From a587cbbc24d7d99b137379ddb25d860cb8196978 Mon Sep 17 00:00:00 2001 From: Stephan D Date: Mon, 19 Oct 2026 14:54:53 +0200 Subject: [PATCH] Record verification validation and local deployment (#60) --- docs/ux/auth-journeys.md | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/docs/ux/auth-journeys.md b/docs/ux/auth-journeys.md index bcac572..083e5fb 100644 --- a/docs/ux/auth-journeys.md +++ b/docs/ux/auth-journeys.md @@ -256,3 +256,43 @@ provider identity clearing, EN/RU success-to-login navigation, editable prefill, empty focused password, and exclusion of email from serialized navigation state. The supplied private diagnostic token is not a test fixture or documentation input; it is kept out of repository sources and tracker records. + +### Validation and local release (#60) + +Delivery: [PR #61](https://git.sendico.io/tech/sxchnge/pulls/61), implementation +commit `5f3b443`. Reviewed the complete backend and frontend contribution against +their module guidelines and the UX/observability checklists. No task-caused +review findings remain. Existing recovery, loading and accessible status states +are retained; EN/RU widget tests and existing small-screen/text-scale coverage +pass. Browser startup was checked against a separately built demo with synthetic +tokens: direct success remains visible, Continue to login shows the verified +email with an empty focused password, and an expired link offers resend/back. +Native Safari was unavailable to automation, so browser-specific helper behavior +is not claimed as verified by this check. + +On 2026-10-19, changed-file Dart formatting, `flutter analyze` in both affected +packages (`frontend/app`, `frontend/packages/sxchnge_auth`), `make test-frontend` +(217 tests), `GOFLAGS=-p=1 make test`, and `make lint-backend` passed. The focused +transactional activation integration test also passed independently. Initial +test-container startup and image-resolution attempts failed while Docker was +stalled. After the user-authorized Docker Desktop restart, the unchanged checks +passed; no assertions, timeouts or gates were weakened. No security scan was +requested or run. + +The task branch was integrated locally into the existing `identity-facts-57` +stand checkout, preserving its unrelated configuration. Fresh stable image +versions/digests were resolved successfully with `sh infra/local/tools.sh images`. +Compose rebuilt BFF and frontend with `build --pull bff frontend`, then recreated +them and the Sendico session sidecar (which shares BFF's network namespace). +Docker restart recovery also unsealed Sendico's existing Vault with its saved +local key and restarted affected existing services in dependency order. + +The updated BFF, frontend and Sendico sidecar are healthy. The authenticated +Sendico currency/ledger check passes. HTTPS serves the direct verification path; +the served JavaScript matches the new frontend image with SHA-256 +`b194c0cf5dcc62634c13c7fd3d2f7e482272cb7abc1e470c62629400bf2d5d21`. +A live synthetic invalid token returns HTTP 400 without an email. The supplied +real token was checked read-only and remains unused and unexpired, with its +account pending verification, ready for the user to reopen the link. PR #61 has +not been merged into remote main; this local deployment does not imply a main +branch merge.