golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
1ea63ef1ee8c95c7c04bf03e17c6e05fe4672ea5
summercms/.planning/phases/10-admin-vue-spa/10-VERIFICATION.md

435 lines
30 KiB
Markdown
Raw Blame History

---
phase: 10-admin-vue-spa
verified: 2026-10-01T21:29:59Z
status: human_needed
score: 4/4 roadmap success criteria verified by automated evidence (plan truths 46/46; 1 browser re-check of changed views pending)
covered_files:
- ".gitignore"
- ".planning/phases/10-admin-vue-spa/10-01-PLAN.md"
- ".planning/phases/10-admin-vue-spa/10-01-SUMMARY.md"
- ".planning/phases/10-admin-vue-spa/10-02-PLAN.md"
- ".planning/phases/10-admin-vue-spa/10-02-SUMMARY.md"
- ".planning/phases/10-admin-vue-spa/10-03-PLAN.md"
- ".planning/phases/10-admin-vue-spa/10-03-SUMMARY.md"
- ".planning/phases/10-admin-vue-spa/10-04-PLAN.md"
- ".planning/phases/10-admin-vue-spa/10-04-SUMMARY.md"
- ".planning/phases/10-admin-vue-spa/10-05-PLAN.md"
- ".planning/phases/10-admin-vue-spa/10-05-SUMMARY.md"
- "admin/env.d.ts"
- "admin/index.html"
- "admin/openapi/admin.json"
- "admin/package-lock.json"
- "admin/package.json"
- "admin/src/App.vue"
- "admin/src/api/client.ts"
- "admin/src/api/schema.d.ts"
- "admin/src/api/types.ts"
- "admin/src/app/controllerRoutes.ts"
- "admin/src/app/i18n.ts"
- "admin/src/app/icons.ts"
- "admin/src/app/listQuery.ts"
- "admin/src/app/router.ts"
- "admin/src/app/runtime.ts"
- "admin/src/app/theme.ts"
- "admin/src/app/winterUrl.ts"
- "admin/src/components/form/FieldRenderer.vue"
- "admin/src/components/form/FormErrorBanner.vue"
- "admin/src/components/form/FormField.vue"
- "admin/src/components/form/FormGrid.vue"
- "admin/src/components/form/FormTabs.vue"
- "admin/src/components/form/control.ts"
- "admin/src/components/form/fields/CheckboxField.vue"
- "admin/src/components/form/fields/DropdownField.vue"
- "admin/src/components/form/fields/NumberField.vue"
- "admin/src/components/form/fields/RelationField.vue"
- "admin/src/components/form/fields/SwitchField.vue"
- "admin/src/components/form/fields/TextField.vue"
- "admin/src/components/form/fields/TextareaField.vue"
- "admin/src/components/form/fields/UnsupportedField.vue"
- "admin/src/components/form/formState.ts"
- "admin/src/components/form/registry.ts"
- "admin/src/components/list/CellValue.vue"
- "admin/src/components/list/DataTable.vue"
- "admin/src/components/list/FilterBar.vue"
- "admin/src/components/list/ListToolbar.vue"
- "admin/src/components/list/Pagination.vue"
- "admin/src/components/relation/RelationManager.vue"
- "admin/src/components/relation/RelationPickerModal.vue"
- "admin/src/components/shell/AppShell.vue"
- "admin/src/components/shell/Breadcrumbs.vue"
- "admin/src/components/shell/PluginRail.vue"
- "admin/src/components/shell/SectionFlyout.vue"
- "admin/src/components/shell/SectionPanel.vue"
- "admin/src/components/shell/UserMenu.vue"
- "admin/src/components/ui/Button.vue"
- "admin/src/components/ui/ConfirmDialog.vue"
- "admin/src/components/ui/Toast.vue"
- "admin/src/components/ui/confirm.ts"
- "admin/src/main.ts"
- "admin/src/state/useAuth.ts"
- "admin/src/state/useBreadcrumbs.ts"
- "admin/src/state/useNavigation.ts"
- "admin/src/state/useSettings.ts"
- "admin/src/state/useSidebar.ts"
- "admin/src/state/useToasts.ts"
- "admin/src/styles/main.css"
- "admin/src/views/FormView.vue"
- "admin/src/views/ListView.vue"
- "admin/src/views/LoginView.vue"
- "admin/src/views/NotFoundView.vue"
- "admin/src/views/SettingsFormView.vue"
