# Fix plan — 2026-11-03

Ordered by user impact, then by effort. Each item names the repo and file,
an effort estimate (XS under an hour, S a morning, M a day or two), and the
check that closes it. Nothing here is filed as a GitHub issue yet; the proposed
issue list is at the bottom so they can be opened in batches without flooding
the board.

## Wave 1 — production-facing, small

### 1. Serve `drape.to/privacy` and `/terms` (P1)

- **Repo:** `Drape-Marketing`. **Effort:** S.
- **Why first:** these are the App Store Connect canonical URLs and every
  marketing footer links them; a reviewer or a user following the link gets a
  404 today.
- **Fix:** the `rewrites()` in `next.config.ts` are not honoured by the Amplify
  deployment. Either add equivalent rewrite rules in the Amplify app settings,
  or replace the rewrite with real routes (`app/privacy/page.tsx` and
  `app/terms/page.tsx`) that render the existing HTML so no host feature is
  needed. The second option is more robust.
- **Verify:** `curl -I https://drape.to/privacy` and `/terms` return 200 after
  deploy; the crawler's marketing pass shows both routes at 200 in production.

### 2. Allow product image hosts in the marketing site (P2)

- **Repo:** `Drape-Marketing`, `next.config.ts`. **Effort:** XS.
- **Fix:** add `images.remotePatterns` for `v3b.fal.media` and the Supabase
  storage host (`mfxtjylgcryarajinvbd.supabase.co`, or `*.supabase.co`).
- **Verify:** `/product/<any id>` shows the product image in production; the
  local dev server no longer throws on the route.

### 3. Show the admin login error (P3)

- **Repo:** `Drape-admin-v1`, `lib/api.ts` and `app/login/page.tsx`.
  **Effort:** XS.
- **Fix:** mirror the brand portal's client: skip the 401 redirect for the login
  request (a `skipAuthRedirect` option, or do not redirect when already on
  `/login`) and surface `detail` from the response.
- **Verify:** a wrong password on `admin.drape.to/login` shows "Invalid admin
  credentials" and keeps the email field; the crawler's
  `login-bad-credentials` capture shows the message.

### 4. Fix the featured-products endpoint (P4)

- **Repo:** `Drape-`, `backend-postgres` (`/api/products/featured`).
  **Effort:** S to M, cause unknown until the traceback is read.
- **Fix:** pull the exception from Sentry or the ECS logs for a direct call to
  the endpoint, fix it, and add it to the integration tests. Consider having
  the app distinguish "no featured drops" from "could not load" so the next
  backend failure is visible.
- **Verify:** `curl https://api.drape.to/api/products/featured` returns 200;
  the Featured screen populates when a product is flagged featured.

## Wave 2 — hygiene, one change per app

### 5. Purge committed test credentials (H1)

- **Repo:** `Drape-`. **Effort:** S.
- **Fix:** remove the email and password from the four files, keep only
  `DRAPE_TEST_EMAIL` / `DRAPE_TEST_PASSWORD` placeholders, and provision a
  non-personal QA account whose password lives in a secrets store. The repo's
  own guidance already notes history still holds older secrets; if the repo is
  ever shared externally, run BFG once for all of them.
- **Verify:** `grep -r DRAPE_TEST_PASSWORD=` across the repo returns only
  placeholders.

### 6. Landmarks, headings and `lang` in shared layouts (H2)

- **Repos:** `Drape-brand`, `Drape-admin-v1`, `Drape-Marketing`. **Effort:** S
  total.
- **Fix:** wrap page content in `main` in each app's root or group layout; give
  the auth pages (login, signup, apply, forgot/reset password, verify email,
  accept invite) a visible or visually-hidden `h1`; set `lang="en"` on the
  `html` element in the marketing and brand layouts.
- **Verify:** the crawler's minor-findings count for "No main landmark", "No h1"
  and "No lang attribute" drops to zero.

### 7. Deploy the brand portal (H3)

- **Repo:** `Drape-brand`. **Effort:** XS.
- **Fix:** the local branch already has a titled 404 page; production is
  behind. Ship the next brand deploy and confirm.
- **Verify:** `brand.drape.to/<unknown>` has a title and a "404" heading.

