feat: Day 1 template readiness

[GRACENOBLE]

Summary

Closes #44, #45, #46, #47, #48, #49

Six Day 1 blocker issues that prevented the template from being used as a project starter.

Backend

• fix(backend): make CORS origin a config value instead of hardcoded localhost:3000 #44 — CORS allowed origins moved from hardcoded localhost:3000 to CORS_ALLOWED_ORIGINS env var (comma-separated, defaults to http://localhost:3000)
• feat(backend): add standardized API response envelope #46 — Standardized API response envelope: JSON[T], JSONStatus[T], JSONError helpers in response.go; all handlers and their tests updated
• feat(backend): add request ID middleware for distributed tracing #47 — Request ID middleware: reads or generates X-Request-ID, propagates to every log line and echo back in the response header; registered as the first middleware

Web

• feat(web): add missing variables to web/.env.example #45 — web/.env.example completed: added BACKEND_URL, NEXT_PUBLIC_BACKEND_URL, SENTRY_ORG, SENTRY_PROJECT
• feat(web): add app/not-found.tsx and app/error.tsx error pages #48 — Error pages: app/not-found.tsx (Server Component), app/error.tsx and app/global-error.tsx (Client Components with retry button); 5 Vitest tests added

Mobile

• feat(mobile): set up HTTP client for backend API calls #49 — data/network/ package: ApiClient (OkHttp + Firebase ID token interceptor), ApiResponse<T> / ApiErrorResponse envelope types matching the backend shape, UserApi.getMe() suspend function with injectable params for testability; UserApiTest covers success + 401 paths via MockWebServer
• BACKEND_URL build config field (defaults to http://10.0.2.2:8080 for emulator)
• network_security_config.xml: allows cleartext HTTP to 10.0.2.2 and localhost in dev builds only — fixes the "CLEARTEXT not permitted" error when calling the local backend from an emulator

Docs

• Updated backend/docs: environment.md, routing.md, middleware.md, error-handling.md
• Updated web/docs/routing.md with error page conventions
• Updated mobile/docs/architecture.md; created mobile/docs/http-client.md

Test plan

• go vet ./... — passes
• Backend handler unit tests — passes
• pnpm lint && pnpm build — passes
• Web Vitest (84 tests) — passes
• ./gradlew lint && ./gradlew test — passes
• Install on emulator: sign in, confirm profile name/email loads without CLEARTEXT error

Summary by CodeRabbit

• New Features

  • Added support for configurable cross-origin access and a more reliable request-tracking experience.
  • Mobile app now connects to the backend API directly, loads the current profile, and shows backend-authenticated data in the home screen.
  • Web app now includes dedicated error and 404 pages for a smoother user experience.

• Bug Fixes

  • Standardized API responses and error messages across backend endpoints for more consistent client behavior.

• Documentation

  • Updated backend, mobile, and web docs to reflect the latest environment, routing, and API usage details.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

Backend config now reads CORS origins from env and adds request IDs to middleware and logs. Shared JSON response helpers are introduced and adopted across handlers. Mobile code adds a Firebase-authenticated API client and /me fetch flow. Web adds App Router error and not-found pages plus updated env docs.

Changes

Backend CORS and request IDs

Layer / File(s)	Summary
CORS origins from config backend/.env.example, backend/docs/environment.md, backend/internal/bootstrap/bootstrap.go	CORS_ALLOWED_ORIGINS is added to the example env file and documented in backend environment docs, and bootstrap loads it into Config with a localhost default.
Route wiring with allowed origins backend/docs/routing.md, backend/internal/server/server.go, backend/internal/transport/handlers/routes.go, backend/internal/transport/handlers/metrics_handler_test.go	RegisterRoutes now accepts allowed origins, the server passes config into route wiring, CORS uses the provided list, and the route-registration test supplies the new argument.
Request ID middleware and logs backend/docs/middleware.md, backend/internal/transport/middleware/request_id.go, backend/internal/transport/middleware/logger.go	New request ID middleware stores or generates X-Request-ID, echoes it on responses, and logger output includes the request ID field.

