golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(19.7): accept the SC-3 group-grant override in UAT

Browse Source
This commit is contained in:
Jakub Zych
2026-10-24 00:17:04 +02:00
parent b8e7ba9d4f
commit eb9a62a5ec
2 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
.planning/phases/19.7-generic-mcp-module/19.7-UAT.md
View File

@@ -3,22 +3,23 @@ status: testing
phase: 19.7-generic-mcp-module phase: 19.7-generic-mcp-module
source: [19.7-VERIFICATION.md] source: [19.7-VERIFICATION.md]
started: 2026-10-23T20:05:22.930Z started: 2026-10-23T20:05:22.930Z
updated: 2026-10-23T20:05:22.930Z updated: 2026-10-23T22:17:04Z
--- ---
## Current Test ## Current Test
number: 1 number: 2
name: Decide on SC-3's wording: frontend tool filtering uses group grants (what user.permission enforces), not MergedPermissions (groups plus the user's own allow/deny). Accept the override below, or ask for MergedPermissions in both the route middleware and the MCP guard (a behaviour change of a core plugin). name: Real MCP client against the local demo (DEPLOY.md, 'MCP endpoint', 'Locally'): add http://127.0.0.1:8097/mcp to Claude Code or Claude Desktop, sign in on /connect as a frontend user asking for backend, see only user_me; in the admin's My account start 'Link frontend account', finish on /link-admin with a fresh sign-in, reconnect (consent shows 'also act as admin <name>'), see the journal_ tools, create a draft post and find it in the admin; unlink and see the journal_ tools disappear.
expected: | expected: |
An override entry is added to this frontmatter (suggested YAML in the report), or a follow-up is opened One connector, one OAuth sign-in; journal_ tools appear only with a verified link plus the backend scope and disappear after unlinking (the session ends, a new session lists user_me only)
awaiting: user response awaiting: user response
## Tests ## Tests
### 1. Decide on SC-3's wording: frontend tool filtering uses group grants (what user.permission enforces), not MergedPermissions (groups plus the user's own allow/deny). Accept the override below, or ask for MergedPermissions in both the route middleware and the MCP guard (a behaviour change of a core plugin). ### 1. Decide on SC-3's wording: frontend tool filtering uses group grants (what user.permission enforces), not MergedPermissions (groups plus the user's own allow/deny). Accept the override below, or ask for MergedPermissions in both the route middleware and the MCP guard (a behaviour change of a core plugin).
expected: An override entry is added to this frontmatter (suggested YAML in the report), or a follow-up is opened expected: An override entry is added to this frontmatter (suggested YAML in the report), or a follow-up is opened
result: [pending] result: pass
note: override accepted in 19.7-VERIFICATION.md (SC-3 group-grant wording)
### 2. Real MCP client against the local demo (DEPLOY.md, 'MCP endpoint', 'Locally'): add http://127.0.0.1:8097/mcp to Claude Code or Claude Desktop, sign in on /connect as a frontend user asking for backend, see only user_me; in the admin's My account start 'Link frontend account', finish on /link-admin with a fresh sign-in, reconnect (consent shows 'also act as admin <name>'), see the journal_ tools, create a draft post and find it in the admin; unlink and see the journal_ tools disappear. ### 2. Real MCP client against the local demo (DEPLOY.md, 'MCP endpoint', 'Locally'): add http://127.0.0.1:8097/mcp to Claude Code or Claude Desktop, sign in on /connect as a frontend user asking for backend, see only user_me; in the admin's My account start 'Link frontend account', finish on /link-admin with a fresh sign-in, reconnect (consent shows 'also act as admin <name>'), see the journal_ tools, create a draft post and find it in the admin; unlink and see the journal_ tools disappear.
expected: One connector, one OAuth sign-in; journal_ tools appear only with a verified link plus the backend scope and disappear after unlinking (the session ends, a new session lists user_me only) expected: One connector, one OAuth sign-in; journal_ tools appear only with a verified link plus the backend scope and disappear after unlinking (the session ends, a new session lists user_me only)
@@ -39,9 +40,9 @@ result: [pending]
## Summary ## Summary
total: 5 total: 5
passed: 0 passed: 1
issues: 0 issues: 0
pending: 5 pending: 4
skipped: 0 skipped: 0
blocked: 0 blocked: 0

7
.planning/phases/19.7-generic-mcp-module/19.7-VERIFICATION.md
View File

File diff suppressed because one or more lines are too long