- "admin/src/views/SettingsIndexView.vue"
- "admin/tests/app/client.test.ts"
- "admin/tests/app/controllerRoutes.test.ts"
- "admin/tests/app/i18n.test.ts"
- "admin/tests/app/icons.test.ts"
- "admin/tests/app/listQuery.test.ts"
- "admin/tests/app/router.test.ts"
- "admin/tests/app/runtime.test.ts"
- "admin/tests/app/theme.test.ts"
- "admin/tests/app/winterUrl.test.ts"
- "admin/tests/fixtures/lang.json"
- "admin/tests/fixtures/navigation.json"
- "admin/tests/fixtures/settings.json"
- "admin/tests/fixtures/typed.ts"
- "admin/tests/fixtures/widgets.form-schema.json"
- "admin/tests/fixtures/widgets.list-schema.json"
- "admin/tests/fixtures/widgets.list.json"
- "admin/tests/fixtures/widgets.options.json"
- "admin/tests/fixtures/widgets.record.json"
- "admin/tests/fixtures/widgets.relation-candidates.json"
- "admin/tests/fixtures/widgets.relation-linked.json"
- "admin/tests/fixtures/widgets.relation-schema.json"
- "admin/tests/form/FormField.test.ts"
- "admin/tests/form/FormGrid.test.ts"
- "admin/tests/form/FormTabs.test.ts"
- "admin/tests/form/FormView.test.ts"
- "admin/tests/form/RelationField.test.ts"
- "admin/tests/form/Settings.test.ts"
- "admin/tests/form/fields.test.ts"
- "admin/tests/form/formState.test.ts"
- "admin/tests/form/registry.test.ts"
- "admin/tests/helpers.ts"
- "admin/tests/list/CellValue.test.ts"
- "admin/tests/list/DataTable.test.ts"
- "admin/tests/list/FilterBar.test.ts"
- "admin/tests/list/ListToolbar.test.ts"
- "admin/tests/list/ListView.test.ts"
- "admin/tests/list/Pagination.test.ts"
- "admin/tests/relation/RelationManager.test.ts"
- "admin/tests/relation/RelationPickerModal.test.ts"
- "admin/tests/setup.ts"
- "admin/tests/shell/AppShell.test.ts"
- "admin/tests/shell/Breadcrumbs.test.ts"
- "admin/tests/shell/PluginRail.test.ts"
- "admin/tests/shell/SectionFlyout.test.ts"
- "admin/tests/shell/SectionPanel.test.ts"
- "admin/tests/shell/UserMenu.test.ts"
- "admin/tests/smoke/edit.smoke.test.ts"
- "admin/tests/smoke/form.smoke.test.ts"
- "admin/tests/smoke/list.smoke.test.ts"
- "admin/tests/smoke/relation.smoke.test.ts"
- "admin/tests/smoke/settings.smoke.test.ts"
- "admin/tests/smoke/shell.smoke.test.ts"
- "admin/tests/smoke/tracer.smoke.test.ts"
- "admin/tests/state/useAuth.test.ts"
- "admin/tests/state/useBreadcrumbs.test.ts"
- "admin/tests/state/useNavigation.test.ts"
- "admin/tests/state/useSettings.test.ts"
- "admin/tests/state/useSidebar.test.ts"
- "admin/tests/state/useToasts.test.ts"
- "admin/tests/ui/ui.test.ts"
- "admin/tests/views/App.test.ts"
- "admin/tests/views/LoginView.test.ts"
- "admin/tsconfig.json"
- "admin/vite.config.ts"
- "admin/vitest.config.ts"
- "go.mod"
- "internal/build/build_test.go"
- "internal/build/stubs/artifacts.tmpl"
- "internal/tools/swagger2openapi/main.go"
- "internal/tools/swagger2openapi/main_test.go"
- "modules/boardwalk/boardwalk.go"
- "modules/boardwalk/boardwalk_test.go"
- "modules/boardwalk/dist/assets/index-CfeX_snf.css"
- "modules/boardwalk/dist/assets/index-J-FCndLr.js"
- "modules/boardwalk/dist/index.html"
- "modules/bouncer/cookie_guard_test.go"
- "modules/bouncer/jwt.go"
- "modules/bouncer/jwt_guard_test.go"
- "modules/bouncer/refresh.go"
- "modules/bouncer/refresh_test.go"
- "modules/bouncer/registry_test.go"
- "modules/cabana/admin_openapi.go"
- "modules/cabana/admin_paths_test.go"
- "modules/cabana/auth.go"
- "modules/cabana/auth_test.go"
- "modules/cabana/bulk_test.go"
- "modules/cabana/commands_test.go"
- "modules/cabana/contracts.go"
