ahmido
714b910734
## Summary - add a dedicated public trust, privacy, and security surface for DACH evaluation - expand homepage trust discoverability and localized trust handoff copy - add and update smoke coverage plus Spec Kit artifacts for feature 405 ## Validation - corepack pnpm --dir apps/website build - WEBSITE_PORT=4322 corepack pnpm exec playwright test tests/smoke/public-routes.spec.ts tests/smoke/interaction.spec.ts Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #400
127 lines
3.8 KiB
Markdown
127 lines
3.8 KiB
Markdown
# Quickstart: DACH Trust, Datenschutz & Security Website Surface
|
|
|
|
## Goal
|
|
|
|
Implement Spec 405 inside `apps/website` only by deepening the existing public trust route, preserving current route/localization contracts, and proving the result with website-only build and smoke checks.
|
|
|
|
## 1. Verify repo truth first
|
|
|
|
Run from the repository root:
|
|
|
|
```bash
|
|
git status --short --branch
|
|
cat package.json
|
|
cat pnpm-workspace.yaml
|
|
cat apps/website/package.json
|
|
find apps/website -maxdepth 3 -type f | sort | sed -n '1,240p'
|
|
```
|
|
|
|
Confirm:
|
|
|
|
- the website package name is `@tenantatlas/website`
|
|
- `WEBSITE_PORT` still defaults to `4321`
|
|
- `/trust` already exists and remains the canonical trust route
|
|
- no `apps/platform` file is required for the change
|
|
|
|
## 2. Review the existing trust implementation seams
|
|
|
|
Inspect the current public shell before editing:
|
|
|
|
```bash
|
|
sed -n '1,260p' apps/website/src/data_files/site-copy.ts
|
|
sed -n '1,220p' apps/website/src/components/pages/TrustPage.astro
|
|
sed -n '1,260p' apps/website/src/components/pages/HomePage.astro
|
|
sed -n '1,200p' apps/website/src/i18n.ts
|
|
sed -n '1,260p' apps/website/tests/smoke/public-routes.spec.ts
|
|
sed -n '1,260p' apps/website/tests/smoke/smoke-helpers.ts
|
|
```
|
|
|
|
## 3. Implement the content and page structure
|
|
|
|
Expected edit targets:
|
|
|
|
- `apps/website/src/data_files/site-copy.ts`
|
|
- `apps/website/src/components/pages/TrustPage.astro`
|
|
- `apps/website/src/components/pages/HomePage.astro`
|
|
- navigation/footer inputs only if the current trust exposure needs adjustment
|
|
- `apps/website/tests/smoke/public-routes.spec.ts`
|
|
- `apps/website/tests/smoke/interaction.spec.ts`
|
|
- `apps/website/tests/smoke/smoke-helpers.ts`
|
|
|
|
Implementation guidance:
|
|
|
|
1. Expand trust copy for both `de` and `en`.
|
|
2. Keep `/trust` and `/en/trust` as the route pair.
|
|
3. Render claim-safe sections for hosting posture, privacy posture, document readiness, data categories, provider permissions, RBAC, auditability, retention, subprocessors, support access, and security handoff.
|
|
4. Use the six allowed claim statuses only.
|
|
5. Reuse `/contact` or a real `mailto:` destination for requests; do not create fake downloads.
|
|
6. Keep homepage trust discoverability lightweight and route users to the canonical trust page instead of duplicating the full content.
|
|
|
|
## 4. Run static scans before browser tests
|
|
|
|
Use a targeted forbidden-claim scan:
|
|
|
|
```bash
|
|
rg -n \
|
|
-e 'href=\"#\"' \
|
|
-e 'lorem ipsum' \
|
|
-e 'DSGVO-konform' \
|
|
-e 'DSGVO compliant' \
|
|
-e 'GDPR compliant' \
|
|
-e 'ISO certified' \
|
|
-e 'ISO 27001 certified' \
|
|
-e 'BSI certified' \
|
|
-e 'NIS2 compliant' \
|
|
-e 'hosted in Germany' \
|
|
-e 'in Deutschland gehostet' \
|
|
-e 'no customer data stored' \
|
|
-e 'keine Kundendaten' \
|
|
-e 'no personal data' \
|
|
-e 'keine personenbezogenen Daten' \
|
|
-e 'automatic restore' \
|
|
-e 'autonomous remediation' \
|
|
-e 'Google supported' \
|
|
-e 'AWS supported' \
|
|
apps/website/src apps/website/public apps/website/dist
|
|
```
|
|
|
|
Any intentional match must have a documented proof source or be rewritten.
|
|
|
|
## 5. Validate with website-only build and smoke coverage
|
|
|
|
```bash
|
|
corepack pnpm build:website
|
|
corepack pnpm --filter @tenantatlas/website test
|
|
```
|
|
|
|
If manual preview is needed:
|
|
|
|
```bash
|
|
corepack pnpm dev:website
|
|
```
|
|
|
|
Then verify:
|
|
|
|
- `/trust` loads on desktop and mobile
|
|
- `/en/trust` mirrors the intended trust posture
|
|
- homepage trust teaser links to the canonical trust route
|
|
- footer/navigation trust links are real
|
|
- no placeholder links remain
|
|
- no false compliance/certification/provider claims are visible
|
|
|
|
## 6. Final scope check
|
|
|
|
Before handing off, confirm that only website-facing files changed:
|
|
|
|
```bash
|
|
git status --short -- apps/website apps/platform
|
|
git diff --name-only
|
|
git diff --check
|
|
```
|
|
|
|
Expected result:
|
|
|
|
- `apps/website` files changed as planned
|
|
- `apps/platform` untouched
|
|
- no dependency, workspace-script, or build-contract drift
|