Backend response envelopes and handlers

Layer / File(s)	Summary
Response helpers and envelope docs backend/internal/transport/handlers/response.go, backend/docs/error-handling.md, backend/docs/routing.md	Shared JSON, JSONStatus, and JSONError helpers are added with data and error envelopes, and the docs describe the new response shapes and helper usage.
Read and validation handlers backend/internal/transport/handlers/health_handler.go, backend/internal/transport/handlers/hello_handler.go, backend/internal/transport/handlers/auth_handler.go, backend/internal/transport/handlers/validation.go, backend/internal/transport/handlers/auth_handler_test.go, backend/internal/transport/handlers/hello_handler_test.go	Health, hello, auth, and binding paths now return enveloped success bodies and structured errors, and the matching tests assert the new JSON shape.
Mutating handlers and storage responses backend/internal/transport/handlers/fcm_handler.go, backend/internal/transport/handlers/me_handler.go, backend/internal/transport/handlers/storage_handler.go, backend/internal/transport/handlers/ws_handler.go, backend/internal/transport/handlers/storage_handler_test.go	FCM, profile, storage, and websocket handlers switch to the shared success and error helpers, and the presign test now reads the nested data payload.

Mobile HTTP client and profile flow

Layer / File(s)	Summary
App network setup mobile/app/build.gradle.kts, mobile/app/src/main/AndroidManifest.xml, mobile/app/src/main/res/xml/network_security_config.xml, mobile/app/src/main/java/com/company/template/data/network/ApiClient.kt, mobile/app/src/main/java/com/company/template/data/network/ApiResponse.kt	The app adds a build-time backend URL, a custom network security config, a shared OkHttp client with token injection, and JSON response/error models.
User API and home screen mobile/app/src/main/java/com/company/template/data/network/UserApi.kt, mobile/app/src/main/java/com/company/template/home/HomeScreen.kt, mobile/app/src/test/java/com/company/template/data/network/UserApiTest.kt	UserApi.getMe() fetches /api/v1/me, HomeScreen loads and renders profile state, and tests cover successful and error responses.
Mobile docs refresh mobile/docs/_index.md, mobile/docs/architecture.md, mobile/docs/http-client.md	The mobile docs index, architecture guide, and HTTP client page are updated to describe the new network stack, runtime setup, and tests.

Web error pages and docs

Layer / File(s)	Summary
Error and not-found components web/app/error.tsx, web/app/global-error.tsx, web/app/not-found.tsx, web/app/__tests__/error.test.tsx	Next.js error, global-error, and not-found pages render fallback UI with reset handling and digest display, and the error page tests cover those states.
Environment and routing docs web/.env.example, web/docs/routing.md	Web env examples split backend URL variables and add Sentry and Vercel placeholders, while routing docs update the App Router references and error-page guidance.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related issues

• issue 44: Backend CORS origins are now read from config instead of being hardcoded, matching the stated acceptance criteria.
• issue 46: The new response helpers and handler rewrites implement the standardized backend response envelope work.
• issue 49: The mobile OkHttp client, bearer-token interceptor, /api/v1/me call, and tests match the mobile HTTP client/API-layer objective.
• issue 45: The web env example now adds the missing backend and deployment-related variables.

Possibly related PRs

• GRACENOBLE/fullstack-template#6: Same backend CORS origin path in route setup; both changes adjust the allowed-origin behavior in the transport wiring.
• GRACENOBLE/fullstack-template#24: Same MeHandler and structured response helper migration around backend auth responses.
• GRACENOBLE/fullstack-template#29: Same FCM handler and route-wiring area, with the same style of helper-based response changes.

Poem

I hopped through configs, soft and keen,
Found CORS and tokens tucked between.
With data wrappers and digests bright,
The backend, mobile, and web feel right.
🐇✨ Hop-hop!

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The PR adds large mobile, web, and response-envelope changes that are unrelated to issue #44.	Split the non-CORS changes into separate PRs or link the additional issues they are meant to satisfy.
Docstring Coverage	⚠️ Warning	Docstring coverage is 39.13% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and broadly matches the PR’s template-readiness work.
Linked Issues check	✅ Passed	The CORS config, env example, and backend docs updates satisfy issue #44.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/day1-template-readiness

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}