Skip to content

production-readiness-qa.md

Latest commit

 

History

History
129 lines (105 loc) · 5.44 KB

production-readiness-qa.md

File metadata and controls

129 lines (105 loc) · 5.44 KB
Raw

Production Readiness QA

Task 7B is a focused production-readiness pass for FrameSignal. It checks build stability, route health, SEO output, accessibility basics, responsive behavior, environment safety, and obvious deployment risks without adding product features.

Scope

  • Public content pages should keep working with Supabase read-only data and mock fallback.
  • Public contact and newsletter forms should remain server-action based and insert-only.
  • Protected admin routes should remain staff-only and should not be promoted in public navigation.
  • SEO output should include sitemap, robots, metadata, and safe JSON-LD without fake ratings or fake streaming availability.
  • Environment setup should remain placeholder-only in committed files.
  • No delete behavior, storage/upload, analytics scripts, new packages, migrations, or product features were added in this QA pass.

Route QA Checklist

Public routes to verify before deployment:

  • /
  • /reviews
  • /reviews/should-you-watch-inception-tonight
  • /reviews/test-review-from-local-qa if a published local Supabase row exists
  • /movies
  • /movies/inception
  • /movies/test-movie-local-qa if a published local Supabase row exists
  • /endings
  • /theories
  • /mood-signal
  • /watch-signal-generator
  • /about
  • /contact
  • /privacy-policy
  • /terms
  • /dmca
  • /editorial-policy
  • /review-methodology
  • /correction-policy
  • /affiliate-disclosure
  • /image-credit-policy
  • /ai-use-policy
  • /project-case-study
  • /sitemap.xml
  • /robots.txt

Admin routes to verify before deployment:

  • /admin/login should be reachable directly.
  • /admin should redirect unauthenticated visitors to /admin/login.
  • /admin/articles, /admin/articles/new, /admin/movies, /admin/movies/new, /admin/categories, /admin/tags, /admin/moods, /admin/genres, /admin/pages, /admin/settings, /admin/media, and /admin/analytics should stay protected.

SEO Checks

  • src/app/sitemap.ts includes public routes, published article URLs, published movie URLs, and published public CMS pages.
  • The sitemap source does not include /admin, /admin/login, draft, or archived.
  • src/app/robots.ts allows public crawling and disallows /admin, /admin/, and /admin/login.
  • src/lib/seo/json-ld.tsx is the centralized JSON-LD helper and escapes < before rendering.
  • No fake aggregate rating, fake offer, fake watch action, embed URL, or streaming availability schema should be added unless a later task has real compliant data.

Accessibility And Responsive Checks

  • Global focus-visible styles remain visible for links, buttons, inputs, selects, textareas, and admin actions.
  • Public contact/newsletter forms use labels and readable success/error states.
  • Admin tables use contained horizontal scroll wrappers instead of forcing body-level overflow.
  • Admin forms collapse to one column on mobile and keep inputs/actions inside the viewport.
  • Status labels should include text, not color alone.
  • No hover-only control is required for public or admin workflows.

Performance Checks

  • No unnecessary client components were found during this pass.
  • Public data fetching stays server-side.
  • Admin data fetching and mutations stay server-side.
  • No new bundle-heavy packages or analytics scripts were added.
  • No external image domains are needed because public imagery still uses safe placeholders.
  • A full Lighthouse/Core Web Vitals pass should be run after deployment with production-like data.

Security Checks

  • Public navigation should not link to /admin.
  • Protected admin routes should rely on Supabase auth, active staff profiles, and RLS.
  • Public pages should not read private tables such as contact_messages, newsletter_subscribers, profiles, content_audit_logs, affiliate_clicks, article_views, or search_logs.
  • Public forms should only insert into their intended public tables and should not expose raw Supabase errors.
  • No service role key should appear in runtime source code.
  • No delete buttons or delete workflows should be introduced by this QA task.

Environment Checklist

Committed placeholder file:

  • .env.example includes NEXT_PUBLIC_SITE_URL, NEXT_PUBLIC_SUPABASE_URL, and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY.
  • .env.example also documents future server-only placeholders without real values.
  • .gitignore ignores .env* while explicitly allowing .env.example.
  • .env.local should be created locally or in Vercel environment settings only and should not be committed.
  • Real Supabase secret or service-role keys must never be exposed in client code.

Intentionally Deferred

  • Deployment smoke testing on Vercel.
  • Lighthouse/Core Web Vitals measurement.
  • Final legal review for policy pages.
  • Production Supabase credential verification.
  • Production staff account bootstrap and activation.
  • Storage/upload, media optimization, analytics scripts, GSAP/Lenis motion, and any delete workflows.

Post-Deployment Manual Checks

After deployment, manually confirm:

  • /sitemap.xml and /robots.txt resolve on the production domain.
  • Canonical URLs use the production NEXT_PUBLIC_SITE_URL.
  • Public routes return 200 and do not expose raw Supabase errors.
  • Admin routes redirect unauthenticated visitors to /admin/login.
  • A real active staff account can log in, view admin pages, and log out.
  • Contact/newsletter forms behave safely with production RLS.
  • Mobile, tablet, and desktop layouts do not show body-level horizontal overflow.