feat: set FRONTEND_SSL_ENABLED to false in docker-compose.yml

Co-authored-by: Copilot <copilot@github.com>
2026-05-02 14:00:28 -04:00 · 2026-05-02 13:41:55 -04:00 · 2026-05-01 23:32:17 -04:00 · 2026-05-01 18:49:48 -04:00 · 2026-05-01 18:49:40 -04:00 · 2026-05-01 15:39:01 -04:00
30 changed files with 422 additions and 195 deletions
--- a/.gitea/workflows/promote-master.yaml
+++ b/.gitea/workflows/promote-master.yaml
@@ -394,7 +394,7 @@ jobs:
            fi

            frontend_ok=false
-            if curl -kfsS "https://localhost:${frontend_host_port}/" >/dev/null 2>&1; then
+            if curl -fsS "http://localhost:${frontend_host_port}/" >/dev/null 2>&1; then
              frontend_ok=true
            fi

--- a/.github/specs/feat-notify-ending-chore.md
+++ b/.github/specs/feat-notify-ending-chore.md
@@ -81,7 +81,7 @@ Import added and `start_chore_expiry_notification_scheduler(app)` called after t
 - [x] `_build_push_payload`: single chore → named title, deep-link fields set
 - [x] `_build_push_payload`: multiple chores → generic title, child_id/entity_id null
 - [x] `_build_push_payload`: body groups chore names by child
- [x] `_build_push_payload`: no approve_token or deny_token in payload
+- [x] `_build_push_payload`: no approve_token or reject_token in payload
 - [x] `send_chore_expiry_notifications_for_user`: calls send_push_to_user with correct payload
 - [x] `send_chore_expiry_notifications_for_user`: no push when no chores expiring
 - [x] `run_chore_expiry_check`: skips when DB_ENV=e2e
@@ -111,7 +111,7 @@ Import added and `start_chore_expiry_notification_scheduler(app)` called after t

 **`frontend/vue-app/public/sw.js`** (modified)

-In the `push` event handler, the `actions` array passed to `showNotification` is now conditionally set: when `payload.type === 'chore_expiring_soon'` the array is empty (no buttons); otherwise Approve and Deny buttons are shown as before. The `notificationclick` handler requires no changes — tapping the notification body already navigates to `/parent/{child_id}?scrollTo={entity_id}` when those fields are present, and falls back to `/parent` when they are null (multi-chore case).
+In the `push` event handler, the `actions` array passed to `showNotification` is now conditionally set: when `payload.type === 'chore_expiring_soon'` the array is empty (no buttons); otherwise Approve and Reject buttons are shown as before. The `notificationclick` handler requires no changes — tapping the notification body already navigates to `/parent/{child_id}?scrollTo={entity_id}` when those fields are present, and falls back to `/parent` when they are null (multi-chore case).

 ## Frontend Tests

@@ -143,6 +143,6 @@ No automated tests added. The `sw.js` change is a simple conditional and is cove

 ### Frontend

- [x] `sw.js` updated — `chore_expiring_soon` notifications show no Approve/Deny action buttons
+- [x] `sw.js` updated — `chore_expiring_soon` notifications show no Approve/Reject action buttons
 - [x] Tapping a single-chore notification navigates to the child's chore page
 - [x] Tapping a multi-chore notification navigates to `/parent`
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -14,7 +14,8 @@
        "REFRESH_TOKEN_EXPIRY_DAYS": "90",
        "DIGEST_TOKEN_SECRET": "dev-digest-token",
        "VAPID_PUBLIC_KEY": "BNKkHdq45uLigohSG7c1TwlAo7ETncoRVLQK02LxHgu2P1DgSJD9njRMfbbzUsaTQGllvLBz7An1WiWsNYQhvKE",
-        "VAPID_PRIVATE_KEY": "jNiZJT0UO4H861KmnCt874Fg6p5jDAyYKS4V2MZf8bQ"
+        "VAPID_PRIVATE_KEY": "jNiZJT0UO4H861KmnCt874Fg6p5jDAyYKS4V2MZf8bQ",
+        "FRONTEND_URL": "https://macbook:5173"
      },
      "args": [
        "run",
--- a/backend/config/version.py
+++ b/backend/config/version.py
@@ -2,7 +2,7 @@
 # file: config/version.py
 import os

-BASE_VERSION = "1.0.12"  # update manually when releasing features
+BASE_VERSION = "1.0.13"  # update manually when releasing features

 def get_full_version() -> str:
    """
--- a/docker-compose.test.yml
+++ b/docker-compose.test.yml
@@ -29,9 +29,10 @@ services:
  chores-test-app-frontend: # Test frontend service name
    image: git.ryankegel.com:3000/kegel/chores/frontend:next # Use latest next tag
    ports:
-      - "446:443" # Host 446 -> Container 443 (HTTPS)
+      - "446:80" # Host 446 -> Container 80 (HTTP behind external TLS proxy)
    environment:
      - BACKEND_HOST=chores-test-app-backend # Points to internal backend service
+      - FRONTEND_SSL_ENABLED=false
    depends_on:
      - chores-test-app-backend
    # Add volumes, networks, etc., as needed
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -25,9 +25,10 @@ services:
    image: git.ryankegel.com:3000/kegel/chores/frontend:latest # Or specific version tag
    container_name: chores-app-frontend-prod # Added for easy identification
    ports:
-      - "${FRONTEND_HOST_PORT:-4601}:443" # Host port -> Container 443 (HTTPS)
+      - "${FRONTEND_HOST_PORT:-4601}:${FRONTEND_CONTAINER_PORT:-80}" # Host port -> Container 80 (HTTP; SSL terminated by external proxy)
    environment:
      - BACKEND_HOST=chores-app-backend # Points to internal backend service
+      - FRONTEND_SSL_ENABLED=false
    depends_on:
      - chores-app-backend
    networks:
--- a/frontend/.gitignore
+++ b/frontend/.gitignore
@@ -37,6 +37,9 @@ __screenshots__/

