From 4d32d963958d1fe860cdf3f68e3871d301211176 Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Mon, 19 Oct 2026 22:14:39 +0200 Subject: [PATCH] test(19.4): persist human verification items as UAT --- .../19.4-UAT.md | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 .planning/phases/19.4-oidc-provider-on-wristband/19.4-UAT.md diff --git a/.planning/phases/19.4-oidc-provider-on-wristband/19.4-UAT.md b/.planning/phases/19.4-oidc-provider-on-wristband/19.4-UAT.md new file mode 100644 index 00000000..1ac372e5 --- /dev/null +++ b/.planning/phases/19.4-oidc-provider-on-wristband/19.4-UAT.md @@ -0,0 +1,40 @@ +--- +status: testing +phase: 19.4-oidc-provider-on-wristband +source: [19.4-VERIFICATION.md] +started: 2026-10-19T20:14:35.407Z +updated: 2026-10-19T20:14:35.407Z +--- + +## Current Test + +number: 1 +name: Run the plugin in a local application (or keep the test harness server alive), set a site name, a logo and an accent colour in row 1 of golem15_oauthserver_settings, open an authorize URL for a test client, then open the inactive-client error page. Compare both side by side with the PHP consent.htm and error.htm pages in a browser. +expected: | + Same structure and copy as PHP, branding (name, logo, colours, font, custom CSS) applied, error heading in the fixed danger colour #B91C1C. +awaiting: user response + +## Tests + +### 1. Run the plugin in a local application (or keep the test harness server alive), set a site name, a logo and an accent colour in row 1 of golem15_oauthserver_settings, open an authorize URL for a test client, then open the inactive-client error page. Compare both side by side with the PHP consent.htm and error.htm pages in a browser. +expected: Same structure and copy as PHP, branding (name, logo, colours, font, custom CSS) applied, error heading in the fixed danger colour #B91C1C. +result: [pending] + +### 2. Open the Clients and Branding screens in the embedded admin SPA as an administrator with manage_clients and manage_settings: create a client, check the one-time secret reveal callout, the scopes taglist, the authorized-users table on the form, the regenerate-secret danger button, and the Settings link to Branding with the logo upload. +expected: Both screens render usably; the secret shows once and not on reload; regenerate asks for confirmation. +result: [pending] + +### 3. Review the LLM-judge verdicts on the 11 judgment-tier prohibitions in the 'Prohibitions' section of this report and confirm or reject each. +expected: Each prohibition held as stated (the verifier found evidence for all 11). +result: [pending] + +## Summary + +total: 3 +passed: 0 +issues: 0 +pending: 3 +skipped: 0 +blocked: 0 + +## Gaps