### 8. Eager-load hero images (H4)

- **Repos:** `Drape-Marketing` (`/`, `/for-brands`), `Drape-brand` (`/`).
  **Effort:** XS.
- **Fix:** add `priority` to the above-the-fold `next/image` hero on each page.
- **Verify:** the LCP warning no longer prints in the dev console.

### 9. Silence the hydration warning (D2)

- **Repo:** `Drape-brand`, root layout. **Effort:** XS.
- **Fix:** `suppressHydrationWarning` on the `html` element, since the theme
  script intentionally mutates it before hydration.
- **Verify:** no hydration message in the dev console on `/`.

## Wave 3 — dev environment

### 10. Make local dev match the CORS rules (D1)

- **Where:** `Drape-AI/start-drape-local.sh` and its stop script (local only,
  not in a repo). **Effort:** XS.
- **Fix:** print and open `brand.localhost:<port>` and `admin.localhost:<port>`;
  pick a free port instead of silently skipping when 3001 is busy; stop only the
  ports the script started.

### 11. Inject Stripe secrets into the dev task definition (D3)

- **Repo:** `Drape-`, `backend-postgres/deploy/task-def-dev.json`.
  **Effort:** XS plus the secret values in Secrets Manager.
- **Fix:** commit the pending change that adds the seven `STRIPE_*` secrets
  (plus Mux, Langfuse and the webhook secrets) to the dev task definition, and
  deploy dev.
- **Verify:** the seller billing screen on a dev build no longer shows the
  "Stripe is not configured" notice.

### 12. Seed dev with a resolvable store and real product images (D4)

- **Where:** dev database. **Effort:** S.
- **Fix:** give the QA Atelier store an active slug so `<slug>.localhost`
  resolves through `/api/tenant/<slug>`, and attach apparel images to its two
  products.
- **Verify:** the storefront, `/l?code=...` and `/p?...` routes can be captured
  in their live states on the next audit.

### 13. Replace the stale Maestro flows (D5)

- **Repo:** `Drape-`, `frontend/.maestro` and `frontend/qa/maestro`.
  **Effort:** M.
- **Fix:** retire flows that assert screens which no longer exist, adopt the
  audit tour as the smoke flow, and keep credentials in environment variables.
  The tour runs in about 12 minutes against a Release simulator build.
- **Verify:** `maestro test audit-tour.yaml` passes on a fresh simulator.

### 14. Scope Watchman to the app (nice-to-have)

- **Repo:** `Drape-`, `frontend/.watchmanconfig`. **Effort:** XS.
- **Fix:** add a `.watchmanconfig` so the watch root is `frontend/` with
  `node_modules`, `ios/Pods` and build output ignored. The first Metro start on
  a fresh machine currently crawls the whole repo for about 40 minutes.

## Needs a decision, not a fix

- **Tenant root.** `https://<brand>.drape.to/` redirects to the portal login in
  both environments. If a shopper is meant to land on the storefront, that root
  should go to `/shop`.
- **Signed-in audits.** 41 portal and admin routes have never been captured.
  A brand login and an admin login for a QA account would let the same crawler
  cover them next time.

## Proposed GitHub issues (not yet filed)

| Proposed title | Repo | Labels | Wave |
| --- | --- | --- | --- |
| Marketing: `/privacy` and `/terms` return 404 in production | Drape-Marketing | bug, production, app-store | 1 |
| Marketing: configure `next/image` remote hosts for product images | Drape-Marketing | bug, production | 1 |
| Admin: wrong password reloads login with no message | Drape-admin-v1 | bug, production, ux | 1 |
| Backend: `/api/products/featured` returns 500 | Drape- | bug, production, backend | 1 |
| Remove committed test credentials from docs and QA files | Drape- | security, hygiene | 2 |
| Add `main` landmark, page `h1`s and `lang` across web apps | Drape-brand, Drape-admin-v1, Drape-Marketing | a11y, hygiene | 2 |
| Eager-load hero images flagged as LCP | Drape-Marketing, Drape-brand | performance | 2 |
| Brand portal: suppress intentional theme hydration mismatch | Drape-brand | hygiene | 2 |
| Dev task definition: inject Stripe and related secrets | Drape- | dev-env | 3 |
| Dev seed: resolvable store slug and real product images | Drape- | dev-env | 3 |
| Refresh Maestro flows to match the current app | Drape- | qa, dev-env | 3 |
| Add `.watchmanconfig` to scope Metro's watch root | Drape- | dev-env | 3 |