 *.old

+# Local dev TLS certs (machine-specific, generated by mkcert)
+*.pem
+
 # Playwright
 /test-results/
 /playwright-report/
--- a/frontend/192.168.1.102+1-key.pem
+++ b/frontend/192.168.1.102+1-key.pem
@@ -1,28 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCh96Qoz16kpDde
-puFkARSFp9PDFs8kUBGCJ0DcBDqJIUuLJj7RT5vxfUj3O7uUUjTtVAVCMJ84/eq/
-IQnyhch1B2Fe5bas51kEgwybzxxEN1bcj3yokbd4aOCpxkpM382TKMPuGH1BXUO8
-ZqqikbvKySJ9glboPImLRA4UvH1cx9Db0kQE9scBl98qqE28exlBqMBsIOjh+mJ0
-rWt3JO+A50OjOSuxO7hdjINlJg5X+jmI1wF3GWE2i9GrCJXh9JVYixnjvsFMIKJo
-Zu9wAZCmtqHvicvwdzDxdDAU8GfACOg4w4hlMOSfIU4pAONxW479Gf5pSFVTw7Zu
-RNrTDsd9AgMBAAECggEAGICASL0wLdt61dqMg8anDl4Yaq2nafCj6WrbRL1uBoMv
-LK59N8hhiKuBj4cthg9WmuWIQx5cY/CDo+TRXqsu60dRy1uYYjlATe6uSF7RQZ+W
-iBi7zLt4hCJnhD9vS4hazs2OsFTrk+kSP2zPmPbPcCqzyUVftNO9ogAKWkg2dcO1
-9KjDnR0pSn17rwj064mfVNoLYiN11nwQ21zyJFLYGM5mXYYW9b+EI9ZnWWyz6Lvo
-+qrYhZh2hR8ul8rpURc0flqFvORaO4FhaQeX5+r5FZFQkRWQYbRfBbAJnIrFVa+N
-8O002E0FLHWI0S7YPsbnBqE+eHRM9fzz1q0p4YrjEQKBgQDDz9n2BLwwQCreXglG
-V2T1SBdi1+MDTMUCHEcak3Gk4ZRIU4r2ofoTdYagEaYCMBGL7/noYECpEfkzF4B5
-u1nXUTtFODq0m1Uc18iL8WMJy8AkoT+LZEmF0y5WDI/fLzzxuQKXpTDyeUwTYf/W
-9xHHi4gckc3wcf1tKtNSswCcMQKBgQDTwJxki8/2OEtIRcPlhhXNQRpSnp6cjgoB
-xQ4J83idR3/HBLWMI9snx47SE1AxGFY4UHIQNvMN3icKt5C7QyfrMfZCpUcRryv6
-1dBFVbvxm0Hvqj/pWsgtjbq+dbiOLtH52zc9nsPAF++FhlYtZz9fJmwsgxsnab1O
-B9dUyXMpDQKBgDj3LRfPhNgcstwCS3x1TF+3W2ZcHCUHnoDgrSbkIjmvjq4D7/eU
-Y+ZpWIMU31Dfnxsw82lRJz6IhhEBE1VW1eo4LaATnbCRSA+eDy/3R7K/3eRKLOxm
-fqU6LM7H1Ms/OOGxyzlGy5ifBSzWY9GsCzYcN7roCBudbfbmcJgsj07hAoGAd2p1
-CCLsub9PfUeSzTrLyr//Nz6q1kEoFY1qeGQszg3HWpYmSAzkh897lK89lyJRZVrA
-qLJEabqxq9KPtXuO5I19gmIw7SErnT69QIyz+/IBwkXx2wjOQRpfiQ9ccBqpYc2l
-noONgyQ8eMGkkeBbFa7WbFfXlWeFUZ8MaY1d+3UCgYBguVXJ9JTvMxeXx5cjnfMI
-eVRhr2BbARTdCJXKUpo4rUUqLrCCSB6BrT4H+DYtRVKO/ZIaXARQIN1ACo03C78o
-U+Rg+mGTyvGh8pVH63zZE9tsohtT+/bSraYm/dLKUmaK3Z9wG75wmOpNLlAEiUqW
-mzkW/UN0WWzg5gyODVbQKQ==
-----END PRIVATE KEY-----
--- a/frontend/192.168.1.102+1.pem
+++ b/frontend/192.168.1.102+1.pem
@@ -1,26 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIEZDCCAsygAwIBAgIQIM51sKaVetu2bhpqghM+2TANBgkqhkiG9w0BAQsFADCB
-kzEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMTQwMgYDVQQLDCtyeWFu
-QG1hY2Jvb2sudGFpbGExNDZiMy50cy5uZXQgKFJ5YW4gS2VnZWwpMTswOQYDVQQD
-DDJta2NlcnQgcnlhbkBtYWNib29rLnRhaWxhMTQ2YjMudHMubmV0IChSeWFuIEtl
-Z2VsKTAeFw0yNjA0MTYyMjEwMTNaFw0yODA3MTYyMjEwMTNaMFMxJzAlBgNVBAoT
-Hm1rY2VydCBkZXZlbG9wbWVudCBjZXJ0aWZpY2F0ZTEoMCYGA1UECwwfcnlhbkBy
-eWFucy1haXIubGFuIChSeWFuIEtlZ2VsKTCCASIwDQYJKoZIhvcNAQEBBQADggEP
-ADCCAQoCggEBAKH3pCjPXqSkN16m4WQBFIWn08MWzyRQEYInQNwEOokhS4smPtFP
-m/F9SPc7u5RSNO1UBUIwnzj96r8hCfKFyHUHYV7ltqznWQSDDJvPHEQ3VtyPfKiR
-t3ho4KnGSkzfzZMow+4YfUFdQ7xmqqKRu8rJIn2CVug8iYtEDhS8fVzH0NvSRAT2
-xwGX3yqoTbx7GUGowGwg6OH6YnSta3ck74DnQ6M5K7E7uF2Mg2UmDlf6OYjXAXcZ
-YTaL0asIleH0lViLGeO+wUwgomhm73ABkKa2oe+Jy/B3MPF0MBTwZ8AI6DjDiGUw
-5J8hTikA43Fbjv0Z/mlIVVPDtm5E2tMOx30CAwEAAaNzMHEwDgYDVR0PAQH/BAQD
-AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB8GA1UdIwQYMBaAFLM+akEIDt75nyHZ
-rbkUs/4IQWesMCkGA1UdEQQiMCCCCWxvY2FsaG9zdIINZGV2c2VydmVyLmxhbocE
-wKgBZjANBgkqhkiG9w0BAQsFAAOCAYEAi4pT3LNzoM5mmD3ujX+G+cXx8MOAljvR
-XGrzorysNOujR79+zR5tPPyiLwFfEYASJhWlHarM8n6DG+IgARNt9PuDq0x8+oDp
-V/t9grCS6eV/SQf6y7JBQrywdIBgfYGJbbx6xzVlj187M+7yNV73f3ldS3wPFKlS
-Gp6p50Vt9gmfsiqzW4NDr0FIvdbcBesNfr2DwRccZNgNAcLsr9ys2yVUcUtMnqPF
-IPyarDbREuBLLLpnsYZhY3BJQgI3gDS9QRoviFCMjcbWKNnv0D2W0rVdZkJf9WOj
-ro9X1K2f2C/t61EnFsM6ncqAgMksbBmlORiVi4thAgB44FDydyHX6anf7Hbzfn1t
-sjsiZ03rO9xvFzUb2T9guFMBkU6pBDEhCdN3twYPY3uKPXByHnSmj3q38NJVbULu
-szC1q91VF+2U2UoeoXaNxrXVleKpLiWEUJ/u/iGrbApeuov5ZTktA/y/d/+TDB+h
-Jlo+Ofg3zgZBHpN+fsGTxhRLlJyXSynI
-----END CERTIFICATE-----
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -10,17 +10,15 @@ RUN npm run build
 FROM nginx:alpine
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY nginx.conf.template /etc/nginx/nginx.conf.template
-# Copy SSL certificate and key
-COPY 192.168.1.102+1.pem /etc/nginx/ssl/server.crt
-COPY 192.168.1.102+1-key.pem /etc/nginx/ssl/server.key
+COPY nginx.http.conf.template /etc/nginx/nginx.http.conf.template
+COPY docker/start-nginx.sh /docker/start-nginx.sh
+RUN chmod +x /docker/start-nginx.sh

 EXPOSE 80
 EXPOSE 443
-# Copy nginx.conf
-COPY nginx.conf.template /etc/nginx/nginx.conf.template

-# Set default BACKEND_HOST (can be overridden at runtime)
+# Set default runtime values (can be overridden at runtime)
 ENV BACKEND_HOST=chore-app-backend
+ENV FRONTEND_SSL_ENABLED=true

