golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(19.7): persist human verification items as UAT

Browse Source
This commit is contained in:
Jakub Zych
2026-10-23 22:05:28 +02:00
parent 94ee2cee03
commit 85a137df24
1 changed files with 48 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
.planning/phases/19.7-generic-mcp-module/19.7-UAT.md Normal file
View File

@@ -0,0 +1,48 @@
---
status: testing
phase: 19.7-generic-mcp-module
source: [19.7-VERIFICATION.md]
started: 2026-10-23T20:05:22.930Z
updated: 2026-10-23T20:05:22.930Z
---
## Current Test
number: 1
name: Decide on SC-3's wording: frontend tool filtering uses group grants (what user.permission enforces), not MergedPermissions (groups plus the user's own allow/deny). Accept the override below, or ask for MergedPermissions in both the route middleware and the MCP guard (a behaviour change of a core plugin).
expected: |
An override entry is added to this frontmatter (suggested YAML in the report), or a follow-up is opened
awaiting: user response
## Tests
### 1. Decide on SC-3's wording: frontend tool filtering uses group grants (what user.permission enforces), not MergedPermissions (groups plus the user's own allow/deny). Accept the override below, or ask for MergedPermissions in both the route middleware and the MCP guard (a behaviour change of a core plugin).
expected: An override entry is added to this frontmatter (suggested YAML in the report), or a follow-up is opened
result: [pending]
### 2. Real MCP client against the local demo (DEPLOY.md, 'MCP endpoint', 'Locally'): add http://127.0.0.1:8097/mcp to Claude Code or Claude Desktop, sign in on /connect as a frontend user asking for backend, see only user_me; in the admin's My account start 'Link frontend account', finish on /link-admin with a fresh sign-in, reconnect (consent shows 'also act as admin <name>'), see the journal_ tools, create a draft post and find it in the admin; unlink and see the journal_ tools disappear.
expected: One connector, one OAuth sign-in; journal_ tools appear only with a verified link plus the backend scope and disappear after unlinking (the session ends, a new session lists user_me only)
result: [pending]
### 3. Consent page with a changed link, in a browser: open /connect for a request asking for backend, then change the user's link to another administrator (Administrators screen) before clicking Allow.
expected: The decision answers 409 backend_link_changed, the page reloads the request and shows the linkChanged notice naming the new administrator; no grant is issued for the old one
result: [pending]
### 4. Link page 'Signed in as', in a browser: start 'Link frontend account' on My account, open the #code=... URL while signed in as a different frontend user than intended.
expected: /link-admin shows the request and 'Signed in as <email>' before the confirm button, keeps the code across a sign-in (sessionStorage), and a session older than the request gets the stale-session message
result: [pending]
### 5. RB-WR-01 in Firefox: in the admin, on a record form with a plugin field type that renders inside a shadow root (taglist or another widget), type into the inner input and press Ctrl+S (and Ctrl+Enter) with a pending taglist draft.
expected: The pending draft is committed before the save; plain keys typed inside the shadow root (letters, Esc, /, ?) trigger no shortcut
result: [pending]
## Summary
total: 5
passed: 0
issues: 0
pending: 5
skipped: 0
blocked: 0
## Gaps