# Phase 3 Server-Side Audit — Quick Check Recipe

Before starting any Phase 3 roadmap item, run this block to determine what's already live vs. what actually needs work. The roadmap's "NOT DONE" status is frequently stale — Phase 3.3/3.4 were fully deployed in prior sessions with no roadmap update.

## One-shot audit block

```bash
# 3.1 GlitchTip — does the stack exist?
ls /opt/glitchtip 2>/dev/null || echo "3.1: not installed"

# 3.2 PB SMTP/superadmin env vars — are any set?
docker inspect pocketbase --format '{{range .Config.Env}}{{println .}}{{end}}' 2>/dev/null | grep -iE 'SMTP|SUPERADMIN' || echo "3.2: no SMTP/superadmin env"

# 3.2 PB backup cron — is one installed?
crontab -l 2>/dev/null | grep -iE 'spq|pocketbase|pb_data' || echo "3.2: no pb backup cron"

# 3.3/3.4 nginx — is the server block serving the SPA + proxying /pb?
# (If both exist, 3.3/3.4 are DONE regardless of roadmap status)
cat /etc/nginx/sites-enabled/shopproquote 2>/dev/null | head -40
curl -sI https://shopproquote.graj-media.com/ | grep -iE 'HTTP/|content-security|x-frame'

# 3.5 Structured logging — json log format in nginx?
grep -l 'json_combined\|log_format.*json' /etc/nginx/nginx.conf 2>/dev/null && echo "3.5: has json format" || echo "3.5: no json format"

# 3.5 PB log rotation — driver + limits?
docker inspect pocketbase --format '{{.HostConfig.LogConfig.Type}} {{.HostConfig.LogConfig.Config}}' 2>/dev/null
# json-file with no max-size/max-file = no rotation (needs fixing)

# 3.6 Offline banner — does the component exist?
ls src/components/OfflineBanner.tsx 2>/dev/null && echo "3.6: file exists" || echo "3.6: missing"

# 3.7 Dependency audit
npm audit 2>&1 | head -3
```

## Interpretation

- **3.1** — Only needs work if `/opt/glitchtip` doesn't exist. If it does, check `docker compose ps` inside it.
- **3.2** — SMTP env vars and backup cron are both > APPROVAL REQUIRED (AGENTS.md). Never set passwords without asking.
- **3.3/3.4** — If the nginx site block exists and serves dist/ on 443 with `try_files ... /index.html` and a `/pb/` location, these are DONE. Do NOT re-implement from the roadmap spec.
- **3.5** — PB container always uses `json-file` driver by default, but without `max-size`/`max-file` opts there's no rotation. The fix is `docker update --log-driver json-file --log-opt max-size=10m --log-opt max-file=5 pocketbase` — needs go-ahead.
- **3.6** — Pure frontend, no approval needed. If the file exists and is wired in App.tsx, it's done.
- **3.7** — `npm audit` only. If 0 vulnerabilities, it's done. Minor patch updates don't need action.

## Approval rules (from AGENTS.md)

- **Do not** touch nginx config without explaining the exact change and getting go-ahead.
- **Do not** set or change passwords (PB superadmin, SMTP, GlitchTip DB) without explicit permission.
- **Do not** make PocketBase schema changes without confirming with the user.
- Frontend-only changes (3.6, 3.7) need no approval — just build/lint/test after.