sneak/pixa
1
0
Fork 0
Code Issues 5 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

docs: record manual test pass of auth and encrypted URL flows (closes #49) #50

Merged
sneak merged 1 commits from test/manual-auth-flow-pass into main 2026-08-07 18:44:01 +02:00
Conversation 1 Commits 1 Files Changed 1 +25 -7
clawbot commented 2026-08-07 18:06:22 +02:00
Collaborator
Copy Link

closes #49

Records the P0 manual test pass in TODO.md per its Workflow section
(checked-off results into Completed Steps; cache size management and
eviction promoted to Next Step). TODO.md is the only changed file —
no production code changes, as the issue requires.

Test setup

pixad built from main at 6573b9d via make build, run on port
18099 with a throwaway local config (temp state dir, known
signing_key, allowlist_hosts including s3.sneak.cloud), driven
with curl using explicit cookie replay (session cookies are
Secure/HttpOnly/SameSite=Strict).

Results — all six checks PASS

  1. Login form: GET / → HTTP 200, Pixa - Login page with
    name="key" password form.
  2. Wrong key error: POST / with key=wrong-key → HTTP 200 login
    page containing "Invalid signing key".
  3. Generator form: POST / with the correct signing key → HTTP 303
    to / with Set-Cookie: pixa_session=...; HttpOnly; Secure; SameSite=Strict; GET / with that cookie → Pixa - URL Generator
    with the /generate form and logout link.
  4. Encrypted URL serves image: POST /generate (ttl=3600) produced
    a /v1/e/<token>/img.jpeg URL → HTTP 200, Content-Type: image/jpeg, 800x600 baseline JPEG, 61706 bytes.
  5. Expired URL → 410: a ttl=1 URL fetched after 3 s → HTTP 410 Gone
    with {"error":"URL has expired","status":410,...}.
  6. Logout: GET /logout → HTTP 303 to / with Set-Cookie: pixa_session=; Max-Age=0; subsequent GET / → login form again.

Additionally, all nine checks in scripts/manual-test.sh passed
against the same server instance.

Verification

make check green on the branch head (all tests, golangci-lint 0
issues, fmt-check clean) — the first fully green make check on a
main-derived branch under the current linter, confirming the #47/#48
fix on merged main.

Note for review: the test execution was performed this session; the
adversarial re-review (independently re-running the six flows) is still
pending and should happen before merge.

closes #49 Records the P0 manual test pass in `TODO.md` per its Workflow section (checked-off results into Completed Steps; cache size management and eviction promoted to Next Step). `TODO.md` is the only changed file — no production code changes, as the issue requires. ## Test setup `pixad` built from `main` at `6573b9d` via `make build`, run on port 18099 with a throwaway local config (temp state dir, known `signing_key`, `allowlist_hosts` including `s3.sneak.cloud`), driven with curl using explicit cookie replay (session cookies are `Secure`/`HttpOnly`/`SameSite=Strict`). ## Results — all six checks PASS 1. **Login form**: GET `/` → HTTP 200, `Pixa - Login` page with `name="key"` password form. 2. **Wrong key error**: POST `/` with `key=wrong-key` → HTTP 200 login page containing "Invalid signing key". 3. **Generator form**: POST `/` with the correct signing key → HTTP 303 to `/` with `Set-Cookie: pixa_session=...; HttpOnly; Secure; SameSite=Strict`; GET `/` with that cookie → `Pixa - URL Generator` with the `/generate` form and logout link. 4. **Encrypted URL serves image**: POST `/generate` (ttl=3600) produced a `/v1/e/<token>/img.jpeg` URL → HTTP 200, `Content-Type: image/jpeg`, 800x600 baseline JPEG, 61706 bytes. 5. **Expired URL → 410**: a ttl=1 URL fetched after 3 s → HTTP 410 Gone with `{"error":"URL has expired","status":410,...}`. 6. **Logout**: GET `/logout` → HTTP 303 to `/` with `Set-Cookie: pixa_session=; Max-Age=0`; subsequent GET `/` → login form again. Additionally, all nine checks in `scripts/manual-test.sh` passed against the same server instance. ## Verification `make check` green on the branch head (all tests, golangci-lint 0 issues, fmt-check clean) — the first fully green `make check` on a `main`-derived branch under the current linter, confirming the #47/#48 fix on merged `main`. Note for review: the test execution was performed this session; the adversarial re-review (independently re-running the six flows) is still pending and should happen before merge.
clawbot added 1 commit 2026-08-07 18:06:22 +02:00
docs: record manual test pass of auth and encrypted URL flows (closes #49)
All checks were successful
check / check (push) Successful in 1m34s
Details
b045de945f 
All six checks from issue #49 executed against a locally built and
running pixad (main at 6573b9d, port 18099, throwaway local config):
login form, wrong-key error, generator form after login, encrypted URL
serving an image, expired URL returning 410, and logout redirect. All
passed, as did the nine checks in scripts/manual-test.sh. Evidence
recorded as a checklist in TODO.md per its Workflow section; the cache
size management and eviction item is promoted to Next Step.
clawbot added the needs-review label 2026-08-07 18:06:27 +02:00
clawbot commented 2026-08-07 18:26:16 +02:00
Author
Collaborator
Copy Link