- "modules/cabana/crud.go"
- "modules/cabana/crud_lifecycle_test.go"
- "modules/cabana/csrf.go"
- "modules/cabana/export_test.go"
- "modules/cabana/filter_options_test.go"
- "modules/cabana/filter_schema.go"
- "modules/cabana/form_schema.go"
- "modules/cabana/form_schema_test.go"
- "modules/cabana/http.go"
- "modules/cabana/lang.go"
- "modules/cabana/list_schema.go"
- "modules/cabana/list_schema_test.go"
- "modules/cabana/messages.go"
- "modules/cabana/messages_test.go"
- "modules/cabana/openapi_conformance_test.go"
- "modules/cabana/phase09_contract_test.go"
- "modules/cabana/phase10_auth_test.go"
- "modules/cabana/phase10_coverage_test.go"
- "modules/cabana/phase10_csrf_test.go"
- "modules/cabana/prefix.go"
- "modules/cabana/query_test.go"
- "modules/cabana/refresh_revocation_test.go"
- "modules/cabana/registry.go"
- "modules/cabana/relation.go"
- "modules/cabana/relation_field.go"
- "modules/cabana/relation_field_test.go"
- "modules/cabana/schema_types.go"
- "modules/cabana/security_coverage_test.go"
- "modules/cabana/security_test.go"
- "modules/pact/capabilities.go"
- "modules/phrasebook/backend/lang/en/lang.yaml"
- "modules/phrasebook/backend/lang/pl/lang.yaml"
- "modules/phrasebook/lang.go"
- "modules/phrasebook/loader.go"
- "modules/phrasebook/phase10_test.go"
- "modules/phrasebook/translator.go"
- "modules/phrasebook/translator_test.go"
- "modules/surf/admin_prefix_test.go"
- "modules/surf/cors_coverage_test.go"
- "modules/surf/cors_test.go"
- "modules/surf/middleware_test.go"
- "modules/surf/router.go"
- "modules/surf/router_test.go"
- "scripts/check-admin-dist.sh"
- "scripts/check-admin-openapi.sh"
- "scripts/check-phase10.sh"
covered_digest: "v2:sha256:f23b588ee19dd2c8ff9456435821e3870aab30f1f869831797c679120d61c730"
covered_files_note: "Paths are root-relative at summercms.go HEAD f2f2279. The 59 framework paths that Phase 10.2 (5e50b16) moved are listed under modules/. The two current hashed SPA bundles are now covered as well. fonoteka.go files are outside the project root and cannot be fingerprinted. They were checked at fonoteka.go HEAD e62f4fc (clean working tree) and are listed in the report body."
behavior_unverified: 0
overrides_applied: 0
mvp_mode_note: "ROADMAP marks Phase 10 mode: mvp, but the goal is not a User Story. Following the Phase 1/3/5/8 precedent, the four ROADMAP success criteria are the contract and User Flow Coverage is derived from them."
decision_coverage:
honored: 28
total: 28
not_honored: []
re_verification:
previous_status: passed
previous_score: "4/4 roadmap success criteria verified (plan truths 46/46 verified; A3 closed by human UAT)"
previous_head: c7487f6
reason: "Stale. Phase 10.2 moved 59 covered paths under modules/. Phases 10.1, 11 and the Phase 9 review fixes changed covered code."
gaps_closed:
- "Phase 10 review WR-01 (logout behind the guard did not expire a rejected cookie): logout is now mounted outside the guard and always clears the cookie (299d220). TestAdminLogoutRevokesExpiredRefreshableToken: PASS."
gaps_remaining: []
regressions: []
human_verification:
- test: "Re-walk the Phase 10 admin flows in a real browser on the current build: run the fonoteka binary, open /plytadmin as a superuser and as a genres-only admin, then use the list and form of each of the five controllers (search, sort, filter, paging, save, 422 field errors), link and unlink a Collection editor, open Ustawienia, and glance at light and dark mode."
