peter
a355285f3b
Final regression sign-off before deployment. Since #018 the only changes are cosmetic (table/body fonts), so no new API surface — this round is a broad regression sweep: full CRUD across all kinds, auth boundaries, confirmation that every closed issue (#003/#004/#006/#008/#010/#014/#015/ #016) stays fixed, and a sharing re-check. A clean pass is the deploy gate. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
77 lines
3.6 KiB
Markdown
77 lines
3.6 KiB
Markdown
# 019 — Handover to AGENT_DAYBOOK__LLM_TEST (round 4 — pre-deploy sign-off)
|
|
|
|
**Status:** For information — final regression pass before deployment.
|
|
|
|
This is the **last test round before the app is deployed**. Unlike previous
|
|
handoffs, there are essentially no new features to probe: since round-3
|
|
(#018), the only changes are cosmetic CSS (table fonts → monospace cells /
|
|
Arial headers; document body prose → system sans-serif). **No API or
|
|
behavioral surface changed.** So the goal here is a **broad regression
|
|
sweep** to confirm nothing has broken, so the maintainer can deploy with
|
|
confidence.
|
|
|
|
Everything is on `main` (pushed) and live on the local dev instance
|
|
(`http://127.0.0.1:8001`). Use the `test` / `testpwd` account and clean up
|
|
what you create.
|
|
|
|
## What to do: full regression sweep
|
|
|
|
Confirm the whole API still behaves. Don't just re-run one thing — cover the
|
|
surface, since a clean pass here is the deploy gate.
|
|
|
|
### Core CRUD, every kind
|
|
- `POST` each text kind (markdown, html_fragment, html_full, deck, json,
|
|
csv) → `201`, correct `kind`, renders, `raw_available` correct.
|
|
- `POST` each file kind (image, pdf, binary) and `.xlsx` (→ converts to csv).
|
|
- `GET /api/artifacts` (list, filters: source/label/day/kind/q) and
|
|
`GET /api/artifacts/{id}` (session-authed).
|
|
- `PATCH` (title/tags/metadata/source_* fields) and the immutable-field
|
|
rejections (content/source/kind/day → 400).
|
|
- `DELETE` → 204, files gone, second delete 404s.
|
|
- `/api/capabilities` returns the current kind/method/filter lists.
|
|
|
|
### Auth boundaries (important pre-deploy)
|
|
- No token / bad token on writes → 403.
|
|
- One user's token cannot read/patch/delete another user's artifact (404).
|
|
- List/detail reads require a session, not just a bearer token.
|
|
|
|
### Confirm every closed issue stays fixed
|
|
Spot-check the earlier repros — these are the regression-risk areas:
|
|
- **#014** — script/onerror in markdown/deck/html_fragment still stripped;
|
|
CSP `script-src 'none'` present on those (and `/s/`); html_full still
|
|
verbatim.
|
|
- **#015** — deeply nested JSON (content *and* request body) → 400, not 500.
|
|
- **#016** — ragged CSV rows don't drop cells.
|
|
- **#010 / #006** — quota race and eviction (thin/no automated coverage):
|
|
concurrent posts never exceed quota; a doomed post doesn't destroy unkept
|
|
artifacts.
|
|
- **#008** — non-string source_* → 400.
|
|
- **#003 / #004** — length limits and content-shape checks still enforced.
|
|
|
|
### Sharing (the unauthenticated surface — worth re-checking before going live)
|
|
- Share toggle creates/clears the token; `/s/{token}` serves unauthenticated;
|
|
unsharing kills the old link immediately; a bad/guessed token 404s; an
|
|
unshared artifact's embedded assets are not reachable anonymously.
|
|
|
|
## Cosmetic changes since #018 (not API-testable, FYI only)
|
|
|
|
- Table cells render in monospace, headers in Arial.
|
|
- Document body prose is system sans-serif (was serif in the report theme).
|
|
- Earlier UI-only work: unified off-white artifact backgrounds, greyscale
|
|
chrome, dark-mode toggle, top-bar logo, sidebar width behavior.
|
|
|
|
None of these change API responses; verify only if a render looks broken.
|
|
|
|
## Out of scope / don't report
|
|
- **#017** (customizable theme variants) is an accepted design issue, not a
|
|
bug.
|
|
- `html_full` being verbatim/unsanitized is by design.
|
|
- `pdf` using the browser's grey viewer chrome is expected.
|
|
|
|
## Outcome
|
|
- **Clean sweep → the maintainer deploys.** If you find anything, file it as
|
|
a new numbered issue (next is **#020**), severity-tagged, so it can be
|
|
triaged as deploy-blocking or deploy-after.
|
|
|
|
As always: `test`/`testpwd`, clean up, and check `artifacts/views.py` before
|
|
calling a surprise a bug.
|