cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): migrate account security presentation

Browse Source
This commit is contained in:
cesnimda
2026-10-11 21:16:05 +02:00
parent 8ad720da5d
commit ad7b4196af
22 changed files with 35532 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/redesign/phase-7/p7-01/README.md
+50 -4
View File
@@ -1,6 +1,6 @@
# P7-01 — Authentication and account-security presentation
**Status: public authentication sub-slice CONDITIONAL GO; account-security implementation/acceptance PENDING.** This is the bounded execution/acceptance plan from the [approved handoff](../../phase-6/p6-05/PHASE7_HANDOFF.md). P7-00 `27c54146ad6f9059295d169b533db7b1b6689210` is pushed and direct development/localHEAD/origin equality verified at2026-10-11 14:44:45UTC; main unchanged and worktree clean at entry. Its [baseline](../p7-00/evidence/baseline.json) and [ledger](../COMMITS.md) satisfy entry. No new routes, identity/provider protocols or capability activation are included. Public source/results below are measured before their commit; the parent records its push receipt separately. This sub-slice does not complete P7-01.
**Status: implemented P7-01 scope CONDITIONAL GO; public slice pushed, account final hygiene/push receipt pending.** This is the bounded execution/acceptance plan from the [approved handoff](../../phase-6/p6-05/PHASE7_HANDOFF.md). P7-00 `27c54146ad6f9059295d169b533db7b1b6689210` is pushed and direct development/localHEAD/origin equality verified at2026-10-11 14:44:45UTC; main unchanged and worktree clean at entry. Its [baseline](../p7-00/evidence/baseline.json) and [ledger](../COMMITS.md) satisfy entry. No new routes, identity/provider protocols or capability activation are included. Public8ad720da5db5999ecda787575dc45621d18a5498 is normally pushed; localHEAD=origin=live development directly verified2026-10-11 18:50:24UTC, local/origin/live main27657f3 unchanged. No completed public work remains uncommitted. The separate account implementation/runtime/visual outcome is CONDITIONAL GO below; final finite hygiene and normal account push/receipt remain pending. The public sub-slice alone does not complete P7-01.
## Baseline and bounded commit scope
@@ -65,7 +65,7 @@ Visual review of the first passing export found registration describing its pass
| Backend auth/security subset | **87/87**, zero failed/not-executed | Auth/session/local identity/context/2FA/email-ownership/authorization contracts at unchanged backend source; a subset of inherited1,033, not an additive total |
| App and browser TypeScript, lint, production frontend build | **All exit0** | Final sequence18:40:04–18:40:39UTC; lint retains zero-warning policy. Browser config contents and command/log hashes are portable in the manifest |
Authoritative final build ID is `rd_SQeVLwVwER9VMCc6XL`. Canonical public six-file source digest is `b330b233508ad5202a1f622ade4464103f7a986ee53648c8f16047f2a1d32586`; the manifest records each file and its precise ordered digest algorithm. Static export74 files have measured raw-file digest `dff031a52740a09359715a31456c9cec70f5aae6f9932c018af078215e973d67`. These identify the tested public working tree, not a newly deployed or remotely pushed identity. P7-00 remains the recorded entry commit until a successor push receipt is recorded in the ledger.
Authoritative public build ID is `rd_SQeVLwVwER9VMCc6XL`, with BUILD_ID bytes retained in the immutable public snapshot. Canonical public six-file source digest is `b330b233508ad5202a1f622ade4464103f7a986ee53648c8f16047f2a1d32586`; the manifest records each file and its precise ordered digest algorithm. Static export74 files have measured raw-file digest `dff031a52740a09359715a31456c9cec70f5aae6f9932c018af078215e973d67`. These identify the tested public source subsequently pushed in8ad720d, not a deployment or the later account build. The manifest preserves entry observation27c5414 and adds the actual successor push receipt separately.