-# Use sed to replace $BACKEND_HOST with the env value, then start Nginx
-CMD ["/bin/sh", "-c", "sed 's/\\$BACKEND_HOST/'\"$BACKEND_HOST\"'/g' /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf && nginx -g 'daemon off;'"]
+CMD ["/docker/start-nginx.sh"]
--- a/frontend/docker/start-nginx.sh
+++ b/frontend/docker/start-nginx.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+set -eu
+
+backend_host="${BACKEND_HOST:-chore-app-backend}"
+ssl_enabled="$(printf '%s' "${FRONTEND_SSL_ENABLED:-true}" | tr '[:upper:]' '[:lower:]')"
+
+template_file="/etc/nginx/nginx.http.conf.template"
+
+case "$ssl_enabled" in
+  1|true|yes|on)
+    template_file="/etc/nginx/nginx.conf.template"
+    ;;
+esac
+
+sed "s|\$BACKEND_HOST|${backend_host}|g" "$template_file" > /etc/nginx/nginx.conf
+
+nginx -t
+exec nginx -g 'daemon off;'
--- a/frontend/e2e/.auth/user-cc.json
+++ b/frontend/e2e/.auth/user-cc.json
@@ -2,20 +2,20 @@
  "cookies": [
    {
      "name": "refresh_token",
-      "value": "1aCKS1DujEPmHYGCELY7JiJ-LfxGjw7_HK1uCymlbh8",
+      "value": "mY6Ehfjz0l0gIgI1-zrA_HMfYQiNmgnNy6g7v2GoT3M",
      "domain": "localhost",
      "path": "/api/auth",
-      "expires": 1785207783.273047,
+      "expires": 1785468152.319767,
      "httpOnly": true,
      "secure": true,
      "sameSite": "Strict"
    },
    {
      "name": "access_token",
-      "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImUyZS1jY0B0ZXN0LmNvbSIsInVzZXJfaWQiOiJhNzY5YzY4Zi04MWQ5LTRiNjctODQwYS1mY2Q5NTVkNzAwNzYiLCJ0b2tlbl92ZXJzaW9uIjowLCJleHAiOjE3Nzc0NDI1ODN9.vdmfmIx0Dg4zKq9HTV7N7tjDbSGaO3EOeGqJbhFSOcQ",
+      "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImUyZS1jY0B0ZXN0LmNvbSIsInVzZXJfaWQiOiI0YmI3ZTQ3ZS0wNGYxLTQyMDctYjZjYy0yNDM3NDVlOGQ0ZDMiLCJ0b2tlbl92ZXJzaW9uIjowLCJleHAiOjE3Nzc3MDI5NTJ9.614NMFQB7JcIJ4k4cqKyxlpcyHmt2Hn4PbjCbvLMJ2A",
      "domain": "localhost",
      "path": "/",
-      "expires": 1777442583.273,
+      "expires": 1777702952.31857,
      "httpOnly": true,
      "secure": true,
      "sameSite": "Lax"
@@ -27,11 +27,11 @@
      "localStorage": [
        {
          "name": "authSyncEvent",
-          "value": "{\"type\":\"logout\",\"at\":1777431783134}"
+          "value": "{\"type\":\"logout\",\"at\":1777692151952}"
        },
        {
          "name": "parentAuth",
-          "value": "{\"expiresAt\":1777604583443}"
+          "value": "{\"expiresAt\":1777864952730}"
        }
      ]
    }
--- a/frontend/e2e/.auth/user-delete.json
+++ b/frontend/e2e/.auth/user-delete.json
@@ -2,20 +2,20 @@
  "cookies": [
    {
      "name": "refresh_token",
-      "value": "eDlr3-DaFNFoWQE3EDAybLFpw7TiR3Maj05kLIkZfu0",
+      "value": "fmbL31vJQXFd7NDUWy7eGlRZZoGh0BZipf8CqFOb8zw",
      "domain": "localhost",
      "path": "/api/auth",
-      "expires": 1785207783.382249,
+      "expires": 1785468152.214735,
      "httpOnly": true,
      "secure": true,
      "sameSite": "Strict"
    },
    {
      "name": "access_token",
-      "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImUyZS1kZWxldGVAdGVzdC5jb20iLCJ1c2VyX2lkIjoiNGYwNmY0YTMtMGQwMC00NzJhLWJkMjQtYjM1YjdkMjg4ZDFiIiwidG9rZW5fdmVyc2lvbiI6MCwiZXhwIjoxNzc3NDQyNTgzfQ.F2TXov3xbhFa20P5NLt6J5HfNDlY2aXlnPoSYYDJpoQ",
+      "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImUyZS1kZWxldGVAdGVzdC5jb20iLCJ1c2VyX2lkIjoiNzc2YjBkYjctYzYyNy00ODBiLTkzZDYtMTRlMTE4MDQ3NTE5IiwidG9rZW5fdmVyc2lvbiI6MCwiZXhwIjoxNzc3NzAyOTUyfQ.I4sfKTo0nsJgKvwDRSztxtyZpWw-oN1y3L4yCtr_CRo",
      "domain": "localhost",
      "path": "/",
-      "expires": 1777442583.38218,
+      "expires": 1777702952.21406,
      "httpOnly": true,
      "secure": true,
      "sameSite": "Lax"
@@ -27,11 +27,11 @@
      "localStorage": [
        {
          "name": "authSyncEvent",
-          "value": "{\"type\":\"logout\",\"at\":1777431783225}"
+          "value": "{\"type\":\"logout\",\"at\":1777692151844}"
        },
        {
          "name": "parentAuth",
-          "value": "{\"expiresAt\":1777604583575}"
+          "value": "{\"expiresAt\":1777864952556}"
        }
      ]
    }
--- a/frontend/e2e/.auth/user.json
+++ b/frontend/e2e/.auth/user.json
@@ -2,20 +2,20 @@
  "cookies": [
    {
      "name": "refresh_token",
-      "value": "BGnvmJr7XNXaCsXlzh1k6RcJPIGVxac6_LBXS22gXIA",
+      "value": "YitpHdwm093Mavj6iTYmJOLGLOIKoozGkmYXgmJMTBM",
      "domain": "localhost",
      "path": "/api/auth",
-      "expires": 1785207781.614965,
+      "expires": 1785468147.453462,
      "httpOnly": true,
      "secure": true,
      "sameSite": "Strict"
    },
    {
      "name": "access_token",
-      "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImUyZUB0ZXN0LmNvbSIsInVzZXJfaWQiOiI4YmQxMWY5NC1jNWJhLTRhNmEtOGZhMi1hZjZkYzk3Y2YyMjgiLCJ0b2tlbl92ZXJzaW9uIjowLCJleHAiOjE3Nzc0NDI1ODF9.WVDBt-zfwVMHCWr78maSGWAyfQZhWOSobX5oXKXLHwg",
+      "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6ImUyZUB0ZXN0LmNvbSIsInVzZXJfaWQiOiI4ZGNmOWU5Ni1lM2I3LTRkNzYtOWQ1NS01NmE4MjU5ZWQ5NzUiLCJ0b2tlbl92ZXJzaW9uIjowLCJleHAiOjE3Nzc3MDI5NDd9.zSetTnajvus3N5uJDBqxRYXfLksoU9ZmkWzqCS0GUvc",
      "domain": "localhost",
      "path": "/",
-      "expires": 1777442581.61492,
+      "expires": 1777702947.452943,
      "httpOnly": true,
      "secure": true,
      "sameSite": "Lax"
@@ -27,11 +27,11 @@
      "localStorage": [
        {
          "name": "authSyncEvent",
-          "value": "{\"type\":\"logout\",\"at\":1777431781473}"
+          "value": "{\"type\":\"logout\",\"at\":1777692147220}"
        },
        {
          "name": "parentAuth",
-          "value": "{\"expiresAt\":1777604581743}"
+          "value": "{\"expiresAt\":1777864947663}"
        }
      ]
    }
--- a/frontend/e2e/mode_parent/notifications/reward-notification-deny.spec.ts
+++ b/frontend/e2e/mode_parent/notifications/reward-notification-deny.spec.ts
@@ -108,8 +108,8 @@ test.describe('Reward Notification — In-App Denial', () => {
    await expect(card).toHaveClass(/item-ready/, { timeout: 3000 })
    await card.click()

