# Site & app audits

A site audit is a **full visual and functional inventory** of every public
surface Drape ships: the marketing site, the brand portal, a tenant storefront,
the admin console, and the iOS app. Every route is loaded, screenshotted at
desktop and phone widths, exercised through the interaction states a signed-out
visitor can reach, and checked for console errors, failed requests and basic
accessibility hygiene.

Each audit is run **twice**: once against local builds of the current branches,
and once against production. A finding that reproduces on the live site is a
real issue for users. One that only appears on localhost is a dev-environment
nice-to-have, and every finding is labelled one way or the other.

## How an audit is produced

| Step | Tool | What it does |
| --- | --- | --- |
| Route discovery | `app/**/page.tsx` in each Next.js repo, plus same-origin links found on rendered pages | Builds the list of routes to visit |
| Web crawl | Playwright + Chromium (`crawl.js`) | Loads each route at 1440×900 and 390×844, full-page screenshots, tabs / expanders / mobile menu / empty form submit / wrong-password login, records console and network errors |
| Report | `report.js` | Classifies findings (critical, needs attention, minor, expected-from-probe), writes `summary.json` and a local HTML index |
| Production pass | same crawler, `config-prod.json` | Same routes on `drape.to`, `brand.drape.to`, a live tenant host and `admin.drape.to` |
| Comparison | `compare.js` | Pairs each local finding and route with its production counterpart and assigns the verdict |
| Mobile tour | Maestro (`audit-tour.yaml`) | Release simulator build, signup and login validation, onboarding, then every main, seller and brand route by deep link |
| Shareable report | `build-artifact.js` | One self-contained HTML file with compressed captures, findings and verdicts |

The tooling for the latest audit is downloadable from that audit's overview
page so the next pass can reuse it. Two environment details matter when
rerunning locally:

- The dev API's CORS allowlist accepts plain `localhost` only on ports 3000 to
  3003, plus any `*.localhost` host. Run the brand portal as
  `brand.localhost:<port>` and the admin as `admin.localhost:<port>`.
- Maestro needs a **Release** simulator build (`npx expo run:ios
  --configuration Release`); the Expo dev client cannot be driven through
  flows that clear state.

## Audits to date

| Date | Scope | Headline |
| --- | --- | --- |
| [2026-11-03](./2026-11-03/overview.md) | Marketing, brand portal, storefront, admin, iOS app; local `develop` vs production | 4 production issues (privacy/terms 404, product share image, admin login error, featured endpoint 500), the rest dev-only or hygiene |