080);
+  --ring: oklch(0.6 0.15 144.2);
   --destructive-foreground: oklch(0.9934 0.0032 17.2118);
   --chart-1: oklch(0.8348 0.1302 160.9080);
   --chart-2: oklch(0.6231 0.1880 259.8145);