TripFlow Workbench

TripFlow is a Firebase-backed collaborative travel-planning workbench built for the UIT Web Development with AI final group assignment. This standalone repository contains only the final project source, Firestore Rules, tests, and reviewer documentation.

Live project

• Production app: https://mxhuit26.vercel.app/final-group/
• Source repository: https://github.com/lenamkhanhh/tripflow-workbench

What a reviewer can test

1. Create an account or sign in with Firebase Email/Password Authentication.
2. Create a trip. Its creator becomes the only trip lead. A signed-in teammate can join using the generated 16-character code, resolved through a time-limited SHA-256-addressed Firestore proof.
3. Use the four workbench screens:
   • Overview: filter and sort itinerary items, search the workspace, and inspect activity and expense summaries.
   • Timeline: create and fully edit events; approve, pause, resume, complete, cancel, delete, and reorder according to role; add event costs, notes, and sub-items; inspect category, status, and current-event metrics.
   • Expenses: create, filter, edit, delete, settle, and calculate each member's paid, owed, and net amounts in integer VND.
   • Members: inspect the join code, edit your own name/responsibility, and remove another member as lead.
4. Verify role behaviour: member-created events start in review; only the lead can approve/reorder events, settle expenses, or remove another member.

For an account-free walkthrough, open https://mxhuit26.vercel.app/final-group/?demo=1. The demo is visibly labelled, uses synthetic in-memory records, resets on reload, and never writes to Firebase.

Stack

• React 19, TypeScript, and Vite
• Firebase Authentication and Cloud Firestore
• Vitest, Firebase Rules tests, and Playwright E2E tests

Local setup

npm install
Copy-Item .env.example .env.local
npm run dev

Add the five public Firebase Web configuration values to .env.local, then open the local Vite URL. Append ?demo=1 for the resettable local demo.

Verification

npm test
npm run build
npm run test:rules
npm run test:e2e
powershell -ExecutionPolicy Bypass -File .\scripts\verify.ps1 -Full

npm run test:auth-live performs an optional production Email/Password smoke using .env.local; it creates a synthetic account and deletes it immediately.

Data and security

Firestore Security Rules are the authorization boundary; client role badges are only affordances. Join proofs cannot be listed and can create only the caller's own member record. All money is stored as integer VND. The repository contains no service-account credential, private key, token, or .env.local.

Known limitations

• Automatic event lifecycle writes run while a lead client session is active; there is no server scheduler.
• Trips created before proof-backed join codes need a fresh trip for join testing.
• Join-proof rotation is protected by Rules but has no dedicated UI.
• File uploads remain unavailable because Firebase Storage and matching Rules are not configured.