### Responsive, localisation and visual evidence
@@ -85,6 +85,52 @@ Intermediate public unit attempts are also retained, including the59-case run wi
The finite public checks preserve E01–E06/E09 and E07/E08/S03 boundaries, exact safe return/query/hash handling, real token failure/replay and old-session rejection. Backend routes/protocols and established link/exchange guards are retained. All **57 groups remain56 PARTIAL + C11 DEFERRED**, and all32 routes remain retained with their existing qualifications. No whole-group upgrade or fresh full frontend/backend/browser/fidelity acceptance is inferred from these subsets. Ordinary P2-D01 remains required by the inherited baseline and future integrated gate; it was not rerun in this public pack.
Public sub-slice acceptance is **CONDITIONAL GO** for its completed development commit, with M01–M12, server-error language/reader/contrast/provider qualifications and inherited debt carried. **Production remains NO-GO**, main unchanged; M13/P5-13 remains deferred do-not-execute. Commit/push/remote receipt and finite hygiene checks are recorded by the parent in the ledger before account product work proceeds.
Public sub-slice acceptance is **CONDITIONAL GO** for pushed8ad720d, with M01–M12, server-error language/reader/contrast/provider qualifications and inherited debt carried. **Production remains NO-GO**, main unchanged; M13/P5-13 remains deferred do-not-execute. The [ledger](../COMMITS.md) and manifest contain the actual normal push/direct remote receipt; entry/public source and runtime history remain separate from account work.
Account/security acceptance is **PENDING**: five new account-presentation RED cases and12 real-provider cases are prepared (eight existing provider behaviors pass; four provider presentation cases fail), plus six meaningful native account cases not yet executed. The parent owns those product repairs and the later fresh affected build/native evidence. This public result neither completes P7-01 nor changes the approved checkpoint order.
The [public static record](evidence/public-static-checks.json) checked2026-10-11 18:48:17UTC records secret scan and working/staged/Phase7 whitespace commands all exit0, all57 statuses and32 routes preserved. An earlier checker parsed56 rows because it did not accept bold `DEFERRED`; accepting optional Markdown emphasis repaired the checker, with no matrix/status change. Later account/successor documentation requires its own fresh finite hygiene run.
At the public gate, five account-presentation RED cases and12 real-provider cases were prepared; those historical counts remain in the frozen public manifest. Subsequent account results are recorded separately below. Focused provider sets overlap existing public cases and cannot be added to a full-suite result. The public slice does not change the approved checkpoint order.
## Account identity and security implementation
**Implemented account scope: CONDITIONAL GO after fresh runtime and actual final visual/context review; final finite hygiene/push receipt pending.** The [account manifest](evidence/account-results.json) records the actual fresh runtime results below, exact seven-file source/export identity, all native attachment bodies and geometry, intermediate failures and case-name deltas. Its public entry reference preserves the already pushed public slice. The whole final UI runtime tree including attempts, focused unit records, BUILD_ID, runner/browser config, inherited frontend baseline, seven source snapshots and exact export are frozen under `.artifacts/phase7/p7-01/account-final/`. All206 recorded path/hash references were verified; only file references were rebased, preserving raw bytes, hashes, commands and original report execution paths. Source identity retains original logical source paths with separate immutable snapshots. Do not recollect this slice after subsequent builds. No backend source, authentication protocol, schema, provider capability or external service was changed.
AuthStatus, 2FA, Sessions and the two real account-provider consumers use the existing themed PageSection with named H2 sections. The shell owns H1; Profile's existing identity/account/password sections keep their save boundaries. Signed-in wording and security/provider dates follow the selected EN/NB locale. Long identity/session metadata wraps within the existing responsive layout.
Unknown or failed 2FA status announces loading/failure and offers a deliberate read-only retry; it cannot suggest setup until an actual status response is known. Sessions loading failure no longer looks like a known empty list. A failed revoke-others request keeps its durable alert inside the named confirmation and preserves explicit retry/cancel. Pending confirmation blocks duplicate commands; current-session logout still clears the authenticated private tree. Existing enable/disable, recovery acknowledgement/export/clear, device revoke, password and provider-link/unlink owners remain in place.
