test(01): verification (human_needed, 11/13) + persist Gate 2 human-UAT

Code verified against codebase, 24 tests pass, CAL-01 + CAL-08 proven live. AUTH-01/02/03 live login + SSE-over-Pangolin smoke test require operator infra — tracked as 01-HUMAN-UAT.md (status: partial).
2026-06-04 11:44:52 -04:00
parent fe8d5c8e4b
commit 5bed2228b7
2 changed files with 244 additions and 0 deletions
@@ -0,0 +1,41 @@
+---
+status: partial
+phase: 01-foundation-broker-spike
+source: [01-VERIFICATION.md]
+started: "2026-06-04"
+updated: "2026-06-04"
+---
+
+## Current Test
+
+[awaiting human testing — requires live Authelia + Pangolin infrastructure]
+
+## Tests
+
+### 1. AUTH-01 — Live Authelia OIDC login over the public Pangolin URL
+expected: From an external network, opening `https://familysync.<domain>` redirects to Authelia; after logging in as Lucas, the app shell loads showing his name, his assigned color, and one real cached Fastmail event. No Fastmail credentials are entered in the app.
+result: [pending]
+setup: Register the `familysync` OIDC client in Authelia (`require_pkce: true`, `pkce_challenge_method: S256`, `token_endpoint_auth_method: client_secret_basic`, redirect `https://familysync.<domain>/callback`, scopes openid/profile/email). Set OIDC env vars in `.env` — note `OIDC_AUTH_EXTERNAL_URL` is mandatory behind Pangolin. Deploy via `docker compose up -d`.
+
+### 2. AUTH-02 — Session persists across browser restart
+expected: After authenticating, fully close and reopen the browser, revisit the URL → no re-login prompt; the shell loads directly.
+result: [pending]
+
+### 3. AUTH-03 — Second member gets a distinct color
+expected: The wife logs in via Authelia on her device and is assigned a stable color distinct from Lucas's; it does not change on subsequent logins.
+result: [pending]
+
+### 4. SSE-over-Pangolin smoke test (de-risks Phase 4)
+expected: With a valid session cookie, `curl -N -H "Cookie: oidc-auth=<value>" https://familysync.<domain>/api/sse/heartbeat` streams a `heartbeat` event roughly every 10s and stays open for 5+ minutes without Pangolin cutting the stream. PASS = continuous heartbeats; FAIL = stream cut early (investigate Pangolin idle-timeout; note as Phase 4 constraint, ref issue #1034).
+result: [pending]
+
+## Summary
+
+total: 4
+passed: 0
+issues: 0
+pending: 4
+skipped: 0
+blocked: 0
+
+## Gaps