-    // Look for a Deny button in the dialog
-    const denyBtn = page.getByRole('button', { name: /deny/i })
+    // Look for the reject action in the dialog
+    const denyBtn = page.getByRole('button', { name: 'Reject', exact: true })
    await expect(denyBtn).toBeVisible({ timeout: 5000 })
    await denyBtn.click()
    await expect(denyBtn).not.toBeVisible({ timeout: 5000 })
@@ -127,7 +127,7 @@ test.describe('Reward Notification — In-App Denial', () => {
    await card.click()
    await expect(card).toHaveClass(/item-ready/, { timeout: 3000 })
    await card.click()
-    const denyBtn = page.getByRole('button', { name: /deny/i })
+    const denyBtn = page.getByRole('button', { name: 'Reject', exact: true })
    await expect(denyBtn).toBeVisible({ timeout: 5000 })
    await denyBtn.click()
    await expect(denyBtn).not.toBeVisible({ timeout: 5000 })
--- a/frontend/e2e/mode_parent/task-activation/pending-reward-warning.spec.ts
+++ b/frontend/e2e/mode_parent/task-activation/pending-reward-warning.spec.ts
@@ -59,7 +59,9 @@ async function createReward(
  for (const r of (await pre.json()).rewards ?? []) {
    if (r.name === name) await request.delete(`/api/reward/${r.id}`)
  }
-  await request.put('/api/reward/add', { data: { name, description: 'E2E pending-warn test', cost } })
+  await request.put('/api/reward/add', {
+    data: { name, description: 'E2E pending-warn test', cost },
+  })
  const list = await request.get('/api/reward/list')
  return (await list.json()).rewards?.find((r: any) => r.name === name)?.id ?? ''
 }
@@ -160,9 +162,7 @@ test.describe('Pending reward warning dialog', () => {

  test('Pending reward card shows PENDING banner', async ({ page }) => {
    await page.goto(`/parent/${childId}`)
-    const card = rewardSection(page)
-      .locator('.item-card')
-      .filter({ hasText: PENDING_REWARD_NAME })
+    const card = rewardSection(page).locator('.item-card').filter({ hasText: PENDING_REWARD_NAME })
    await card.waitFor({ state: 'visible' })
    await expect(card.locator('.pending')).toHaveText('PENDING')
  })
@@ -177,12 +177,12 @@ test.describe('Pending reward warning dialog', () => {

    await activateItem(card)

-    // Pending reward warning dialog appears (has a "No" button)
-    await expect(page.getByRole('button', { name: 'No', exact: true })).toBeVisible()
-    await page.getByRole('button', { name: 'No', exact: true }).click()
+    // Pending reward warning dialog appears
+    await expect(page.getByRole('button', { name: 'Reject', exact: true })).toBeVisible()
+    await page.getByRole('button', { name: 'Reject', exact: true }).click()

    // Dialog dismissed; task confirmation dialog must NOT have appeared
-    await expect(page.getByRole('button', { name: 'No', exact: true })).not.toBeVisible()
+    await expect(page.getByRole('button', { name: 'Reject', exact: true })).not.toBeVisible()
    await expect(page.getByRole('button', { name: 'Cancel' })).not.toBeVisible()
    // Points unchanged
    await expect(page.locator('.points .value')).toHaveText(String(pointsBefore))
@@ -204,8 +204,8 @@ test.describe('Pending reward warning dialog', () => {
    await activateItem(card)

    // Pending reward warning dialog
-    await expect(page.getByRole('button', { name: 'No', exact: true })).toBeVisible()
-    await page.getByRole('button', { name: 'Yes' }).click()
+    await expect(page.getByRole('button', { name: 'Reject', exact: true })).toBeVisible()
+    await page.getByRole('button', { name: 'Approve', exact: true }).click()

    // After confirming, the task confirmation dialog appears (has "Cancel" button)
    await expect(page.getByRole('button', { name: 'Cancel' })).toBeVisible({ timeout: 3000 })
@@ -219,7 +219,9 @@ test.describe('Pending reward warning dialog', () => {

  // ── kindness ──────────────────────────────────────────────────────────────

-  test('Kindness activation — Cancel on pending dialog leaves state unchanged', async ({ page }) => {
+  test('Kindness activation — Cancel on pending dialog leaves state unchanged', async ({
+    page,
+  }) => {
    await page.goto(`/parent/${childId}`)
    const card = kindnessSection(page).locator('.item-card').filter({ hasText: KIND_NAME })
    await card.waitFor({ state: 'visible' })
@@ -227,10 +229,10 @@ test.describe('Pending reward warning dialog', () => {

    await activateItem(card)

-    await expect(page.getByRole('button', { name: 'No', exact: true })).toBeVisible()
-    await page.getByRole('button', { name: 'No', exact: true }).click()
+    await expect(page.getByRole('button', { name: 'Reject', exact: true })).toBeVisible()
+    await page.getByRole('button', { name: 'Reject', exact: true }).click()

-    await expect(page.getByRole('button', { name: 'No', exact: true })).not.toBeVisible()
+    await expect(page.getByRole('button', { name: 'Reject', exact: true })).not.toBeVisible()
    await expect(page.getByRole('button', { name: 'Cancel' })).not.toBeVisible()
    await expect(page.locator('.points .value')).toHaveText(String(pointsBefore))
  })
@@ -245,8 +247,8 @@ test.describe('Pending reward warning dialog', () => {

    await activateItem(card)

-    await expect(page.getByRole('button', { name: 'No', exact: true })).toBeVisible()
-    await page.getByRole('button', { name: 'Yes' }).click()
+    await expect(page.getByRole('button', { name: 'Reject', exact: true })).toBeVisible()
+    await page.getByRole('button', { name: 'Approve', exact: true }).click()

    await expect(page.getByRole('button', { name: 'Cancel' })).toBeVisible({ timeout: 3000 })
    await page.getByRole('button', { name: 'Yes' }).click()
@@ -266,10 +268,10 @@ test.describe('Pending reward warning dialog', () => {

    await activateItem(card)

-    await expect(page.getByRole('button', { name: 'No', exact: true })).toBeVisible()
-    await page.getByRole('button', { name: 'No', exact: true }).click()
+    await expect(page.getByRole('button', { name: 'Reject', exact: true })).toBeVisible()
+    await page.getByRole('button', { name: 'Reject', exact: true }).click()

-    await expect(page.getByRole('button', { name: 'No', exact: true })).not.toBeVisible()
+    await expect(page.getByRole('button', { name: 'Reject', exact: true })).not.toBeVisible()
    await expect(page.getByRole('button', { name: 'Cancel' })).not.toBeVisible()
    await expect(page.locator('.points .value')).toHaveText(String(pointsBefore))
  })
@@ -284,8 +286,8 @@ test.describe('Pending reward warning dialog', () => {

    await activateItem(card)

-    await expect(page.getByRole('button', { name: 'No', exact: true })).toBeVisible()
-    await page.getByRole('button', { name: 'Yes' }).click()
+    await expect(page.getByRole('button', { name: 'Reject', exact: true })).toBeVisible()
+    await page.getByRole('button', { name: 'Approve', exact: true }).click()

    await expect(page.getByRole('button', { name: 'Cancel' })).toBeVisible({ timeout: 3000 })
    await page.getByRole('button', { name: 'Yes' }).click()
@@ -320,10 +322,10 @@ test.describe('Pending reward warning dialog', () => {
    await activateItem(otherCard)

    // Pending reward warning dialog appears when another reward has a pending request
-    await expect(page.getByRole('button', { name: 'No', exact: true })).toBeVisible()
-    await page.getByRole('button', { name: 'No', exact: true }).click()
+    await expect(page.getByRole('button', { name: 'Reject', exact: true })).toBeVisible()
+    await page.getByRole('button', { name: 'Reject', exact: true }).click()

-    await expect(page.getByRole('button', { name: 'No', exact: true })).not.toBeVisible()
+    await expect(page.getByRole('button', { name: 'Reject', exact: true })).not.toBeVisible()
    await expect(page.getByRole('button', { name: 'Cancel' })).not.toBeVisible()
    await expect(page.locator('.points .value')).toHaveText(String(pointsBefore))
    // PENDING banner still visible — reward request was not cancelled
@@ -346,11 +348,11 @@ test.describe('Pending reward warning dialog', () => {

    await activateItem(otherCard)

-    await expect(page.getByRole('button', { name: 'No', exact: true })).toBeVisible()
-    await page.getByRole('button', { name: 'Yes' }).click()
+    await expect(page.getByRole('button', { name: 'Reject', exact: true })).toBeVisible()
+    await page.getByRole('button', { name: 'Approve', exact: true }).click()

    // Pending dialog closes; reward confirm does NOT auto-open (other reward must be re-clicked)
-    await expect(page.getByRole('button', { name: 'No', exact: true })).not.toBeVisible()
+    await expect(page.getByRole('button', { name: 'Reject', exact: true })).not.toBeVisible()
    await expect(page.getByRole('button', { name: 'Cancel' })).not.toBeVisible()