Profile uses the existing API-error helper and durable scoped save/password feedback, retaining the draft after failure for explicit retry. Identity save still sends exactly firstName/lastName/displayName/userName; account email, canonical Career data and CV variants retain their separate owners. Native fixtures read canonical data and two sibling CVs before/after an actual identity PUT204 and reload, and assert no browser canonical/CV write.
Visual inspection of the first passing account export exposed two copy defects: a disabled Microsoft account card instructed the product user to set a NEXT_PUBLIC environment variable, and the account chip called a CV missing even when canonical Career data and two CV variants existed. The chip's actual source is only stored `profileCvText`. Two ordinary EN/NB Profile cases and a strengthened existing provider assertion reproduced these failures (33 pass/3 fail, no selected-out cases). Account-only `profileCvTextAvailable/Missing` keys now describe that stored text truthfully; the existing Microsoft unavailable hint uses natural EN/NB wording. Existing Career CV keys/data, CV-library fetching and provider configuration semantics are unchanged.
### Fresh account regression and source identity
| Evidence | Actual result | Scope / count explanation |
|---|---|---|
| Full frontend Jest | **573/573 in89 suites**, zero fail/pending/todo | Fresh19:03:13–19:06:30UTC. Inherited521/85 becomes+52 cases/+4 suites: public23, account providers12, card presentation7, security flows5 and Profile5 (19→24). No removed/renamed cases; exact names are retained in the manifest |
| Account native | **6/6**, zero skip/flaky/unexpected/retry | Fresh19:04:29–19:05:01UTC. Four actual identity-save/reload/isolation samples, failed-2FA-read→explicit-retry/no-write, and real multiple-session cancel/failure/retry/readback/current-logout workflow |
| Public native regression | **22/22**, zero skip/flaky/unexpected/retry | Fresh19:05:01–19:05:33UTC on the account export; separate from the immutable public acceptance run and its SMTP evidence |
| Existing auth/account-isolation browser boundaries | **10/10**, zero skip/flaky/unexpected/retry | Fresh19:05:33–19:06:16UTC on the same account export. Current/private-tree disposal, canonical account separation, safe return and expired authentication retain their ordinary assertions |
| App/browser TypeScript, lint, frontend production build | **All exit0** | Fresh19:03:46–19:04:29UTC, lint zero-warning policy retained. Earlier unknown-response spread in a new test was corrected with a test-only structural assertion; the diagnostic failed typecheck is retained |
The measured account export is `SbTVDn-CSb21uPKSzFqOv`. Seven product owners have canonical-LF digest `91589b37e8efe9e0a089987158af44e5f846d0b56cc78782423f38508404f915`; the74 exported files have raw digest `04926e1ee0c75884a8a61b70b3b65e158ad237d65c2714e196ace6d692655bda`. The manifest records per-file hashes and the ordered digest algorithms. These identify the tested working tree after the19:02:57UTC product freeze, before the account commit, with entry HEAD8ad720d. The final test-only structural assertion does not change product source. Backend1,033, sidecar49, ordinary integrated159 and rendering corpora remain inherited; this account slice does not claim fresh executions of them or ordinary P2-D01.
### Account accessibility and responsive evidence
Eight all-enabled account snapshots cover NB/dark320, EN/light390, NB/light768 and EN/dark1440 identity persistence, plus unknown/recovered 2FA and failed/settled session revocation at320/390. All eight record root overflow0 and eight named sections within the viewport. Actual identity fields save/reload, long names and security dates are included. The six account cases do not vary density; both Comfortable/Compact are not claimed. These finite contexts do not establish every breakpoint/theme/language combination, physical touch/software keyboards, browser zoom or a human screen-reader result.
