Lucas BergerandClaude Opus 4.8
17a531550a
Two issues surfaced only when plans 19-04 (login UI) and 19-05 (Option C bypass + login.spec) were merged together and run against the real stack — neither executor could catch them in isolation: 1. LOCAL_SESSION_SECRET was added to the CI harness (ci.yml) but not to the local dev stack (docker-compose.dev.yml). Without it the real-login success path (POST /api/auth/local/login) 503s when signing the session cookie, so the e2e round-trip failed. Add the same fixed dev-only value to the dev compose override (dev-only target; never a production secret). 2. login.spec test 1 assumed clearing the local-session cookie yields a logged-out state, but under the always-on DEV_AUTH_BYPASS devAuthBypass() injects DEV_USER into /api/me regardless of any cookie — a logged-out state is architecturally unreachable in this bypass-only harness. Reframe the test to drive /login directly (validating the real-browser render of all brand + form surfaces) and move the unauthenticated root->/login redirect-gate coverage to a unit test in App.test.tsx where meQuery.isError is controllable. Result: API 446/446, PWA 265/265 (+2 gate tests), e2e desktop 42 passed / 3 skipped (all login specs green). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
30 lines
1.1 KiB
YAML
30 lines
1.1 KiB
YAML
# Local dev overrides — use with: docker compose -f docker-compose.yml -f docker-compose.dev.yml up
|
|
services:
|
|
api:
|
|
build:
|
|
context: .
|
|
dockerfile: apps/api/Dockerfile
|
|
target: dev
|
|
volumes:
|
|
- ./apps/api/src:/app/apps/api/src
|
|
environment:
|
|
NODE_ENV: development
|
|
# Local-dev only: skip OIDC and authenticate as Dev User id 1. Guarded by
|
|
# NODE_ENV !== 'production' (and the production image bakes NODE_ENV=production),
|
|
# so this can never activate in a shipped image. Required by the e2e harness.
|
|
DEV_AUTH_BYPASS: 'true'
|
|
# Phase 19 (AUTH-LOCAL-16, D-14/D-15): required for devSessionCookieMiddleware to
|
|
# issue real local-session cookies under bypass AND for the real-login round-trip
|
|
# (POST /api/auth/local/login) to sign a session — without it that path 503s.
|
|
# Fixed dev-only value, mirrors the CI harness job (.gitea/workflows/ci.yml) —
|
|
# NEVER a production secret; this override file is dev-only (target: dev).
|
|
LOCAL_SESSION_SECRET: 'dev-secret-change-me-0000000000000000'
|
|
|
|
mariadb:
|
|
ports:
|
|
- '3306:3306'
|
|
|
|
redis:
|
|
ports:
|
|
- '6379:6379'
|