    // The pending reward request was cancelled — PENDING banner should disappear
--- a/frontend/e2e/mode_parent/task-activation/reward-redemption.spec.ts
+++ b/frontend/e2e/mode_parent/task-activation/reward-redemption.spec.ts
@@ -152,7 +152,7 @@ test.describe('Reward redemption', () => {

    await activateItem(card)
    await expect(page.getByRole('button', { name: 'Yes' })).toBeVisible()
-    await page.getByRole('button', { name: 'Cancel' }).click()
+    await page.getByRole('button', { name: 'No', exact: true }).click()

    await expect(page.getByRole('button', { name: 'Yes' })).not.toBeVisible()
    await expect(page.locator('.points .value')).toHaveText(String(before))
--- a/frontend/e2e/mode_parent/task-modification/reward-edit-cost.spec.ts
+++ b/frontend/e2e/mode_parent/task-modification/reward-edit-cost.spec.ts
@@ -187,11 +187,11 @@ test.describe('Reward edit cost', () => {
    await card.getByTitle('Edit custom value').click()

    // PendingRewardDialog should appear warning about the pending state
-    await expect(page.locator('.modal-message')).toContainText('pending')
+    await expect(page.getByText(/currently pending/i)).toBeVisible()

-    // Clicking "No" closes the dialog without opening the override modal
-    await page.getByRole('button', { name: 'No', exact: true }).click()
-    await expect(page.locator('.modal-message')).not.toBeVisible()
+    // Clicking "Reject" closes the dialog without opening the override modal
+    await page.getByRole('button', { name: 'Reject', exact: true }).click()
+    await expect(page.getByText(/currently pending/i)).not.toBeVisible()
    await expect(page.getByRole('button', { name: 'Save' })).not.toBeVisible()
  })

@@ -209,10 +209,10 @@ test.describe('Reward edit cost', () => {
    await card.getByTitle('Edit custom value').click()

    // PendingRewardDialog visible
-    await expect(page.locator('.modal-message')).toContainText('pending')
+    await expect(page.getByText(/currently pending/i)).toBeVisible()

    // Confirming cancels the pending request and opens the override modal
-    await page.getByRole('button', { name: 'Yes' }).click()
+    await page.getByRole('button', { name: 'Approve', exact: true }).click()
    await expect(page.getByRole('button', { name: 'Save' })).toBeVisible({ timeout: 5000 })
    await page.getByRole('button', { name: 'Cancel' }).click()
  })
--- a/frontend/localhost+1-key.pem
+++ b/frontend/localhost+1-key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC3VWwSC3U5hnOx
+kznjtzIKmzuWJ/BtEg+6lh9n1KSqjnF06Q2jXj3uxfQmqZBrIDhlhbt6ZfMsHZW9
+lIPsGX2vSwzNhZd9AqMdgwZK7NeLh+Hd3FDTlr4xgDrt5Rb6FQHs8rg7Dh1etwfn
+6ZTKE05jtiZ1PKEci59YkgwvYfrv9PYUpXMrAVNW+OHtnHuRb32zdmfQrNEqmWqb
+v7UY2+FJxTSHGhYW92asbnbuctnlbRLg66p3PjGWYHoBWF0tVwaaCKkRcHqeQQu+
+bfrXWY8APUo4osrI5tl6LkvmIq85zTZ9zq92l9LG+nRegwFKNHbhSB2Qf62D4YH9
+X91k5b5/AgMBAAECggEAAY+aofSzBNBeP87PGV8/79MuiLLCW0tiEuagUdP/quwX
+jzVExnVQ9a19zK546lCV6ldfJ0Wi8mc2FS0kimgVJ97ttvpCNfBFz0SEUzL9CtUX
+WTo8/fA0oltDJS9kKLDxGUFfzDDskxff21ujxqyvaC3u2eSwQnv12V00+VpONqjN
+lbpOJhKBfvzziMtgYVqqhG12d6gavLobmoz/xBeLrmg6AG6ZCdXnhZlsC4v+GRKM
+WvmImHhfqB/kkVsUO5cgXMpZhRrmtByts0PzJ1Be8fwJLkXR2oJTlNf5gPYEIOqG
+LMcxvJfGso5QwV9oV4ObtXhN9jXSgW5w8liyvM7LIQKBgQDNDUhan0EDFSYCJ4vt
+TvDmBUIvARncZWSClFFA1/wwUUHGPMcJo5FkOB59JWhW8+QCG/3TRszLkDJUy4O2
+MEGzivrEgjycxGkLZJ8KG1Jjuj14c7fCuUVTHtIJD4eBAsPfTypcuhoXl8YAHwxH
+hiQbCEORnjoys9dVO1jZgHFR5wKBgQDk4rYn+KQRLW6evk5pONa8zH4iRphH4xk6
+TrmMhuykJYQpK8URweBXGQpncsXbdV4z2wBjkxhWMm4Ona1iyCida2bBBkrkugM2
+g0JcbVX15Embfc6Hc5AMs6ZsnfADlFQUhS6jlFeE5VXNZQJTfloeyz+ICjoj/JDi
+Eu+ULShLqQKBgGxZpm/sUugUFr9wsim1WunQwYYg6M9i7Fdrk/vVpTbK2RytJOdc
+/Qid9s5eI+I+ga7zp44qjTDLgyz3VSPCIBWFTLjlsK2Nw4v3oWovwbtcv/qT+vfz
+kPPt2B+SjXLhkDLjjDtTbhFxKRvw4dPxGhcV4fsugfsq84ny+0yR67lAoGAQaiH
+eI/rAMJ3qTIObEDR2PcQd+SoanbLFd7fe2B5Id1hPC5CKgXjxRh505MpDvtsOpPo
+WKgpoxB0Ydz5kAy7Ge1lXJnhghuaMFkXAEydDBygwOomBNUxzXL7mszzvRMfy4Mp
+DePP91+SbYk8UZc9YvgLEYtdglVBepjUAT2zAYECgYAzSQC+vGDdBlSRemwy72Nm
+SJ1/2VKS94cMjCLfJ7+Q/TKxbH4t4PM8mbPYM21wkWZk+vUlDtK2p1DEnoFIIFdF
+f+oHJc6TpDuLAEmbbOkYv+QeXLNXC31AFlpusUYWPs/uqhq7R7Ymp61Y7XIcWH/t
+SW09F1L0b28LWYZOh38aug==
+-----END PRIVATE KEY-----
--- a/frontend/localhost+1.pem
+++ b/frontend/localhost+1.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEdDCCAtygAwIBAgIQZzySCYorx8yxVddqZLN0tDANBgkqhkiG9w0BAQsFADCB
+kzEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMTQwMgYDVQQLDCtyeWFu
+QG1hY2Jvb2sudGFpbGExNDZiMy50cy5uZXQgKFJ5YW4gS2VnZWwpMTswOQYDVQQD
+DDJta2NlcnQgcnlhbkBtYWNib29rLnRhaWxhMTQ2YjMudHMubmV0IChSeWFuIEtl
+Z2VsKTAeFw0yNjA0MzAwMTQyMjhaFw0yODA3MzAwMTQyMjhaMF8xJzAlBgNVBAoT
+Hm1rY2VydCBkZXZlbG9wbWVudCBjZXJ0aWZpY2F0ZTE0MDIGA1UECwwrcnlhbkBt
+YWNib29rLnRhaWxhMTQ2YjMudHMubmV0IChSeWFuIEtlZ2VsKTCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBALdVbBILdTmGc7GTOeO3MgqbO5Yn8G0SD7qW
+H2fUpKqOcXTpDaNePe7F9CapkGsgOGWFu3pl8ywdlb2Ug+wZfa9LDM2Fl30Cox2D
+Bkrs14uH4d3cUNOWvjGAOu3lFvoVAezyuDsOHV63B+fplMoTTmO2JnU8oRyLn1iS
+DC9h+u/09hSlcysBU1b44e2ce5FvfbN2Z9Cs0SqZapu/tRjb4UnFNIcaFhb3Zqxu
+du5y2eVtEuDrqnc+MZZgegFYXS1XBpoIqRFwep5BC75t+tdZjwA9Sjiiysjm2Xou
+S+YirznNNn3Or3aX0sb6dF6DAUo0duFIHZB/rYPhgf1f3WTlvn8CAwEAAaN3MHUw
+DgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB8GA1UdIwQYMBaA
+FLM+akEIDt75nyHZrbkUs/4IQWesMC0GA1UdEQQmMCSCCWxvY2FsaG9zdIIXUnlh
+bnMtTWFjQm9vay1BaXIubG9jYWwwDQYJKoZIhvcNAQELBQADggGBABF6bepj6zob
+9aZI69drzaKpYZ2kGFBuK91GawcNvGWfcP69ClT0ZfFG/UP7gkPyJgn4lCR8b909
+iGK9M8CZvAaNdZKtwXgfH+GNZZO+YiwymKrwX+/Vf+VgoDDdlhwtoQWX0Pn8nLL3
+qQCZcg5NduxybTtlZPZ5miAPPu63AvtUAwFlV1otrQPUs0baoEbY4URBwzRYn4Si
+NL3/It1PAYx6ulxc+ctEIDernaQbVzd22MWtY3hFOt/eFKSXPZfuCTk6PVmwGR/Q
+RPuDO7sGCzcSWpKEk/liMNhm3neVSXgFMouhMch0mgW3uqLV9A45MXs0+JVZcoK
+cJeo1p3GjJyWgtHSEPAcKtvaYyErU9tg18/pK9hKOxdVYl/OtusmNRfLQI8Vne/e
+tl7Id/hfP1lb1FAQFENEvlHHcOVeZFMgVcRnA3dV3HEaEFKXWAnYIaLVE7WPnasq
+E/774GpF3ONxJ0kGvy0f4gcrnO5UHwMgtbYL88UAvxNMa6kUd9+REw==
+-----END CERTIFICATE-----
--- a/frontend/nginx.http.conf.template
+++ b/frontend/nginx.http.conf.template
@@ -0,0 +1,37 @@
+events {}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    server {
+        client_max_body_size 2M;
+        listen 80;
+        server_name _;
+        root /usr/share/nginx/html;
+
+        location /api/ {
+            proxy_pass http://$BACKEND_HOST:5000/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location /events {
+            proxy_pass http://$BACKEND_HOST:5000/events;
+            proxy_set_header Host $host;
+            proxy_set_header Connection '';
+            proxy_http_version 1.1;
+            chunked_transfer_encoding off;
+            proxy_buffering off;
+            proxy_cache off;
+            proxy_read_timeout 36000s;
+            proxy_send_timeout 36000s;
+        }
+
+        location / {
+            try_files $uri $uri/ /index.html;
+        }
+    }
+}
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -16,7 +16,6 @@
        "@tsconfig/node22": "^22.0.2",
        "@types/jsdom": "^27.0.0",
        "@types/node": "^22.18.11",
-        "@vitejs/plugin-basic-ssl": "^2.3.0",
        "@vitejs/plugin-vue": "^6.0.1",
        "@vitest/eslint-plugin": "^1.3.23",
        "@vue/eslint-config-prettier": "^10.2.0",
@@ -2172,19 +2171,6 @@
        "url": "https://opencollective.com/eslint"
      }
    },
-    "node_modules/@vitejs/plugin-basic-ssl": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@vitejs/plugin-basic-ssl/-/plugin-basic-ssl-2.3.0.tgz",
-      "integrity": "sha512-bdyo8rB3NnQbikdMpHaML9Z1OZPBu6fFOBo+OtxsBlvMJtysWskmBcnbIDhUqgC8tcxNv/a+BcV5U+2nQMm1OQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^18.0.0 || ^20.0.0 || >=22.0.0"
-      },
-      "peerDependencies": {
-        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
-      }
-    },
    "node_modules/@vitejs/plugin-vue": {
      "version": "6.0.1",
      "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue/-/plugin-vue-6.0.1.tgz",
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -26,7 +26,6 @@
    "@tsconfig/node22": "^22.0.2",
    "@types/jsdom": "^27.0.0",
    "@types/node": "^22.18.11",
-    "@vitejs/plugin-basic-ssl": "^2.3.0",
    "@vitejs/plugin-vue": "^6.0.1",
    "@vitest/eslint-plugin": "^1.3.23",
    "@vue/eslint-config-prettier": "^10.2.0",
--- a/frontend/public/sw.js
+++ b/frontend/public/sw.js
@@ -1,4 +1,4 @@
-/* Service Worker for Reward App push notifications */
+/* Service Worker for Chorly push notifications */