Account scans retain **0 violation nodes and85 incomplete nodes**:84 color-contrast (74 background overlap,8 short-text,2 partial overlap) and1 aria-hidden-focus. The failed revoke-others modal targets `#root` with `focusable-modal-open`: “Check that focusable elements are not tabbable in the current state.” The ordinary native test proves named dialog/description, installed MUI initial focus container, subsequent forward/backward keyboard trap cycle, cancel focus restoration, failure retained inside the modal and deliberate retry. That bounded keyboard evidence does not replace **M09** spoken navigation/state or **M11** contextual contrast/forced-colors qualification. Exact nodes/check messages/data and source contexts remain in the manifest and hashed raw report; no rule was disabled.
The public regression adds22 separate all-enabled scans with0 violation nodes/31 contrast incompletes. Combined30 account-build snapshots have0 violation nodes/116 incomplete occurrences, but the8 account and22 public contexts remain separate; they are not like-for-like substitutes for Phase6's mixed-scope319 snapshots. The earlier account export had84 incompletes; the final failed-modal snapshot has one additional overlap node. No incomplete was hidden to preserve an earlier count.
Eight PNGs are extracted byte-for-byte from the inline base64 report attachments into a report-SHA directory; their exact raw hash and original embedded-report reference are recorded. **The parent actually opened all eight final post-copy PNGs with `view_image`**: four persisted identity samples, failed/recovered2FA read, failed revoke dialog and surviving-session view. Stored-text wording is truthful, the unavailable Microsoft hint contains no operator variable, and controls/layout remain clear and in bounds. Sticky appbar/skip-link positions in stitched full-page captures reflect their actual scroll/focus capture context. Earlier inspected identity images and their two copy defects remain historical. The manifest contains exact image hashes and the direct review receipt; extraction performs no editing and visual review does not provide human assistive acceptance.
### Historical failures and remaining acceptance
The first native account attempt passed1/6. Four cases assumed Profile PUT returned200, whereas the established AuthController contract returns204. Another assertion expected initial focus inside the Paper role=dialog, although installed MUI FocusTrap initially focuses its containing dialog container. Fixtures now require204 and the actual initial trap container; subsequent Tab/Shift+Tab still must cycle inside the named dialog and cancel restores the invoking control. This corrected test assumption did not alter product authentication/save semantics or relax keyboard containment. Its whole report/log/output folder is retained.
The provider RED8 pass/4 fail, original card RED0/5, strengthened card RED1/7, focused GREEN sets and copy RED33/36 are retained with their exact counts. Earlier full571/89 and passing account/public/boundary native runs precede the copy repair and remain historical, not final acceptance. The fresh full573 run has no pending/skipped/expected-failure masking. Whole previous runtime folders are retained by the runner; raw reports still contain their original execution paths.
All57 groups remain56 PARTIAL + C11 DEFERRED, all32 routes retained with existing qualifications. This slice adds finite E02–E06/E08/E09 and C01/C07/S03 evidence; it does not upgrade whole groups. Human reader/zoom/physical and software-keyboard, real OAuth/Turnstile/authenticator/device and production delivery gates remain open. Existing server-authored English errors in NB remain an explicit localisation qualification. M01–M12 and inherited debt carry forward; M13/P5-13 stays deferred do-not-execute, Phase8 stays separate, production NO-GO and main unchanged. Implemented account and whole-P7-01 scope are CONDITIONAL GO with these explicit qualifications. Final finite hygiene and normal account commit/push receipt remain pending; no account push is inferred from runtime or visual review. The latest account static record uses [static-checks.json](evidence/static-checks.json); its final metadata will be mirrored after the parent's staged checks.
The final account [static checks](evidence/static-checks.json) passed2026-10-11 19:15:38UTC: tracked/untracked secret scan, working/staged/Phase7 whitespace,303 relative documentation links,57 groups and32 original routes. Root independently verified all206 account manifest file/hash references. Normal account commit/push remains the next step; the successor records its actual receipt.