service-finder/docs/v201/16_TESTING_AND_DEPLOYMENT_GUIDE.md

16. TESTING AND DEPLOYMENT GUIDE

Current Testing State

E2E Auth Flow Test (PASSED - 2026-04-01)

We have successfully executed the complete Identity & Onboarding E2E test inside the sf_api container.

Prerequisites Configuration

Before the test run, SSoT configuration values were injected into system.system_parameters:

• auth_remember_me_days: 30
• auth_refresh_default_days: 1
• auth_password_strict: True

Executed Scenarios & Results

1. LITE REGISTRATION TEST - PASSED

   • Successfully registered test_architect@example.com with a complex password.
   • Database confirmed is_active=False for both User and Twin Person.

2. EMAIL VERIFICATION TEST - PASSED

   • Token retrieved from identity.verification_tokens.
   • Endpoint POST /auth/verify-email processed the token.
   • Fixed an architectural bug where is_active was not updated correctly upon token validation. It now updates the status to True successfully.

3. REMEMBER ME / COOKIE TEST - PASSED

   • Performed POST /auth/login with remember_me=true.
   • Fixed missing Set-Cookie header logic. The API now correctly returns refresh_token as an HttpOnly, Secure, SameSite=lax cookie with Max-Age aligned to SSoT (30 days).

4. SOFT DELETE / ANONYMIZATION TEST - PASSED

   • Verified that AuthService.soft_delete_user anonymizes the email prefixing with deleted_.
   • Record is_active set to False and is_deleted set to True.

Deployment Checklist (API)

• Database Sync Engine verifies SSoT variables.
• SSoT configurations drive auth_service parameters.
• Hybrid authentication token delivery works per specification.