expected: "Everything still behaves as approved in 10-UAT.md tests 2 to 5. The limited admin sees only fonoteka > Genres. Lists and forms render. The editor round trip works. The Albums form now also shows the Phase 10.1 widgets and partials, and they do not break the Phase 10 form."
why_human: "10-UAT.md was approved on 2026-09-27 against c7487f6. Since then Phase 10.1 changed ListView.vue, FormView.vue, ListToolbar.vue, FormField.vue, registry.ts, router.ts and main.css, and fonoteka's Albums controller now registers plugin widgets and partials. The Phase 9 review fixes changed server-side navigation (WR-01, WR-02, WR-17). Vitest and the Postgres acceptance test pass, but D-23 keeps the real browser out of the automated suite, and the browser checks for these views (10.1-UAT.md tests 1 and 4) are still pending. Closing 10.1-UAT tests 1 and 4 with Genres, Collections and Settings included also closes this item."
- test: "Carried: decide CR-01 (refresh ignores tokens_valid_after / is_activated)"
expected: "Fix now or accept with override"
why_human: "Security-policy decision"
resolution: "Fixed (be4a923, a13a121). TestAdminRefreshRevocation re-run this session: PASS. Approved in 10-UAT.md test 1. Still applies, still resolved."
- test: "Carried: Secure cookie on http://localhost (assumption A3)"
expected: "Chrome and Firefox store summer_admin with default cookie_secure"
why_human: "Browser cookie policy, non-inferable"
resolution: "Approved in 10-UAT.md test 6. The cookie attributes (cabana auth.go) are unchanged in substance since then. Still resolved."
- test: "Carried: review the 17 judgment-tier prohibitions"
expected: "Accept or reject the verifier's non-authoritative verdicts"
why_human: "Judgment-tier prohibitions need human resolution"
resolution: "Accepted in 10-UAT.md test 7. Re-checked against HEAD in this report and all are still not violated, so the acceptance carries over."
---
# Phase 10: Admin Vue SPA Verification Report
**Phase Goal:** A minimal Vue 3 + TypeScript admin SPA renders login, permission-gated navigation, lists, forms and the relation manager for Albums, Artists, Collections, Genres and Styles, typed from the generated OpenAPI document.
**Verified:** 2026-10-01T21:29:59Z (summercms.go HEAD f2f2279, fonoteka.go HEAD e62f4fc)
**Status:** human_needed
**Re-verification:** Yes. The previous report (c7487f6, passed) went stale. Phase 10.2 moved its 59 framework paths under `modules/`, and later phases changed covered code.
**MVP note:** ROADMAP marks this phase `mode: mvp`, but the goal is not a User Story. Following the precedent of Phases 1, 3, 5 and 8, the four ROADMAP success criteria are the contract and plan `must_haves` are supporting evidence.
## What changed since the previous verification
| Source | Change to covered code | Effect on this report |
|---|---|---|
| Phase 10.2 (5e50b16, 57e7b56) | Framework packages moved to `modules/<pkg>`. Moves only, plus retargeted fixtures. | 59 covered paths re-mapped. No behavior change. |
| Phase 10.1 (f928194..5bbb0ad) | Runtime extension point. The SPA gains `WidgetField`, `PartialField`, `PartialHost` with an allowlisted node renderer, `pluginAssets.ts`, toolbar actions in `ListToolbar.vue`, and plugin CSS scoped per controller in `router.ts`. `ListView.vue`, `FormView.vue`, `FormField.vue` and `registry.ts` were extended. cabana gains action and asset routes. The OpenAPI document and `schema.d.ts` were regenerated (+516 / +325 lines, additive). The dist was rebuilt. | Phase 10 tests still pass, together with the new ones (Vitest went from 441 to 681). The drift gates are clean. The changed views need a browser re-check, so a human item is open. |
| Phase 11 (f7b6b0c, 93c735b, 5382947, 61da4d1) | cabana writes are commit-safe, transaction gates fail closed, the jwt.auth 401 gets a cache header, and the Phase 10 gate accepts the Phase 12 pending goldens | `go test` and the gate stages pass |
| Phase 9 review fixes (b4b8b5d..4ae272e, 2da8112) | WR-01 wildcard permissions, WR-02 drops a denied main menu item and repoints its target, WR-17 merges an admin's own permissions over the role's, WR-03 and WR-05 refuse writes and relation link/unlink that are not declared, WR-14 mounts logout outside the guard and always clears the cookie, WR-11 case-insensitive unique emails, WR-19 TxFromContext | Re-checked against the SPA's contract: the assembled acceptance test (exact nav sets, CRUD, link/unlink, logout) and the named cabana tests pass |
