✨ SvelteKit Scaffold & Auth Wiring

[ebigunso]

Objective
Introduce a SvelteKit frontend, integrate auth with the existing Rust backend, remove server-rendered HTML, provide minimal protected routing, and add a basic trends page using Chart.js.

Summary of changes

• Frontend (sleep-ui/)

  • New SvelteKit app with Tailwind, Vite proxy, and basic app shell (+layout).
  • Auth flow: login page posts to /login.json, session guard via +layout.server.ts reading /api/session, logout posts /logout with X-CSRF-Token.
  • API helpers (credentials: 'include') and CSRF header mirroring from cookie.
  • Toast store and UI notifications.
  • Trends page rendering Chart.js bar chart using /api/trends/sleep-bars with date range picker.
  • Dockerfile for SvelteKit dev server; compose service ui added.

• Backend (Axum)

  • feat(api): add GET /api/session returning { authenticated: boolean }.
  • feat(api): add HEAD /health for readiness checks.
  • refactor(api): remove server-rendered HTML (GET /trends Askama template, GET /login page), make backend API-only; root returns 204.

• Tests

  • Update integration tests to use /api/session for unauthenticated checks.
  • Ensure tests work with dev cookie names when COOKIE_SECURE=0; keep CSRF double-submit coverage.

• Tooling / config

  • Svelte preprocess import fixed (vitePreprocess from @sveltejs/vite-plugin-svelte).
  • tsconfig extends .svelte-kit/tsconfig.json; $lib alias configured via kit.alias.
  • Vite proxy: /api, /login.json, /logout, /sleep, /exercise, /note, /health -> :8080.
  • compose.yaml: add ui service exposing :5173 and depending on api.

How to run (dev)

• Backend: cargo run -p sleep-api (set COOKIE_SECURE=0 in .env for http:// during local dev).
• Frontend: cd sleep-ui && npm install && npm run dev (or docker compose up --build ui).
• Visit http://localhost:5173/login; login with backend ADMIN_EMAIL/ADMIN_PASSWORD_HASH.

Security

• Cookies via proxy, CSRF double-submit enforced for mutating routes; UI mirrors CSRF cookie into header.

Knowns / Audit

• npm audit in sleep-ui currently reports 4 low-severity vulnerabilities through transitive cookie < 0.7 via @sveltejs/kit. No safe non-breaking fix is available; audit fix --force would downgrade Kit to 0.0.30.

Acceptance criteria mapping

• SvelteKit runs at :5173 with proxy to backend :8080.
• Successful login sets backend cookies and unblocks protected routes.
• Lint/build OK (requires npm install).
• Raw HTML replaced by SvelteKit pages; backend API-only.

Diff highlights vs origin/main

• New: sleep-ui/ (SvelteKit app, Vite/Tailwind/Chart.js).
• New: /api/session, HEAD /health; removed Askama views/routes.
• Updated: tests for auth/CSRF and trends bars.

[Copilot]

Pull Request Overview

This PR introduces a complete SvelteKit frontend for the sleep tracking application, establishing it as an API-only backend with proper authentication integration. The changes remove server-rendered HTML pages in favor of a modern single-page application architecture.

Key changes:

• Adds a complete SvelteKit frontend (sleep-ui/) with Tailwind CSS, authentication flow, and Chart.js-powered trends visualization
• Converts the backend to API-only by removing Askama templates and HTML routes while adding session and health endpoints
• Updates all integration tests to work with both secure and development cookie configurations

Reviewed Changes

Copilot reviewed 27 out of 31 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
sleep-ui/*	Complete SvelteKit application with authentication, routing, API integration, and trends visualization
sleep-api/src/app.rs	Removes HTML routes, adds /api/session and /health endpoints for frontend integration
sleep-api/src/middleware/auth_layer.rs	Removes redirect-based authentication extractor, keeping only JSON-based auth
sleep-api/tests/*.rs	Updates integration tests to handle both secure and development cookie names
compose.yaml	Adds UI service configuration for development

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}