36 lines
1.7 KiB
Markdown
36 lines
1.7 KiB
Markdown
# 16. TESTING AND DEPLOYMENT GUIDE
|
|
## Current Testing State
|
|
|
|
### E2E Auth Flow Test (PASSED - 2026-04-01)
|
|
We have successfully executed the complete Identity & Onboarding E2E test inside the `sf_api` container.
|
|
|
|
#### Prerequisites Configuration
|
|
Before the test run, SSoT configuration values were injected into `system.system_parameters`:
|
|
- `auth_remember_me_days`: 30
|
|
- `auth_refresh_default_days`: 1
|
|
- `auth_password_strict`: True
|
|
|
|
#### Executed Scenarios & Results
|
|
|
|
1. **LITE REGISTRATION TEST** - **PASSED**
|
|
- Successfully registered `test_architect@example.com` with a complex password.
|
|
- Database confirmed `is_active=False` for both User and Twin Person.
|
|
|
|
2. **EMAIL VERIFICATION TEST** - **PASSED**
|
|
- Token retrieved from `identity.verification_tokens`.
|
|
- Endpoint `POST /auth/verify-email` processed the token.
|
|
- Fixed an architectural bug where `is_active` was not updated correctly upon token validation. It now updates the status to `True` successfully.
|
|
|
|
3. **REMEMBER ME / COOKIE TEST** - **PASSED**
|
|
- Performed `POST /auth/login` with `remember_me=true`.
|
|
- Fixed missing `Set-Cookie` header logic. The API now correctly returns `refresh_token` as an `HttpOnly`, `Secure`, `SameSite=lax` cookie with `Max-Age` aligned to SSoT (30 days).
|
|
|
|
4. **SOFT DELETE / ANONYMIZATION TEST** - **PASSED**
|
|
- Verified that `AuthService.soft_delete_user` anonymizes the email prefixing with `deleted_`.
|
|
- Record `is_active` set to `False` and `is_deleted` set to `True`.
|
|
|
|
### Deployment Checklist (API)
|
|
- [x] Database Sync Engine verifies SSoT variables.
|
|
- [x] SSoT configurations drive `auth_service` parameters.
|
|
- [x] Hybrid authentication token delivery works per specification.
|