2.4 KiB
status, phase, source, started, updated
| status | phase | source | started | updated | |
|---|---|---|---|---|---|
| testing | 10-admin-vue-spa |
|
2026-09-27T16:44:38Z | 2026-09-27T16:44:38Z |
Current Test
number: 1
name: Decide CR-01 (refresh ignores tokens_valid_after / is_activated)
expected: |
Secure behavior: after summer admin:reset-password <login> and access-token expiry, the SPA lands on the login screen. Current code silently refreshes and keeps working for up to refresh_ttl (14 days). Decide: fix now, or accept with override plus follow-up.
awaiting: user response
Tests
1. Decide CR-01 (refresh ignores tokens_valid_after / is_activated)
expected: Fix now or accept with override. Secure behavior is a redirect to login after password reset and token expiry. result: [pending]
2. Limited admin vs superuser navigation at /plytadmin
expected: Limited admin (only golem15.fonoteka.access_genres) sees only fonoteka > Genres, no Ustawienia. Superuser sees Albums, Collections, Genres, Styles, Artists plus Ustawienia. result: [pending]
3. Walkthrough of the five controllers and Ustawienia
expected: Every list and form renders from its YAML. Search, sort, filter, paging and bulk delete work. Save shows a toast. 422 errors appear under the right fields. Albums genre/artists relations and Ustawienia > search_use_typesense work. result: [pending]
4. Collection editors link/unlink round trip
expected: The picker shows 5 per page with the owner excluded. Dodaj (N) is disabled at 0. Linking refreshes the list and shows a plural toast. Unlink asks for confirmation and removes the row. The focus trap and Esc work. The relation manager does not appear on the create form. result: [pending]
5. Visual check in light/dark at desktop and ~900px
expected: Matches .planning/phases/10-admin-vue-spa/design. The sidebar stays dark. Below ~1100px the panel collapses to the rail, and the flyout opens on hover/focus, closes on Esc and returns focus. result: [pending]
6. Secure cookie on http://localhost (assumption A3)
expected: With backend.cookie_secure at its default, Chrome and Firefox store summer_admin on http://localhost and the session works. result: [pending]
7. Review the 17 judgment-tier prohibitions in 10-VERIFICATION.md
expected: Accept or reject the verifier's "not violated" verdicts. result: [pending]
Summary
total: 7 passed: 0 issues: 0 pending: 7 skipped: 0 blocked: 0