Independent adversarial review of PR #50 — verdict: merge-ready

Reviewed by a session independent of the authoring session. Scope: diff vs REPO_POLICIES.md and issue #49 (including all comments), independent re-execution of every claimed check, make check, commit hygiene.

Independent reproduction — all claims verified

Built pixad from the branch head (b045de9) via make build (nix-shell with libvips, as on the authoring run) and ran it on port 18299 with a throwaway config (temp state_dir, 39-char signing_key, allowlist_hosts containing s3.sneak.cloud). Re-ran all six checks from issue #49 with curl and explicit Set-Cookie replay:

  1. GET / returned HTTP 200, &lt;title&gt;Pixa - Login&lt;/title&gt;, form field name="key" — matches claim.
  2. POST / with key=wrong-key returned HTTP 200 login page containing "Invalid signing key" — matches claim.
  3. POST / with the correct signing key returned HTTP 303 to / with Set-Cookie: pixa_session=...; Path=/; Max-Age=2592000; HttpOnly; Secure; SameSite=Strict; GET / replaying that cookie rendered &lt;title&gt;Pixa - URL Generator&lt;/title&gt; with the /generate form and /logout link — matches claim.
  4. POST /generate (ttl=3600) produced a /v1/e/&lt;token&gt;/img.jpeg URL that returned HTTP 200, Content-Type: image/jpeg, a baseline JPEG at 800x600 and exactly 61706 bytes — byte-identical to the size claimed in the PR.
  5. A ttl=1 URL fetched after 3 s returned HTTP 410 with body {"error":"URL has expired","status":410,...} — matches claim.
  6. GET /logout returned HTTP 303 to / with Set-Cookie: pixa_session=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Strict; subsequent GET / rendered the login form — matches claim.

Additionally re-ran scripts/manual-test.sh against the same server instance: all nine checks pass, including the direct-proxy check (test 7) not covered by the six issue checks.

Review findings

  • Diff scope: single commit b045de9 atop current main (6573b9d), touching only TODO.md — exactly what issue #49's definition of done requires (no production code changes). Merge base is current main; no rebase needed.
  • Document placement: results recorded in TODO.md Completed Steps per its Workflow section — correct location for this repo; the issue explicitly mandates it.
  • TODO bookkeeping: the finished Next Step moved to the top of Completed Steps as a checked-off checklist with concrete evidence (status codes, header values, byte counts — reproducible, not vague); the top Future Step (P0 cache size management and eviction, now #51) correctly promoted into Next Step and removed from Future Steps.
  • Claims are concrete and reproducible: every checklist item names the exact request, the expected response, and the observed evidence; I reproduced each one without needing any information not in the PR body or TODO.md.
  • make check: green on the branch head, independently verified (all tests pass, golangci-lint 0 issues, fmt-check clean, prose properly wrapped).
  • Commit hygiene: one commit, one change; title docs: record manual test pass of auth and encrypted URL flows (closes #49) ends with the required closer; body is accurate; no attribution trailers of any kind.
  • No AI-tool references anywhere in the diff, commit message, or PR body.