 /* Activate immediately — no waiting for old tabs to close */
 self.addEventListener('install', function (event) {
@@ -16,18 +16,24 @@ self.addEventListener('push', function (event) {
  try {
    payload = event.data.json()
  } catch (e) {
-    payload = { title: 'Reward App', body: event.data.text() }
+    payload = { title: 'Chorly', body: event.data.text() }
  }

-  const title = payload.title || 'Reward App'
+  const title = payload.title || 'Chorly'
+  // Android Chrome has a bug where event.action is unreliable — only show Approve
+  // so tapping it always executes the correct action.
+  const isAndroidChrome =
+    /Android/.test(self.navigator.userAgent) && /Chrome\//.test(self.navigator.userAgent)
  // Expiry-warning notifications are informational only — no action buttons
  const actions =
    payload.type === 'chore_expiring_soon'
      ? []
-      : [
-          { action: 'approve', title: 'Approve' },
-          { action: 'deny', title: 'Deny' },
-        ]
+      : isAndroidChrome
+        ? [{ action: 'approve', title: 'Approve' }]
+        : [
+            { action: 'approve', title: 'Approve' },
+            { action: 'deny', title: 'Reject' },
+          ]
  const options = {
    body: payload.body || '',
    icon: '/icons/icon-192x192.png',
--- a/frontend/src/components/child/ChildView.vue
+++ b/frontend/src/components/child/ChildView.vue
@@ -452,6 +452,7 @@ function isChoreScheduledToday(item: ChildTask): boolean {
 }

 function isChoreExpired(item: ChildTask): boolean {
+  if (item.pending_status === 'pending') return false
  if (!item.schedule) return false
  const today = new Date()
  const due = getDueTimeToday(item.schedule, today)
--- a/frontend/src/components/child/ParentView.vue
+++ b/frontend/src/components/child/ParentView.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { ref, onMounted, onUnmounted, watch, nextTick } from 'vue'
+import { computed, ref, onMounted, onUnmounted, watch, nextTick } from 'vue'
 import ModalDialog from '../shared/ModalDialog.vue'
 import ScheduleModal from '../shared/ScheduleModal.vue'
 import PendingRewardDialog from './PendingRewardDialog.vue'
@@ -95,6 +95,14 @@ const kebabBtnRefs = ref<Map<string, HTMLElement>>(new Map())
 const showScheduleModal = ref(false)
 const scheduleTarget = ref<ChildTask | null>(null)

+const pendingDialogReward = computed<Reward | RewardStatus | null>(() => {
+  if (pendingEditOverrideTarget.value?.type === 'reward') {
+    return pendingEditOverrideTarget.value.entity as Reward
+  }
+
+  return selectedReward.value
+})
+
 // Expiry timers
 const expiryTimers = ref<number[]>([])

@@ -112,7 +120,6 @@ function handleChoreItemReady(itemId: string) {
 }

 function handleTaskTriggered(event: Event) {
-  console.log('Task triggered, refreshing rewards list -> ', childRewardListRef.value)
  const payload = event.payload as ChildTaskTriggeredEventPayload
  if (child.value && payload.child_id == child.value.id) {
    child.value.points = payload.points
@@ -450,6 +457,7 @@ function isChoreScheduledToday(item: ChildTask): boolean {
 }

 function isChoreExpired(item: ChildTask): boolean {
+  if (item.pending_status === 'pending') return false
  if (!item.schedule) return false
  const now = new Date()
  if (!isScheduledToday(item.schedule, now)) return false
@@ -633,6 +641,33 @@ function applyHighlightPulse(itemId: string) {
  }, 200)
 }