## User Flow Coverage
Derived user story: *As a Płytarium admin, I want to log in to /plytadmin, see only what my role permits, and manage Albums, Artists, Collections, Genres, Styles and Collection editors, so that the catalogue can be administered without the PHP backend.*
| Step | Expected | Evidence (this session) | Status |
|---|---|---|---|
| Open /plytadmin | Embedded SPA served with base /plytadmin | `modules/boardwalk/boardwalk.go`, `TestPhase10TracerSPA` PASS, `check-admin-dist.sh` "matches a fresh build" | VERIFIED |
| Log in | Cookie session, no token in body | `modules/cabana/auth.go` login, `useAuth.login`, `LoginView.test.ts` (Vitest PASS), `TestPhase10Coverage` PASS | VERIFIED |
| See permitted navigation | Limited admin sees Genres only | `TestPhase10AssembledAcceptance` SC-1 PASS (exact nav sets) and `TestNavigationDropsDeniedParentAndRepointsTarget` PASS | VERIFIED (automated); browser re-check pending |
| Use five lists and forms | Schema-driven list and form, create, update | `TestPhase10AssembledAcceptance` SC-2 and `TestPhase10Controllers` PASS, ListView/FormView Vitest PASS | VERIFIED (automated); browser re-check pending |
| Link and unlink an editor | Search candidates, link, unlink | `TestPhase10AssembledAcceptance` SC-3 PASS, `relation.smoke.test.ts` PASS | VERIFIED (automated); browser re-check pending |
| Stay signed in / be signed out | Refresh keeps an active session; reset, deactivation or deletion ends it | `TestAdminRefreshRevocation` PASS | VERIFIED |
| Log out | Cookie expired, old cookie 401, works with an expired access token | Acceptance test (logout then /auth/me 401) and `TestAdminLogoutRevokesExpiredRefreshableToken` PASS | VERIFIED |
## Goal Achievement
### Observable Truths (ROADMAP contract)
| # | Truth | Status | Evidence |
|---|---|---|---|
| 1 | An admin logs in through the SPA and sees only the navigation items their permissions allow. | ✓ VERIFIED | Server: `TestPhase10AssembledAcceptance` (fonoteka, Postgres) asserts the limited admin's nav is exactly `fonoteka:[genres]`, the developer's is `albums,collections,genres,styles,artists`, the limited admin gets 403 on albums and an empty settings list. It passes at HEAD with the Phase 9 WR-01/WR-02/WR-17 permission changes in place. `TestNavigationDropsDeniedParentAndRepointsTarget`: PASS. SPA: `useNavigation.ts`, `PluginRail.vue` and `SectionPanel.vue` are unchanged since c7487f6. Their Vitest tests pass. |
| 2 | Each of the five controllers renders a working list and form generated from its JSON schema. | ✓ VERIFIED | Server: the SC-2 loop and `TestPhase10Controllers` (fields and columns equal the tracked YAML) pass. `TestCRUDOperationsFollowDeclarations` (Phase 9 WR-03) passes, and SC-2's create and update still succeed under it. SPA: `ListView.vue` still loads `/schema/list` and the list, and `FormView.vue` still loads `/schema/form` and the record and then POSTs or PUTs. 10.1 adds toolbar actions, widgets, partials and plugin CSS on top. `ListView.test.ts` (+171 lines) and `FormView.test.ts` (+144) pass with the original Phase 10 cases intact. Vitest: 53 files, 681 passed. Browser confirmation of the changed views is the open human item. |
| 3 | The Collections form's relation manager lets an admin search, link and unlink an editor. | ✓ VERIFIED | Server: the SC-3 block covers candidates with the owner excluded, link, list, the linked user dropping out of the candidates, unlink, and an empty list afterwards. It passes with Phase 9 WR-05 (undeclared link/unlink refused) in place. SPA: `RelationManager.vue` and `RelationPickerModal.vue` are unchanged since c7487f6, and their tests and `relation.smoke.test.ts` pass. |
| 4 | API calls in the SPA use TypeScript types generated from the OpenAPI document, with no hand-maintained duplicate type. | ✓ VERIFIED | `client.ts` is `createClient<paths>` over the generated `schema.d.ts`. `admin/src` has no other `fetch(`, and `pluginAssets.ts` loads same-origin assets through elements, not a fetch. `types.ts` (+12 lines for the 10.1 types) still contains only aliases onto `components['schemas']` and `paths[...]`. `check-admin-openapi.sh --check`: exit 0. `check-phase10.sh --hygiene`: passed. |
