2026.06.04 frontend építés közben

docs/v201/16_TESTING_AND_DEPLOYMENT_GUIDE.md

@@ -0,0 +1,35 @@
+# 16. TESTING AND DEPLOYMENT GUIDE
+## Current Testing State
+
+### E2E Auth Flow Test (PASSED - 2026-04-01)
+We have successfully executed the complete Identity & Onboarding E2E test inside the `sf_api` container.
+
+#### Prerequisites Configuration
+Before the test run, SSoT configuration values were injected into `system.system_parameters`:
+- `auth_remember_me_days`: 30
+- `auth_refresh_default_days`: 1
+- `auth_password_strict`: True
+
+#### Executed Scenarios & Results
+
+1. **LITE REGISTRATION TEST** - **PASSED**
+   - Successfully registered `test_architect@example.com` with a complex password.
+   - Database confirmed `is_active=False` for both User and Twin Person.
+
+2. **EMAIL VERIFICATION TEST** - **PASSED**
+   - Token retrieved from `identity.verification_tokens`.
+   - Endpoint `POST /auth/verify-email` processed the token.
+   - Fixed an architectural bug where `is_active` was not updated correctly upon token validation. It now updates the status to `True` successfully.
+
+3. **REMEMBER ME / COOKIE TEST** - **PASSED**
+   - Performed `POST /auth/login` with `remember_me=true`.
+   - Fixed missing `Set-Cookie` header logic. The API now correctly returns `refresh_token` as an `HttpOnly`, `Secure`, `SameSite=lax` cookie with `Max-Age` aligned to SSoT (30 days).
+
+4. **SOFT DELETE / ANONYMIZATION TEST** - **PASSED**
+   - Verified that `AuthService.soft_delete_user` anonymizes the email prefixing with `deleted_`.
+   - Record `is_active` set to `False` and `is_deleted` set to `True`.
+
+### Deployment Checklist (API)
+- [x] Database Sync Engine verifies SSoT variables.
+- [x] SSoT configurations drive `auth_service` parameters.
+- [x] Hybrid authentication token delivery works per specification.