Add CSRF token hidden input fields to:
- Submission form (submission/form.html)
- Login form (auth/login.html)
Also fix broken link in login page that referenced submission.form
without required product_slug parameter. Changed to link to index page.
Bug found during manual testing when submitting feedback resulted in
"Bad Request - The CSRF token is missing" error.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Changed terminology from "API" to "Routes" to better reflect server-rendered HTML approach:
- Renamed submission_api.md → submission_routes.md
- Renamed dashboard_api.md → dashboard_routes.md
- Renamed admin_api.md → admin_routes.md
- Updated headers to clarify "Response Type: Server-rendered HTML (no JavaScript required)"
- Updated references in plan.md and quickstart.md
This clarifies that the application uses traditional web routes with form submissions
and HTML responses, not REST API endpoints with JSON.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Complete Phase 0 (Research) and Phase 1 (Design) of implementation planning workflow:
- plan.md: Technical context, constitution check, and project structure
- research.md: Technology decisions for AI integration, file storage, authentication, security
- data-model.md: Domain entities with validation rules and state transitions
- contracts/: API specifications for submission, dashboard, and admin endpoints
- quickstart.md: Developer setup guide with test-first workflow
- CLAUDE.md: Updated agent context with tech stack
All constitutional requirements validated. Ready for task generation phase.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
gurixandClaude