# Condo Owner Desk Prototype

Static local frontend for annual owner stay privilege management. The primary navigation contains Dashboard and Owner Accounts; account data and linked Usage history are managed together inside Owner Accounts.

Use the `EN / 中文 / ไทย` control at the bottom-left of the sidebar (or the matching control on the login page) to switch the complete interface in place. English is restored when the page is refreshed. Thai dates use Thai month/day names with the Gregorian year and Latin operational digits.

## Sign in

The workspace now requires the backend-authenticated operator login:

- Username: `wyndhamcondon`
- Password: `wyndhamcondon`

The browser never stores the password. A successful login creates a 12-hour, HttpOnly session cookie; refresh keeps the session and Sign out invalidates it immediately. The local defaults can be overridden with backend authentication environment variables.

## Run locally

For a login-protected preview with the complete verified historical import, start the Fastify snapshot backend first:

```bash
cd backend
npm run build
npm run preview:history
```

This validates and loads the retained `legacy-016dc36d15cc40a5` import snapshot in memory: 388 owner accounts, 157 usage records, 438 privilege nights used in 2026 and 5,394 remaining. It uses the same backend login/session and API contract as PostgreSQL, but does not require or modify the remote database. Preview writes are memory-only and reset when this backend process stops.

In a second terminal, serve the frontend:

```bash
python3 -m http.server 4173 --bind 127.0.0.1
```

Then open <http://127.0.0.1:4173>.

Authentication always requires a backend. Use the verified snapshot command above for the complete historical preview, or start the PostgreSQL backend with its runtime database secrets for persistent live data.

The default URL uses the backend API and loads the imported owner accounts and usage history after sign-in. To use the local prototype dataset after authentication, open `http://127.0.0.1:4173/?mode=demo`. Imported usage history keeps its original source-row order. Records added in the interface appear above imported history in newest-entry-first order, independent of Check-in or Check-out dates.

Demo-mode records and snapshot-preview writes are stored in memory. A page refresh keeps them while their serving process remains active, but restarting the relevant process restores the original dataset. PostgreSQL-backed changes remain persistent. Annual entitlement information remains on the Dashboard; there is no separate Annual Report page.

## API integration mode

Start the backend on `127.0.0.1:3000`, start the frontend on `127.0.0.1:4173`, then open the default URL:

<http://127.0.0.1:4173>

This mode:

- verifies the operator session before loading or rendering the workspace;
- includes the HttpOnly session cookie on every API request and returns to login when the session expires;
- loads health, room types, all paginated owner accounts, all paginated usage records and Dashboard aggregates from the API;
- keeps UUIDs as strings and safely renders nullable account numbers, transfer dates and annual balances;
- shows explicit loading, connected, empty and error states with a Retry action;
- never falls back to the 190 demo accounts when the API fails;
- sends only owner, confirmation, dates, used room type, optional AC2 multiplier, remark and an idempotency key when creating usage; Night, Use and Balance remain server-derived.

The API base URL and default mode are centralized in `runtime-config.js`. The API hostname follows the frontend hostname so local cookies remain same-site on both `127.0.0.1` and `localhost`. It contains no database or login credentials. Browser code never connects directly to PostgreSQL.

For tiny-fixture frontend debugging without database writes, start the two-account in-memory Mock API:

```bash
node tests/mock-api-server.mjs
```

Use `node tests/mock-api-server.mjs --empty` to verify the empty-database interface. The Mock is intentionally not the historical preview; it runs only in process memory and is discarded when stopped.

Run the frontend API-client and localization tests with:

```bash
node --test tests/*.test.mjs
```

## Backend foundation

The isolated PostgreSQL database layer and TypeScript/Fastify API are implemented under [backend](./backend/README.md).

- The existing database remains `booking_test`.
- New database objects live only in the `condon` schema.
- The current latest workbook import has been applied and verified in the isolated `condon` schema.
- The frontend uses API integration by default; `?mode=demo` is an explicit static-prototype override.
- Login, session validation and logout are owned by the backend; all health, documentation and business endpoints require an authenticated session.
- The latest verified import contains 388 owner accounts and 157 usage records.