2 Commits

Author	SHA1	Message	Date
Matt Mabrey	73da684b99	T10.4: remove the local password path entirely ... Real deletion (D15's 'full replacement'), not a toggle. Okta is now the only credential this app accepts anywhere. Backend: - server/models.py: drop User.password_hash. - server/alembic/versions/1d60a608bb51_...: matching migration (op.drop_column, same plain-drop precedent as project_role/locked_until/etc.; downgrade re-adds it with server_default=''). - server/auth.py: remove hash_password/verify_password/password_problem/ MIN_PASSWORD_LEN/_COMMON_PASSWORDS, create_reset_token/decode_reset_token/ RESET_MINUTES, the bcrypt import. Roles/tokens/cookies/get_current_user untouched. - server/app.py: remove login(), the whole self-service reset-password block (forgot-password/reset-available/reset-password), and change_password() (POST /api/auth/password). Rework create_user() to drop the password field (with a docstring note: the username must exactly match the eventual Okta identity claim, or a later sign-in provisions a second account instead of matching this one). Remove admin_reset_password() outright - nothing left to reset. Fixes a bug this task's own predecessor left behind: okta_callback()'s JIT provisioning (T10.3) was still setting password_hash="", which would have raised TypeError the moment the column was actually dropped. Admin bootstrap (D16): server/manage_users.py moves from creating accounts (create/create-admin/reset-password, all password-based) to a single 'promote <username> --role <role>' command that changes the role on a row Okta's JIT provisioning already created - the documented path for naming the first admin. list/disable/enable unchanged. Frontend: html/users.js drops the password field and validation from createUser(), removes resetPw() and its button (nothing left to reset). html/users.html drops the #nu-password input, adds a tooltip on username explaining the exact-match-to-Okta requirement. html/auth-guard.js removes the wpChangePassword dialog; html/wp-sidenav.js removes the 'Password' menu item that opened it. Tests: tests/browser_check.py and tests/launcher_check.py stop hashing a password to seed fixture rows (and the --keep-server hint now prints a ready-to-use cookie-setting snippet instead of a dead username/password). tests/pipeline_check.py and tests/token_check.py drop an unused PW import. tests/console_dialogs_check.py: the admin password-reset dialog it drove no longer exists, so that scenario is removed - the prompt-with-validate() UI pattern it exercised is still covered via creator_dialogs_check.py's wp-creation-app.js call sites, noted in this file's docstring so the coverage move isn't silent. tests/url_state_check.py: the "next= survives a real sign-in via login" scenario is explicitly marked SKIPPED (not deleted, not faked) - that promise is specific to the login FORM this task removed and can't be honestly re-proven until T10.5 rebuilds it as an Okta redirect; a minted-token cookie now stands in as setup only, so scenarios 3-6 in that file still get a signed-in page to run against. server/smoketest.py and server/seed_demo.py: switched from POST /api/auth/login to minting a session the same way okta_callback() does (auth.create_token(), seeded into the cookie jar) rather than waiting on T10.7. This is a real operational change, documented in both files' own AUTHENTICATION sections: they now need to run where AUTH_SECRET_KEY and the database match the target server's (inside the api container, or local dev) - they can no longer sign in to an arbitrary remote URL from an unrelated workstation, because Okta requires a real browser and these are stdlib scripts. The account must already exist; neither script creates or promotes one. server/requirements.txt: bcrypt dropped, nothing imports it anymore. Verified: full Alembic chain (baseline through this migration) upgrades and downgrades cleanly against a throwaway SQLite DB. okta_callback() JIT provisioning re-tested against the post-migration schema (would have thrown before the password_hash="" fix above). create_user() verified via a live HTTP call with no password field. manage_users.py promote verified end to end (seed a JIT-shaped row at project_user, promote to admin, list). smoketest.py and seed_demo.py both run to completion against a live uvicorn instance using the new minted-session path - 25/25 checks, including logout actually invalidating the session (proving the cookie-jar seeding didn't just fake the sign-in, it preserved the real expiry mechanics). wave-10.md T10.4 / D15 / D16	2026-09-03 10:58:28 -07:00
n.siegfried	b54034db04	T4.2 - S3: the app's state has an address; X1 is unblocked ... Wave 0 counted pushState across html/ and found 0. Every page read its query string once at boot and never wrote one again, so you could not send anyone a link to WP07, a refresh dropped you back at the default view, and Back left the app entirely because the app had never added a history entry. CR-011 and CR-014 both promise an email carrying a direct link to a work package. That is X1, and it was blocked on this. It is not blocked now. html/wp-url.js is the whole mechanism, and it is deliberately NOT a router. Nothing in it intercepts navigation or renders anything; it is the query string treated as state that can be read, merged, written and subscribed to. Pages keep their own rendering. Query parameters rather than a hash, because the server already serves these paths and a hash is never sent to the server - which matters the day a link has to be resolved before the page boots. The merge behaviour is the part that earns its place: WPUrl.push({wp:id}) keeps the active project, and WPUrl.push({wp:''}) clears one key without needing to know what else is in the URL. Hand-built URLs losing ?project= is the usual way this goes wrong. WIRED: the creator (open package, dashboard view), the SOP wizard (tool, step), the launcher (project). Each records a history entry only when the user chose the change - restoring from the URL uses replace, or Back would immediately add an entry and appear to do nothing. WPUrl.absolute() is what CR-011/CR-014 will paste into an email in wave 8. TWO BUGS THIS TASK CREATED AND FIXED, both found by the probe rather than by reading: - bootSOP() calls newPackage() during boot, and newPackage() cleared ?wp=. A deep link therefore worked and then erased its own parameter, leaving Back with nothing to return to. Now guarded on wpCreatorReady. - goToStep() runs validateStep(), which ends in alert() when a required field is empty - always true on a freshly loaded page. So restoring ?step=3 from a shared link opened a modal dialog mid-boot, and hung the browser under CDP. Restoring a view is not a forward navigation and no longer runs the forward-navigation guard. The second one is worth keeping in mind for the rest of wave 4: this app has 79 native dialogs, and any of them firing during a restore path will hang a headless browser rather than fail visibly. VERIFICATION. tests/url_state_check.py, 23 checks, all passing, covering every done-when on the task: - a URL identifying a work package opens that package - the same URL for a SIGNED-OUT user goes to login, carries the target through ?next=, and lands on the work package itself after signing in - refresh preserves project, package, tab and view - Back and Forward move through states, verified as still-initialised rather than reloaded, and with the dashboard actually rendered rather than only the URL changed - a different user opening the same URL reaches the same view - nothing credential-shaped appears in the query string Metric 8, pushState: was 0 at wave 0, now 2 in html/ (one pushState and one replaceState, both in wp-url.js) behind 6 call sites across 4 files. The raw count stays low by design - one place writes history, which is the same reason the token work put one place in charge of colour. browser_check 71/71, f_items 5 FIXED / F6 REPRODUCES, aggregates 16/16. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-15 19:32:31 -05:00