**Score:** 4/4 ROADMAP truths verified (0 present-but-behavior-unverified).
### Plan must-have truths (supporting evidence)
There are 46 plan truths across 10-01..10-05. The earlier runs verified all of them, with A3 human-observed. Their evidence is the named tests and gates, and all of those were re-run this session as part of `go test ./...` (summercms.go), the fonoteka Phase 10 acceptance tests, Vitest, the dist and OpenAPI drift gates, and the gate stages `--self-test`, `--hygiene`, `--security` and `--evidence`. All of them pass. The renamed packages carry the same tests: `modules/cabana/phase10_*_test.go`, `modules/phrasebook/phase10_test.go`, `modules/surf/admin_prefix_test.go` and the others in covered_files.
Backstop (non-inferable) truths:
| Truth | Evidence | Status |
|---|---|---|
| A1 default prefix /backend; fonoteka /plytadmin | `modules/cabana/prefix.go` `DefaultAdminPrefix`, `TestPhase10Prefix` in the passing cabana run | VERIFIED |
| A3 Secure cookie accepted on http://localhost | 10-UAT.md test 6 (human-observed). The cookie attributes are unchanged in substance. | VERIFIED (human-observed) |
| A10 30 s blacklist grace plus single-flight refresh | `modules/cabana/auth.go` reads `admin.jwt.blacklist_grace`, fonoteka `config/admin.yaml`, `client.test.ts` (Vitest PASS) | VERIFIED |
| A8 pivot sort_order = array index | fonoteka `admin_phase10_relations_test.go` (package passes) | VERIFIED |
| Required relation is a schema hint only | `TestPhase10RelationSave` PASS | VERIFIED |
| A6 dark mode follows the system only | `theme.ts`, `theme.test.ts` PASS | VERIFIED |
| SC-4 mechanical enforcement | `check-phase10.sh --hygiene` PASS | VERIFIED |
### Prohibitions (judgment tier)
All 17 verdicts were accepted in 10-UAT.md test 7. I re-checked them against the code that changed since:
- No Płytarium or fonoteka names appear in `admin/src`, `admin/tests`, `admin/openapi` or `modules/boardwalk/dist`. A grep came back empty, and the hygiene gate passes.
- `admin/src` has no `v-html` or `innerHTML`. The 10.1 partials are built from an allowlisted node tree with `h()`, and text is always text (`partialNodes.ts`). Plugin labels and comments are still rendered as text.
- Plugin JS and CSS come from cabana's same-origin asset route, so nothing loads from a foreign origin.
- The cookie login and refresh paths still never return the JWT in a body.
- Phase 9 WR-03 and WR-05 tighten "relation save never writes a protected FK or an out-of-scope id". They do not weaken it.
All 17 remain not violated, and the human acceptance carries over.
