2026-10-20 18:00:06 +00:00
1 changed files with 40 additions and 0 deletions
@@ -256,3 +256,43 @@ provider identity clearing, EN/RU success-to-login navigation, editable prefill,
 empty focused password, and exclusion of email from serialized navigation state.
 The supplied private diagnostic token is not a test fixture or documentation
 input; it is kept out of repository sources and tracker records.
 ### Validation and local release (#60)
 Delivery: [PR #61](https://git.sendico.io/tech/sxchnge/pulls/61), implementation
 commit `5f3b443`. Reviewed the complete backend and frontend contribution against
 their module guidelines and the UX/observability checklists. No task-caused
 review findings remain. Existing recovery, loading and accessible status states
 are retained; EN/RU widget tests and existing small-screen/text-scale coverage
 pass. Browser startup was checked against a separately built demo with synthetic
 tokens: direct success remains visible, Continue to login shows the verified
 email with an empty focused password, and an expired link offers resend/back.
 Native Safari was unavailable to automation, so browser-specific helper behavior
 is not claimed as verified by this check.
 On 2026-10-19, changed-file Dart formatting, `flutter analyze` in both affected
 packages (`frontend/app`, `frontend/packages/sxchnge_auth`), `make test-frontend`
 (217 tests), `GOFLAGS=-p=1 make test`, and `make lint-backend` passed. The focused
 transactional activation integration test also passed independently. Initial
 test-container startup and image-resolution attempts failed while Docker was
 stalled. After the user-authorized Docker Desktop restart, the unchanged checks
 passed; no assertions, timeouts or gates were weakened. No security scan was
 requested or run.
 The task branch was integrated locally into the existing `identity-facts-57`
 stand checkout, preserving its unrelated configuration. Fresh stable image
 versions/digests were resolved successfully with `sh infra/local/tools.sh images`.
 Compose rebuilt BFF and frontend with `build --pull bff frontend`, then recreated
 them and the Sendico session sidecar (which shares BFF's network namespace).
 Docker restart recovery also unsealed Sendico's existing Vault with its saved
 local key and restarted affected existing services in dependency order.
 The updated BFF, frontend and Sendico sidecar are healthy. The authenticated
 Sendico currency/ledger check passes. HTTPS serves the direct verification path;
 the served JavaScript matches the new frontend image with SHA-256
 `b194c0cf5dcc62634c13c7fd3d2f7e482272cb7abc1e470c62629400bf2d5d21`.
 A live synthetic invalid token returns HTTP 400 without an email. The supplied
 real token was checked read-only and remains unused and unexpired, with its
 account pending verification, ready for the user to reopen the link. PR #61 has
 not been merged into remote main; this local deployment does not imply a main
 branch merge.