No findings. Replacing needs-review with merge-ready and assigning sneak for merge. Merging will close #49.

## Independent adversarial review of PR #50 — verdict: merge-ready Reviewed by a session independent of the authoring session. Scope: diff vs `REPO_POLICIES.md` and issue #49 (including all comments), independent re-execution of every claimed check, `make check`, commit hygiene. ### Independent reproduction — all claims verified Built `pixad` from the branch head (`b045de9`) via `make build` (nix-shell with libvips, as on the authoring run) and ran it on port 18299 with a throwaway config (temp `state_dir`, 39-char `signing_key`, `allowlist_hosts` containing `s3.sneak.cloud`). Re-ran all six checks from issue #49 with curl and explicit `Set-Cookie` replay: 1. GET `/` returned HTTP 200, `&lt;title&gt;Pixa - Login&lt;/title&gt;`, form field `name="key"` — matches claim. 2. POST `/` with `key=wrong-key` returned HTTP 200 login page containing "Invalid signing key" — matches claim. 3. POST `/` with the correct signing key returned HTTP 303 to `/` with `Set-Cookie: pixa_session=...; Path=/; Max-Age=2592000; HttpOnly; Secure; SameSite=Strict`; GET `/` replaying that cookie rendered `&lt;title&gt;Pixa - URL Generator&lt;/title&gt;` with the `/generate` form and `/logout` link — matches claim. 4. POST `/generate` (ttl=3600) produced a `/v1/e/&lt;token&gt;/img.jpeg` URL that returned HTTP 200, `Content-Type: image/jpeg`, a baseline JPEG at 800x600 and exactly 61706 bytes — byte-identical to the size claimed in the PR. 5. A ttl=1 URL fetched after 3 s returned HTTP 410 with body `{"error":"URL has expired","status":410,...}` — matches claim. 6. GET `/logout` returned HTTP 303 to `/` with `Set-Cookie: pixa_session=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Strict`; subsequent GET `/` rendered the login form — matches claim. Additionally re-ran `scripts/manual-test.sh` against the same server instance: all nine checks pass, including the direct-proxy check (test 7) not covered by the six issue checks. ### Review findings - **Diff scope**: single commit `b045de9` atop current `main` (`6573b9d`), touching only `TODO.md` — exactly what issue #49's definition of done requires (no production code changes). Merge base is current `main`; no rebase needed. - **Document placement**: results recorded in `TODO.md` Completed Steps per its Workflow section — correct location for this repo; the issue explicitly mandates it. - **TODO bookkeeping**: the finished Next Step moved to the top of Completed Steps as a checked-off checklist with concrete evidence (status codes, header values, byte counts — reproducible, not vague); the top Future Step (P0 cache size management and eviction, now #51) correctly promoted into Next Step and removed from Future Steps. - **Claims are concrete and reproducible**: every checklist item names the exact request, the expected response, and the observed evidence; I reproduced each one without needing any information not in the PR body or `TODO.md`. - **`make check`**: green on the branch head, independently verified (all tests pass, golangci-lint 0 issues, fmt-check clean, prose properly wrapped). - **Commit hygiene**: one commit, one change; title `docs: record manual test pass of auth and encrypted URL flows (closes #49)` ends with the required closer; body is accurate; no attribution trailers of any kind. - **No AI-tool references** anywhere in the diff, commit message, or PR body. No findings. Replacing `needs-review` with `merge-ready` and assigning sneak for merge. Merging will close #49.
clawbot added merge-ready and removed needs-review labels 2026-08-07 18:26:20 +02:00
sneak was assigned by clawbot 2026-08-07 18:26:21 +02:00
sneak merged commit 5d0b5f864e into main 2026-08-07 18:44:01 +02:00
sneak deleted branch test/manual-auth-flow-pass 2026-08-07 18:44:01 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
merge-ready
needs-checks
needs-rebase
needs-review
needs-rework
No Label merge-ready
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
clawbot sneak
No Assignees sneak
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/pixa#50
Delete Branch "test/manual-auth-flow-pass"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?