+// Handle digestToken appearing in route query (e.g. SW navigates to same route with new token)
+watch(
+  () => route.query.digestToken,
+  async (token) => {
+    if (typeof token !== 'string' || !token) return
+    try {
+      const res = await fetch(`/api/digest-action/${token}`, {
+        method: 'POST',
+        credentials: 'include',
+      })
+      const data = await res.json().catch(() => ({}))
+      console.log('[ParentView] digest-action POST status=', res.status, 'body=', data)
+    } catch (e) {
+      console.warn('[ParentView] Digest action request failed:', e)
+    }
+    // Refresh chore and reward lists to reflect the action result
+    childChoreListRef.value?.refresh()
+    childRewardListRef.value?.refresh()
+    if (child.value?.id) {
+      const updated = await fetchChildData(child.value.id)
+      if (updated) {
+        child.value = updated
+      }
+    }
+  },
+)
+
 onMounted(async () => {
  try {
    eventBus.on('child_task_triggered', handleTaskTriggered)
@@ -665,12 +700,8 @@ onMounted(async () => {
            method: 'POST',
            credentials: 'include',
          })
-          if (!res.ok) {
-            const data = await res.json().catch(() => ({}))
-            console.warn('Digest action failed:', data.error || res.status)
-          }
        } catch (e) {
-          console.warn('Digest action request failed:', e)
+          console.warn('[ParentView] onMounted digest action request failed:', e)
        }
      }

@@ -692,6 +723,8 @@ onMounted(async () => {
                childRewardListRef.value?.scrollToItem(scrollToId)
                applyHighlightPulse(scrollToId)
              }
+              const { scrollTo: _s, entityType: _e, ...remainingQuery } = route.query
+              router.replace({ query: remainingQuery })
            }, 500)
          }
        })
@@ -753,6 +786,7 @@ const triggerTask = (task: ChildTask) => {
  selectedTask.value = task
  const pendingRewardIds = getPendingRewardIds()
  if (pendingRewardIds.length > 0) {
+    selectedReward.value = null
    showPendingRewardDialog.value = true
    return
  }
@@ -817,13 +851,13 @@ const confirmTriggerTask = async () => {

 const triggerReward = (reward: RewardStatus) => {
  if (reward.points_needed > 0) return
+  selectedReward.value = reward
  // If there is a pending reward and it's not this one, show the pending dialog
  const pendingRewardIds = getPendingRewardIds()
  if (pendingRewardIds.length > 0 && !reward.redeeming) {
    showPendingRewardDialog.value = true
    return
  }
-  selectedReward.value = reward
  setTimeout(() => {
    showRewardConfirm.value = true
  }, 150)
@@ -1134,6 +1168,16 @@ function goToAssignRewards() {
    <!-- Pending Reward Dialog -->
    <PendingRewardDialog
      v-if="showPendingRewardDialog"
+      :reward-name="pendingDialogReward?.name"
+      :child-name="pendingDialogReward ? child?.name : undefined"
+      :image-url="pendingDialogReward?.image_url ?? null"
+      :subtitle="
+        pendingDialogReward
+          ? pendingDialogReward.points_needed === 0
+            ? 'Reward Ready!'
+            : pendingDialogReward.points_needed + ' more points'
+          : undefined
+      "
      :message="
        pendingEditOverrideTarget
          ? 'This reward is currently pending. Changing its cost will cancel the pending request. Would you like to proceed?'
@@ -1144,6 +1188,7 @@ function goToAssignRewards() {
        () => {
          showPendingRewardDialog = false
          pendingEditOverrideTarget = null
+          selectedReward = null
        }
      "
    />
--- a/frontend/src/components/child/PendingRewardDialog.vue
+++ b/frontend/src/components/child/PendingRewardDialog.vue
@@ -1,11 +1,18 @@
 <template>
-  <ModalDialog title="Warning!" @backdrop-click="$emit('cancel')">
-    <div class="modal-message">
-      {{ message }}
-    </div>
-    <div class="modal-actions">
-      <button @click="$emit('confirm')" class="btn btn-primary">Yes</button>
-      <button @click="$emit('cancel')" class="btn btn-secondary">No</button>
+  <ModalDialog @backdrop-click="$emit('cancel')">
+    <div class="approve-dialog">
+      <img v-if="imageUrl" :src="imageUrl" alt="Reward" class="reward-image" />
+      <p v-if="rewardName" class="item-label">{{ rewardName }}</p>
+      <p v-if="subtitle" class="subtitle">{{ subtitle }}</p>
+      <p v-if="rewardName && childName" class="message">
+        Redeem this reward for <strong>{{ childName }}</strong
+        >?
+      </p>
+      <p class="message">{{ message }}</p>
+      <div class="actions">
+        <button @click="$emit('confirm')" class="btn btn-primary">Approve</button>
+        <button @click="$emit('cancel')" class="btn btn-secondary">Reject</button>
+      </div>
    </div>
  </ModalDialog>
 </template>
@@ -16,9 +23,17 @@ import ModalDialog from '../shared/ModalDialog.vue'
 withDefaults(
  defineProps<{
    message?: string
+    rewardName?: string
+    childName?: string
+    imageUrl?: string | null
+    subtitle?: string
  }>(),
  {
    message: 'A reward is currently pending. It will be cancelled. Would you like to proceed?',
+    rewardName: undefined,
+    childName: undefined,
+    imageUrl: null,
+    subtitle: undefined,
  },
 )

@@ -29,9 +44,58 @@ defineEmits<{
 </script>

 <style scoped>
-.modal-message {
-  margin-bottom: 1.2rem;
+.approve-dialog {
+  text-align: center;
+  padding: 0.5rem;
+}
+
+.reward-image {
+  width: 72px;
+  height: 72px;
+  object-fit: cover;
+  border-radius: 8px;
+  background: var(--info-image-bg);
+  margin-bottom: 0.75rem;
+}
+
+.item-label {
+  font-size: 1.2rem;
+  font-weight: 700;
+  color: var(--dialog-child-name);
+  margin-bottom: 0.15rem;
+}
+
+.subtitle {
  font-size: 1rem;
-  color: var(--modal-message-color, #333);
+  font-weight: 600;
+  color: var(--dialog-child-name);
+  margin-bottom: 1rem;
+}
+
+.message {
+  font-size: 1rem;
+  color: var(--dialog-message);
+  margin-bottom: 0.15rem;
+}
+
+.message:last-of-type {
+  margin-bottom: 1.5rem;
+}
+
+.actions {
+  display: flex;
+  gap: 1.5rem;
+  justify-content: center;
+}
+
+.actions button {
+  padding: 0.7rem 1.8rem;
+  border-radius: 10px;
+  border: 0;
+  cursor: pointer;
+  font-weight: 700;
+  font-size: 1.05rem;
+  transition: background 0.18s;
+  min-width: 100px;
 }
 </style>
--- a/frontend/src/components/child/RewardConfirmDialog.vue
+++ b/frontend/src/components/child/RewardConfirmDialog.vue
@@ -1,19 +1,22 @@
 <template>
-  <ModalDialog
-    v-if="reward"
-    :imageUrl="reward.image_url"
-    :title="reward.name"
-    :subtitle="reward.points_needed === 0 ? 'Reward Ready!' : reward.points_needed + ' more points'"
-    @backdrop-click="$emit('cancel')"
-  >
-    <div class="modal-message">
-      Redeem this reward for <span class="child-name">{{ childName }}</span
-      >?
-    </div>
-    <div class="modal-actions">
-      <button @click="$emit('confirm')" class="btn btn-primary">Yes</button>
-      <button v-if="reward?.redeeming" @click="$emit('deny')" class="btn btn-danger">Deny</button>
-      <button @click="$emit('cancel')" class="btn btn-secondary">Cancel</button>
+  <ModalDialog v-if="reward" @backdrop-click="$emit('cancel')">
+    <div class="approve-dialog">
+      <img v-if="reward.image_url" :src="reward.image_url" alt="Reward" class="reward-image" />
+      <p class="item-label">{{ reward.name }}</p>
+      <p class="subtitle">
+        {{ reward.points_needed === 0 ? 'Reward Ready!' : reward.points_needed + ' more points' }}
+      </p>
+      <p class="message">
+        Redeem this reward for <strong>{{ childName }}</strong
+        >?
+      </p>
+      <div class="actions">
+        <button @click="$emit('confirm')" class="btn btn-primary">Yes</button>
+        <button v-if="reward.redeeming" @click="$emit('deny')" class="btn btn-secondary">
+          Reject
+        </button>
+        <button v-else @click="$emit('cancel')" class="btn btn-secondary">No</button>
+      </div>
    </div>
  </ModalDialog>
 </template>
@@ -35,14 +38,54 @@ defineEmits<{
 </script>