### Required Artifacts
| Artifact | Status | Details |
|---|---|---|
| `admin/` SPA (views, components, state, api, app) | ✓ VERIFIED | It exists, has substance and is wired, and it is embedded via `modules/boardwalk/dist`, which matches a fresh build |
| `admin/openapi/admin.json`, `admin/src/api/schema.d.ts`, `admin/src/api/types.ts` | ✓ VERIFIED | No drift from generation |
| `modules/boardwalk/boardwalk.go` + `dist/` | ✓ VERIFIED | `TestPhase10TracerSPA` PASS |
| `modules/cabana/{auth,http,crud,relation,relation_field,form_schema,list_schema,filter_schema,schema_types,registry,contracts,csrf,lang,messages,prefix,admin_openapi}.go` | ✓ VERIFIED | Moved under modules/ and changed by 10.1, 11 and the Phase 9 fixes. The cabana package passes. |
| `modules/bouncer/{jwt,refresh}.go` | ✓ VERIFIED | `RefreshAudienceFor` still wired from `modules/cabana/auth.go`. The new WR-14 logout helper is additive. |
| `modules/pact/capabilities.go`, `modules/phrasebook/*`, `modules/surf/router.go` | ✓ VERIFIED | Packages pass |
| `scripts/check-phase10.sh`, `check-admin-dist.sh`, `check-admin-openapi.sh` | ✓ VERIFIED | Retargeted to `modules/` paths, and every stage run passes |
| `../fonoteka.go/plugins/golem15/fonoteka/admin_phase10_*_test.go` | ✓ VERIFIED | At e62f4fc: Acceptance, Tracer and Controllers PASS |
### Key Link Verification
| From | To | Via | Status |
|---|---|---|---|
| `admin/src/api/client.ts` | generated `schema.d.ts` | `createClient<paths>`, the only `fetch(` in `admin/src` | WIRED |
| `admin/src/state/useAuth.ts` logout | `POST /auth/logout` | `modules/cabana/http.go:205`, now mounted outside the guard with `requireAjax`. The client sets `X-Requested-With` on every request (`client.ts:71`). | WIRED |
| `modules/cabana/auth.go` refresh | `bouncer.RefreshAudienceFor` → the guard's `UserProvider` | `s.users` (`lazyBackendUsers`) | WIRED |
| `admin/src/views/ListView.vue` / `FormView.vue` | `/schema/list`, `/schema/form`, records | client calls (10.1 additions on top) | WIRED |
| `RelationManager.vue` | `/relations/{name}`, `/candidates` | client calls | WIRED |
| `modules/boardwalk` | `admin` build | `go:embed dist`, drift gate | WIRED |
### Data-Flow Trace (Level 4)
These are unchanged in structure. Every flow is ✓ FLOWING:
- navigation comes from `GET /navigation`, filtered on the server
- list rows and columns come from the list endpoint and `/schema/list`
- form fields and the record come from `/schema/form` and `GET /{id}`
- the relation manager's linked rows and candidates come from `/relations/{name}` and `/candidates`
- strings come from `GET /lang`
### Behavioral Spot-Checks (run this session)
| Behavior | Command | Result | Status |
|---|---|---|---|
| Vet | `go vet ./...` (summercms.go) | exit 0 | ✓ PASS |
| Full Go suite | `go test -count=1 ./...` (summercms.go), run once | Most packages ok. Eight packages failed only because testcontainers Postgres did not start within the timeout (`context deadline exceeded`, and one `internal/dev` watch timeout) while Vitest and other suites shared the machine: docs/examples/blog, internal/dev, beachcomber, bouncer, cabana, conga, lagoon/attach, lighthouse. | see re-run |
| Re-run of those 8 packages serially | `go test -count=1 -p 1 <8 pkgs>` | all 8 ok, exit 0 | ✓ PASS |
| Logout, nav, refresh, CRUD gating, Phase 10 coverage | `go test -count=1 -run '^(TestAdminLogoutRevokesExpiredRefreshableToken\|TestNavigationDropsDeniedParentAndRepointsTarget\|TestAdminRefreshRevocation\|TestPhase10Coverage\|TestCRUDOperationsFollowDeclarations)$' ./modules/cabana/` | all PASS | ✓ PASS |
| SC-1..SC-3 assembled on Postgres plus tracer and controllers | `go test -count=1 -run '^(TestPhase10AssembledAcceptance\|TestPhase10TracerSPA\|TestPhase10Controllers)$' ./plugins/golem15/fonoteka/` (fonoteka.go) | 3 PASS, ok 6.6s | ✓ PASS |
| SPA unit/component suite | `npx vitest run` (admin) | 53 files, 681 passed | ✓ PASS |
| Embedded dist drift (incl. vue-tsc) | `scripts/check-admin-dist.sh` | "modules/boardwalk/dist matches a fresh build" | ✓ PASS |
| OpenAPI and types drift | `scripts/check-admin-openapi.sh --check` | exit 0 | ✓ PASS |
| Phase gate stages | `scripts/check-phase10.sh --self-test / --hygiene / --security / --evidence` | each exit 0 | ✓ PASS |
### Probe Execution
No `probe-*.sh` scripts are declared or present. `check-phase10.sh` is the phase gate. Its stages were run as listed above. Its `--go`, `--postgres`, `--spa`, `--openapi` and `--dist` stages were covered directly by the full Go run with the serial re-run, the fonoteka tests, Vitest and the two drift scripts.
