golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(19.3): persist human verification items as UAT

Browse Source
This commit is contained in:
Jakub Zych
2026-10-15 23:11:05 +02:00
parent 56fe2ae372
commit 694a565941
1 changed files with 44 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
.planning/phases/19.3-framework-transport-and-infrastructure-for-wavepath/19.3-UAT.md Normal file
View File

@@ -0,0 +1,44 @@
---
status: testing
phase: 19.3-framework-transport-and-infrastructure-for-wavepath
source: [19.3-VERIFICATION.md]
started: 2026-10-15T21:11:00.207Z
updated: 2026-10-15T21:11:00.207Z
---
## Current Test
number: 1
name: Cookie refresh across real api/www subdomains in a browser. Deploy to staging with auth.cookie.domain set to the parent domain and cors:<profile> (or http.cors) credentialed for the www origin. Log in on www, wait past the access TTL.
expected: |
The SPA reads the 401, the refresh call sends the cookie, the rotated cookie replaces the old one, the replayed old token answers 401.
awaiting: user response
## Tests
### 1. Cookie refresh across real api/www subdomains in a browser. Deploy to staging with auth.cookie.domain set to the parent domain and cors:<profile> (or http.cors) credentialed for the www origin. Log in on www, wait past the access TTL.
expected: The SPA reads the 401, the refresh call sends the cookie, the rotated cookie replaces the old one, the replayed old token answers 401.
result: [pending]
### 2. S3-compatible upload. Build with build.tags [summercms_s3], set storage bucket_url s3://...?endpoint=..., upload a public file, fetch it via storage.uploads.public_url and via /storage/uploads; try a protected (is_public false) upload with public_url set.
expected: Both URLs serve the public file; the protected upload is refused with attach.ErrProtectedNeedsPrivateBucket (admin answers the opaque 500 and logs the reason).
result: [pending]
### 3. Live Nuxt purge. Save a menu entry and a FAQ entry in admin against a running Nuxt site using the 0.3.0/0.5.0 layers; for a proxied deployment set NUXT_SITE_CACHE_ALLOW_PROXIED=true.
expected: The page updates without waiting for the 300 s SWR TTL; the app log shows 'cooler: site cache purged' after the save returned.
result: [pending]
### 4. Swagger UI under its new nonce-only CSP. Enable http.api_docs, open /api-docs in a browser.
expected: The UI renders the spec with no CSP violations in the console (script-src is now only 'nonce-...').
result: [pending]
## Summary
total: 4
passed: 0
issues: 0
pending: 4
skipped: 0
blocked: 0
## Gaps