Refuse an emailless identity where the session is minted, and rows the upstream should not have sent

2026-09-02 18:24:56 +02:00
parent 390ac5f112
commit 18dc4f3136
14 changed files with 59 additions and 33 deletions
@@ -179,9 +179,8 @@ test("the reference plugin: public Overview is open to all, My shifts takes any
  await expect(page.locator('.sidebar a[href="/scheduling/shifts"]')).toHaveCount(0); // gated leaf filtered out
  await expect(page.locator('.sidebar a[href="/scheduling/mine"]')).toHaveCount(1); // session gate: a session is enough

-  // And the page itself renders for that same member, holding no permission at all. This stack runs
-  // no shifts upstream, so it also pins the degraded page: the reason, never a 500 and never a claim
-  // about what is assigned. The working page is asserted against a real upstream in full-flow.spec.
+  // No shifts upstream on this stack, so this also pins the degraded page: the reason, never a 500
+  // and never a claim about what is assigned.
  await page.goto("/scheduling/mine");
  await expect(page.getByRole("heading", { name: "My shifts" })).toBeVisible();
  await expect(page.getByText("Couldn't reach the scheduling service")).toBeVisible();