### Requirements Coverage
| Requirement | Source Plan | Description | Status | Evidence |
|---|---|---|---|---|
| ADMIN-06 | 10-01..10-05 | Minimal Vue 3 + TS SPA renders login, permission-gated navigation, lists, forms and the relation manager for the five controllers using generated types | ✓ SATISFIED (automated); browser re-check pending | Truths 1-4 |
Orphaned requirements: none.
### Decision Coverage
All 28 trackable CONTEXT.md decisions are honored (no decision was reverted by the later phases).
### Anti-Patterns Found
| File | Pattern | Severity | Impact |
|---|---|---|---|
| `modules/cabana/auth.go`, `http.go` | Phase 10 review WR-01: logout behind the guard | resolved | Fixed by Phase 9 WR-14 (299d220) |
| `modules/bouncer/refresh.go`, fonoteka `golem15/user` | WR-08: the site-user refresh ignores tokens_valid_after | ⚠️ Warning | Outside the Phase 10 contract. Core user plugin contract kept. |
| `modules/cabana/relation_field.go`, `crud.go` | WR-02 and WR-03 (Phase 10 review) | ⚠️ Warning | Phase 9 WR-03 and WR-05 now refuse undeclared writes and link/unlink. Not re-triaged here. |
| `modules/pact/capabilities.go` | WR-04: `FilterOptions(scope)` has no ctx or db | ⚠️ Warning | Open |
| `admin/src/views/*.vue` | WR-05: loaders without try/catch | ⚠️ Warning | Open |
| `ListView.vue`, `RelationManager.vue` | WR-06: no page clamp after delete or unlink | ⚠️ Warning | Open |
| `modules/bouncer/refresh.go` | WR-07: the refresh window slides with no absolute cap | ⚠️ Warning | Residual risk in T-10-05 |
None of the non-planning covered files contains an unreferenced `TBD`, `FIXME` or `XXX` marker (grep came back empty).
### Other observations (Info)
- Phase 10.1's own UAT (10.1-UAT.md) is still `status: testing` with 6 items pending. Its tests 1 and 4 overlap the open Phase 10 human item.
- The summercms.go working tree has an uncommitted change to `.planning/phases/10.2-.../10.2-VERIFICATION.md` that this verifier did not make (another run in progress), plus the untracked `SummerCMS landing page.zip`. Neither is Phase 10 code.
- The first full `go test` run was disturbed by machine load: Postgres containers timed out at startup. A fail-closed reading needs the serial re-run. If the gate is run in CI, run it on an otherwise idle machine.
### Human Verification Required
### 1. Browser re-walk of the Phase 10 flows on the current build
**Test:** Run the fonoteka binary and open /plytadmin. Log in as a superuser and then as a genres-only admin. For each of the five controllers, use the list and form (search, sort, filter, paging, save, 422 field errors). Link and unlink a Collection editor. Open Ustawienia. Glance at light and dark mode.
**Expected:** Everything still behaves as approved in 10-UAT.md tests 2 to 5. The Albums form's new 10.1 widgets and partials do not break the Phase 10 form.
**Why human:** Phase 10.1 changed the very views the 2026-09-27 approval covered, and D-23 keeps browser e2e out of the automated suite. Closing 10.1-UAT tests 1 and 4 with Genres, Collections and Settings included also closes this item.
The carried items (CR-01, A3, the 17 prohibitions) remain resolved, with evidence re-run this session.
### Gaps Summary
There are no gaps. All four ROADMAP success criteria hold at HEAD on automated evidence re-run this session:
- `go vet` is clean
- every Go package passes, with eight container-startup timeouts cleared by a serial re-run
- the fonoteka Postgres acceptance test passes
- Vitest passes, 681 of 681
- the dist and OpenAPI drift gates and four gate stages pass
The status is human_needed, not passed, because the human browser approvals predate the Phase 10.1 changes to ListView, FormView, the toolbar, the router and the styles. Those approvals cannot be carried over to the changed views.
---
_Verified: 2026-10-01T21:29:59Z_
_Verifier: Claude (gsd-verifier)_
Reference in New Issue View Git Blame Copy Permalink