From 815cb903c684b25dca4eda81e61800c6351430f3 Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Sun, 27 Sep 2026 18:44:38 +0200 Subject: [PATCH] test(10): persist human verification items as UAT --- .planning/phases/10-admin-vue-spa/10-UAT.md | 56 +++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 .planning/phases/10-admin-vue-spa/10-UAT.md diff --git a/.planning/phases/10-admin-vue-spa/10-UAT.md b/.planning/phases/10-admin-vue-spa/10-UAT.md new file mode 100644 index 0000000..9d8c1af --- /dev/null +++ b/.planning/phases/10-admin-vue-spa/10-UAT.md @@ -0,0 +1,56 @@ +--- +status: testing +phase: 10-admin-vue-spa +source: [10-VERIFICATION.md] +started: 2026-09-27T16:44:38Z +updated: 2026-09-27T16:44:38Z +--- + +## Current Test + +number: 1 +name: Decide CR-01 (refresh ignores tokens_valid_after / is_activated) +expected: | + Secure behavior: after `summer admin:reset-password ` and access-token expiry, the SPA lands on the login screen. Current code silently refreshes and keeps working for up to refresh_ttl (14 days). Decide: fix now, or accept with override plus follow-up. +awaiting: user response + +## Tests + +### 1. Decide CR-01 (refresh ignores tokens_valid_after / is_activated) +expected: Fix now or accept with override. Secure behavior is a redirect to login after password reset and token expiry. +result: [pending] + +### 2. Limited admin vs superuser navigation at /plytadmin +expected: Limited admin (only golem15.fonoteka.access_genres) sees only fonoteka > Genres, no Ustawienia. Superuser sees Albums, Collections, Genres, Styles, Artists plus Ustawienia. +result: [pending] + +### 3. Walkthrough of the five controllers and Ustawienia +expected: Every list and form renders from its YAML. Search, sort, filter, paging and bulk delete work. Save shows a toast. 422 errors appear under the right fields. Albums genre/artists relations and Ustawienia > search_use_typesense work. +result: [pending] + +### 4. Collection editors link/unlink round trip +expected: The picker shows 5 per page with the owner excluded. Dodaj (N) is disabled at 0. Linking refreshes the list and shows a plural toast. Unlink asks for confirmation and removes the row. The focus trap and Esc work. The relation manager does not appear on the create form. +result: [pending] + +### 5. Visual check in light/dark at desktop and ~900px +expected: Matches .planning/phases/10-admin-vue-spa/design. The sidebar stays dark. Below ~1100px the panel collapses to the rail, and the flyout opens on hover/focus, closes on Esc and returns focus. +result: [pending] + +### 6. Secure cookie on http://localhost (assumption A3) +expected: With backend.cookie_secure at its default, Chrome and Firefox store summer_admin on http://localhost and the session works. +result: [pending] + +### 7. Review the 17 judgment-tier prohibitions in 10-VERIFICATION.md +expected: Accept or reject the verifier's "not violated" verdicts. +result: [pending] + +## Summary + +total: 7 +passed: 0 +issues: 0 +pending: 7 +skipped: 0 +blocked: 0 + +## Gaps