test(auth): prove email token lifecycle

Reject verification-link replay and cover real Identity token expiry, replay, email change, and custom username preservation on SQLite.
2026-08-15 20:06:08 +02:00
parent 134aac7bcf
commit dc511296a4
5 changed files with 158 additions and 3 deletions
@@ -200,7 +200,7 @@ This queue records the highest-value work that can proceed without production cr
 - **Blocker:** in-app browser localhost access was denied by its admin policy check; no safe SMTP sink, disposable MariaDB, or production environment is available.
 - **Evidence:** `docs/verification/sec-005b-email-ownership.md`; focused backend 35/35; full backend 501/501; frontend 151/151 and build; SQLite upgrade and dual-provider migration scripts; isolated API 202/no-cookie and 403/no-cookie checks.
 - **Commit:** none.
- **Remaining work:** real-browser desktop/mobile/keyboard flows with a local email sink; expired/replayed token and custom-username integration checks; disposable MariaDB migration execution; production SMTP/origin/version-skew verification before `DONE`.
+- **Remaining work:** real-browser desktop/mobile/keyboard flows with a local email sink; disposable MariaDB migration execution; production SMTP/origin/version-skew verification before `DONE`. Real Identity valid/expired/replayed verification and custom-username email-change behavior pass locally (V-182).

 ### SEC-006 — Compatible document-parser dependency update