 <style scoped>
-.modal-message {
-  margin-bottom: 1.2rem;
-  font-size: 1rem;
-  color: var(--modal-message-color, #333);
+.approve-dialog {
+  text-align: center;
+  padding: 0.5rem;
 }

-.child-name {
+.reward-image {
+  width: 72px;
+  height: 72px;
+  object-fit: cover;
+  border-radius: 8px;
+  background: var(--info-image-bg);
+  margin-bottom: 0.75rem;
+}
+
+.item-label {
+  font-size: 1.2rem;
+  font-weight: 700;
+  color: var(--dialog-child-name);
+  margin-bottom: 0.15rem;
+}
+
+.subtitle {
+  font-size: 1rem;
  font-weight: 600;
-  color: var(--text-primary, #333);
+  color: var(--dialog-child-name);
+  margin-bottom: 1rem;
+}
+
+.message {
+  font-size: 1rem;
+  color: var(--dialog-message);
+  margin-bottom: 1.5rem;
+}
+
+.actions {
+  display: flex;
+  gap: 1.5rem;
+  justify-content: center;
+}
+
+.actions button {
+  padding: 0.7rem 1.8rem;
+  border-radius: 10px;
+  border: 0;
+  cursor: pointer;
+  font-weight: 700;
+  font-size: 1.05rem;
+  transition: background 0.18s;
+  min-width: 100px;
 }
 </style>
--- a/frontend/src/components/shared/ModalDialog.vue
+++ b/frontend/src/components/shared/ModalDialog.vue
@@ -1,6 +1,6 @@
 <template>
  <div class="modal-backdrop" @click.self="$emit('backdrop-click')">
-    <div class="modal-dialog">
+    <div class="modal-dialog" :style="{ maxWidth: dialogMaxWidth }">
      <div class="modal-heading">
        <img v-if="imageUrl" :src="imageUrl" alt="Dialog Image" class="modal-image" />
        <div class="modal-details">
@@ -18,6 +18,7 @@ defineProps<{
  imageUrl?: string | null | undefined
  title?: string
  subtitle?: string | null | undefined
+  dialogMaxWidth?: string
 }>()

 defineEmits<{
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -1,23 +1,44 @@
 import { fileURLToPath, URL } from 'node:url'
 import { defineConfig, loadEnv } from 'vite'
 import vue from '@vitejs/plugin-vue'
-import basicSsl from '@vitejs/plugin-basic-ssl'
 import fs from 'fs'

 export default defineConfig(({ mode }) => {
  const env = loadEnv(mode, process.cwd(), '')
  const backendHost = env.VITE_BACKEND_HOST ?? '127.0.0.1'

-  const httpsConfig =
-    fs.existsSync('./key.pem') && fs.existsSync('./cert.pem')
-      ? { key: fs.readFileSync('./key.pem'), cert: fs.readFileSync('./cert.pem') }
-      : undefined
+  // Use a trusted mkcert cert when present; otherwise fall back to plain HTTP.
+  // Browsers treat localhost as a secure context even over HTTP, so service
+  // workers and push notifications work without any cert on localhost.
+  //
+  // For cross-device LAN testing (e.g. from a phone), run mkcert once per
+  // network — the IP in the cert doesn't matter to Vite, just drop the files
+  // in frontend/ and they'll be picked up automatically:
+  //
+  //   mkcert localhost <your-current-lan-ip>
+  //   # files are auto-detected; no renaming needed
+  //
+  // All *.pem files are gitignored so they stay machine-local.
+  const httpsConfig = (() => {
+    // Prefer explicit key.pem / cert.pem (e.g. custom or renamed certs)
+    if (fs.existsSync('./key.pem') && fs.existsSync('./cert.pem'))
+      return { key: fs.readFileSync('./key.pem'), cert: fs.readFileSync('./cert.pem') }
+    // Auto-detect any mkcert-generated *-key.pem / *.pem pair in this directory.
+    // mkcert always names files <host>[-key].pem regardless of which IPs are included.
+    const keyFile = fs.readdirSync('.').find((f) => f.endsWith('-key.pem'))
+    if (keyFile) {
+      const certFile = keyFile.replace('-key.pem', '.pem')
+      if (fs.existsSync(certFile))
+        return { key: fs.readFileSync(keyFile), cert: fs.readFileSync(certFile) }
+    }
+    return undefined
+  })()

  return {
-    plugins: [vue(), basicSsl()],
+    plugins: [vue()],
    server: {
      host: '0.0.0.0',
-      https: httpsConfig ?? true,
+      https: httpsConfig,
      proxy: {
        '/api': {
          target: `http://${backendHost}:5000`,
@@ -25,7 +46,7 @@ export default defineConfig(({ mode }) => {
          rewrite: (path) => path.replace(/^\/api/, ''),
        },
        '/events': {
-          target: 'http://192.168.1.102:5000',
+          target: `http://${backendHost}:5000`,
          changeOrigin: true,
          secure: false,
        },
Author	SHA1	Message	Date
Ryan Kegel	75d3d6dc39	feat: set FRONTEND_SSL_ENABLED to false in docker-compose.yml All checks were successful Chore App Build, Test, and Push Docker Images / build-and-push (push) Successful in 2m19s Details Co-authored-by: Copilot <copilot@github.com>	2026-05-02 14:00:28 -04:00
Ryan Kegel	3d882656e3	feat: set FRONTEND_SSL_ENABLED to false in docker-compose.yml All checks were successful Chore App Build, Test, and Push Docker Images / build-and-push (push) Successful in 2m19s Details	2026-05-02 13:41:55 -04:00
Ryan Kegel	8308d205e8	feat: update reward version to 1.0.13 and modify dialog button labels for clarity All checks were successful Chore App Build, Test, and Push Docker Images / build-and-push (push) Successful in 2m31s Details	2026-05-01 23:32:17 -04:00
Ryan Kegel	e77254eabf	feat: add dynamic dialog max width to ModalDialog component All checks were successful Chore App Build, Test, and Push Docker Images / build-and-push (push) Successful in 2m45s Details	2026-05-01 18:49:48 -04:00
Ryan Kegel	a68a86a6a6	feat: add dynamic dialog max width to ModalDialog component Some checks failed Chore App Build, Test, and Push Docker Images / build-and-push (push) Has been cancelled Details	2026-05-01 18:49:40 -04:00
Ryan Kegel	4ac83dcf17	feat: enhance push notification service worker for chore expirations and update related configurations All checks were successful Chore App Build, Test, and Push Docker Images / build-and-push (push) Successful in 2m49s Details	2026-05-01 15:39:01 -04:00
Ryan Kegel	ab0d32c6b0	feat: enhance push notification service worker for chore expirations and update related configurations Some checks failed Chore App Build, Test, and Push Docker Images / build-and-push (push) Failing after 2m22s Details	2026-05-01 15:34:56 -04:00