GuilanCE/guilan-ace-deployment
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record auth regression gate completion

Browse Source
This commit is contained in:
Amirhossein Khalili
2026-09-28 23:18:04 +03:30
parent c04d3bed5b
commit 3119916ec2
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
tasks/todo.md
View File

@@ -44,10 +44,10 @@ Checkpoint C was approved by the owner on 2026-09-27 after reviewing [the schema
## 3. Authentication (5–7 person-days) ## 3. Authentication (5–7 person-days)
- [x] **T20 — Simplify auth entry and navigation (M; deps: T15, T02).** Files: F Auth view/auth shell/tests. Acceptance: mobile entry automatically routes password accounts to password entry, passwordless existing accounts to login OTP, and new numbers to registration OTP then details, with a clear way to edit the phone and no backend auth-rule changes. Implemented this single phone-first path and removed the separate login/signup selector. - [x] **T20 — Simplify auth entry and navigation (M; deps: T15, T02).** Files: F Auth view/auth shell/tests. Acceptance: mobile entry automatically routes password accounts to password entry, passwordless existing accounts to login OTP, and new numbers to registration OTP then details, with a clear way to edit the phone and no backend auth-rule changes. Implemented this single phone-first path and removed the separate login/signup selector.
- [x] **T21 — Clarify form, OTP, loading, and error states (M; deps: T20).** Files: F auth components/tests. Acceptance: each step has one clear action, input constraints and errors are accessible, resend/countdown are understandable, and retry does not lose valid input. Added inline announced errors, field autocomplete/constraints, an accessible OTP label, cooldown display, duplicate-submit protection, and automatic sign-in after successful registration. Removed forgotten-password UI because OTP login covers account access, improved dark-mode error contrast, and standardized outline/toggle/nav hovers on the theme's secondary color. Frontend lint/build pass. - [x] **T21 — Clarify form, OTP, loading, and error states (M; deps: T20).** Files: F auth components/tests. Acceptance: each step has one clear action, input constraints and errors are accessible, resend/countdown are understandable, and retry does not lose valid input. Added inline announced errors, field autocomplete/constraints, an accessible OTP label, cooldown display, duplicate-submit protection, and automatic sign-in after successful registration. Removed forgotten-password UI because OTP login covers account access, improved dark-mode error contrast, and standardized outline/toggle/nav and account-menu hovers on the theme's secondary color. Frontend lint/build pass.
- [x] **Checkpoint I (deps: T20–T21).** Owner reviewed and approved the phone → password/OTP → registration details flow, dark-mode errors, and button hover colors in RTL/mobile on 2026-09-28; backend auth rules remain unchanged. - [x] **Checkpoint I (deps: T20–T21).** Owner reviewed and approved the phone → password/OTP → registration details flow, dark-mode errors, and button hover colors in RTL/mobile on 2026-09-28; backend auth rules remain unchanged.
- [ ] **T22 — Align verification and OAuth callback screens (M; deps: T20).** Files: F verification/callback views/tests. Acceptance: expired token, failed Google callback, success, and return-to-intent states follow the same system; forgotten-password recovery stays removed in favor of OTP login. Verify: browser tests for link/token variants. - [x] **T22 — Align verification and OAuth callback screens (M; deps: T20).** Files: F verification/callback views/tests. Acceptance: expired token, failed Google callback, success, and return-to-intent states follow the same system; forgotten-password recovery stays removed in favor of OTP login. Added persistent accessible Persian errors for incomplete/expired Google callbacks and preserved safe internal return destinations through Google login and recovery. Browser smoke confirmed the callback error state at 390px in dark mode. The error icon and text follow RTL flex-start alignment with the accessible red/dark error treatment.
- [ ] **T23 — Auth regression gate (M; deps: T21–T22).** Files: F end-to-end tests, B focused auth tests if needed. Acceptance: password login, OTP login, signup, verification, logout, protected redirects, and the retired recovery URL behave with existing API semantics. Verify: focused automated suite plus manual mobile smoke. - [x] **T23 — Auth regression gate (M; deps: T21–T22).** Files: F end-to-end tests, B focused auth tests if needed. Acceptance: password login, OTP login, signup, verification, logout, protected redirects, and the retired recovery URL behave with existing API semantics. Added 4 safe-return-path unit tests. Password login submits the selected mobile as name=username with autocomplete=username in the same form as current-password; browser DOM confirmed the field metadata; frontend auth tests, lint, and production build pass; 43 focused backend auth/OAuth tests pass with isolated SQLite. Browser smoke confirmed protected /profile returns to /auth?next=%2Fprofile, /reset-password returns to /auth, and expired Google callback displays its error state. No live SMS/OAuth sign-in was exercised. Next.js upgraded to 16.3.5 for the runtime verification tooling. Existing lockfile audit reports 11 production dependency advisories (1 critical, 5 high); dompurify remediation requires a breaking jspdf upgrade and is deferred to T37.
## 4. Events and registration (9–12 person-days) ## 4. Events and registration (9–12 person-days)