sneak/pixa
1
0
Fork 0
Code Issues 5 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

P0: manual test pass of the auth and encrypted URL flows #49

New Issue
Closed
opened 2026-08-07 17:44:56 +02:00 by clawbot · 2 comments
clawbot commented 2026-08-07 17:44:56 +02:00
Collaborator
Copy Link

TODO.md's current Next Step: exercise the auth and encrypted-URL flows against a locally built and running pixad, then commit the checked-off results to TODO.md.

Checks (all six must be executed against a real running server, not unit tests)

  1. Visit / and see the login form.
  2. Wrong key shows an error.
  3. Correct signing key shows the generator form.
  4. A generated encrypted URL serves the image.
  5. An expired URL (short TTL) returns 410.
  6. Logout redirects back to login.

Definition of done

  • Each check performed against a locally running pixad built from current main, with the actual observed evidence (HTTP status codes, relevant headers/body fragments) recorded.
  • Any check that FAILS is a finding, not something to code around: record it, and if it reveals a bug, stop and report on the PR before writing any fix — bug fixes are separate TDD'd work, not part of this pass.
  • TODO.md updated per its Workflow section: this Next Step moves to the top of Completed Steps as a checked-off checklist with the results; the top Future Step (P0: cache size management and eviction) is promoted into Next Step.
  • The finishing commit's title ends with (closes #49).

Notes

  • scripts/manual-test.sh automates part of this; the login/logout browser flows will need direct HTTP (curl with a cookie jar) or equivalent.
  • Session cookies are now always Secure/HttpOnly/SameSite=Strict (PR #48). Browsers accept Secure cookies on http://localhost, but curl may not replay them over plain HTTP — if so, drive the cookie explicitly from the Set-Cookie response header. Do NOT weaken the cookie attributes to make testing easier.
  • Upstream fetch checks depend on the allowlisted hosts in the config (note the key is now allowlist_hosts, PR #46).
TODO.md's current Next Step: exercise the auth and encrypted-URL flows against a locally built and running `pixad`, then commit the checked-off results to `TODO.md`. ## Checks (all six must be executed against a real running server, not unit tests) 1. Visit `/` and see the login form. 2. Wrong key shows an error. 3. Correct signing key shows the generator form. 4. A generated encrypted URL serves the image. 5. An expired URL (short TTL) returns 410. 6. Logout redirects back to login. ## Definition of done - Each check performed against a locally running `pixad` built from current `main`, with the actual observed evidence (HTTP status codes, relevant headers/body fragments) recorded. - Any check that FAILS is a finding, not something to code around: record it, and if it reveals a bug, stop and report on the PR before writing any fix — bug fixes are separate TDD'd work, not part of this pass. - `TODO.md` updated per its Workflow section: this Next Step moves to the top of Completed Steps as a checked-off checklist with the results; the top Future Step (P0: cache size management and eviction) is promoted into Next Step. - The finishing commit's title ends with ` (closes #49)`. ## Notes - `scripts/manual-test.sh` automates part of this; the login/logout browser flows will need direct HTTP (curl with a cookie jar) or equivalent. - Session cookies are now always `Secure`/`HttpOnly`/`SameSite=Strict` (PR #48). Browsers accept `Secure` cookies on `http://localhost`, but curl may not replay them over plain HTTP — if so, drive the cookie explicitly from the `Set-Cookie` response header. Do NOT weaken the cookie attributes to make testing easier. - Upstream fetch checks depend on the allowlisted hosts in the config (note the key is now `allowlist_hosts`, PR #46).
clawbot commented 2026-08-07 17:45:07 +02:00
Author
Collaborator
Copy Link

Dispatching an implementor now. Direction:

  • Branch test/manual-auth-flow-pass from current main (6573b9d), in a worktree.
  • Build with make build; run ./bin/pixad with a purpose-made local config (temp state dir, known signing_key, an allowlisted public host for the image-serving checks). Run the binary under the same nix-shell environment the scripts use if libvips isn't on the host.
  • Execute all six checks with curl (cookie jar / explicit Set-Cookie replay as needed) plus scripts/manual-test.sh where it applies; capture status codes and evidence for each.
  • Results go into TODO.md exactly per the issue's definition of done; make fmt before committing markdown; make check green before the commit (run golangci-lint cache clean first — the shared lint cache is known to replay stale findings from deleted worktree paths).
  • This pass produces documentation of observed behavior only — no production code changes. If any check fails, record the failure honestly in the PR and stop for direction; do not fix in this branch.
  • Open the PR against main with closes #49 in the body; progress/questions go in PR comments.
Dispatching an implementor now. Direction: - Branch `test/manual-auth-flow-pass` from current `main` (`6573b9d`), in a worktree. - Build with `make build`; run `./bin/pixad` with a purpose-made local config (temp state dir, known `signing_key`, an allowlisted public host for the image-serving checks). Run the binary under the same nix-shell environment the scripts use if libvips isn't on the host. - Execute all six checks with curl (cookie jar / explicit `Set-Cookie` replay as needed) plus `scripts/manual-test.sh` where it applies; capture status codes and evidence for each. - Results go into `TODO.md` exactly per the issue's definition of done; `make fmt` before committing markdown; `make check` green before the commit (run `golangci-lint cache clean` first — the shared lint cache is known to replay stale findings from deleted worktree paths). - This pass produces documentation of observed behavior only — no production code changes. If any check fails, record the failure honestly in the PR and stop for direction; do not fix in this branch. - Open the PR against `main` with `closes #49` in the body; progress/questions go in PR comments.
clawbot commented 2026-08-07 18:06:31 +02:00
Author
Collaborator
Copy Link

Session-handoff status: the test pass was fully executed and all six checks passed (plus all nine scripts/manual-test.sh checks). The implementor was stopped right before committing, so the results were salvaged, committed as b045de9 after a green make check, and pushed. PR #50 (labelled needs-review) carries the full evidence and closes this issue on merge.

Remaining before merge, for the next session picking this up: adversarial review of PR #50 per the standard workflow — independently re-run the six flows against a locally built pixad from the branch (config recipe is in the PR body), verify the evidence in TODO.md matches observed behavior, verify the TODO Workflow bookkeeping (cache eviction promoted to Next Step), then label merge-ready and assign sneak on pass.

Session-handoff status: the test pass was fully executed and **all six checks passed** (plus all nine `scripts/manual-test.sh` checks). The implementor was stopped right before committing, so the results were salvaged, committed as `b045de9` after a green `make check`, and pushed. **PR #50** (labelled `needs-review`) carries the full evidence and closes this issue on merge. Remaining before merge, for the next session picking this up: adversarial review of PR #50 per the standard workflow — independently re-run the six flows against a locally built `pixad` from the branch (config recipe is in the PR body), verify the evidence in `TODO.md` matches observed behavior, verify the TODO Workflow bookkeeping (cache eviction promoted to Next Step), then label `merge-ready` and assign sneak on pass.
sneak closed this issue 2026-08-07 18:44:01 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
merge-ready
needs-checks
needs-rebase
needs-review
needs-rework
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
clawbot sneak
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/pixa#49
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?