281 Commits

Author	SHA1	Message	Date
lilleman	1fc6033dd5	Give the JsonWebKey alias the kid a JWKS selects a key by	2026-11-08 23:26:03 +01:00
lilleman	1304cdae56	Read JsonWebKey from webcrypto, where @types/node 26 exports it	2026-11-08 23:26:03 +01:00
lilleman	0a9c79d08f	Refuse a malformed admin DSN before postgres 4 connects to the host it misreads	2026-11-08 23:26:03 +01:00
lilleman	42661b111f	Flush the logger in the OTLP export test, since @larvit/log 2.4.0 batches records	2026-11-08 23:14:55 +01:00
lilleman	0727d15964	Trim two stale comments in the grants and Keto client headers	2026-11-08 22:24:18 +01:00
lilleman	2b19ed27d2	Answer prose round 1: 1 🔴, 4 🟡 (0 misread); correct the older changelog entries, keep each fact in one home, rewrap the Keto header	2026-11-08 22:15:54 +01:00
lilleman	63c90ea3d6	Answer stability round 1: 0 🔴, 5 🟡 (1 misread); pin the revoke, redirect, 503 and URL-slash paths with tests, and stop calling an undeclared grant dormant	2026-11-08 22:15:54 +01:00
lilleman	4d2e7b59fd	List grants no plugin declares with a Remove, and save a permission change as one Keto transaction	2026-11-08 22:04:52 +01:00
lilleman	216089c067	Answer stability round 1: 0 🔴, 0 🟡 (0 misread); drop the call-count guard, tighten the test's comments	2026-11-08 21:53:53 +01:00
lilleman	56807434e8	Make the client-abort log test wait on the handler, not on fixed sleeps	2026-11-08 21:51:13 +01:00
lilleman	e328832374	Answer prose round 1: 0 🔴, 4 🟡 (0 misread); repoint the stale /admin examples and the plugin-api comment, fix the examples row	2026-11-08 21:33:58 +01:00
lilleman	8324a9c59e	Answer stability round 1: 0 🔴, 4 🟡 (0 misread); own-key rename lookup, test the host translator, name both id kinds in the conflict, keep admin unreserved	2026-11-08 21:33:55 +01:00
lilleman	05da1d7897	Rename the admin example plugin to auth-admin, and let config/menu.ts hide or rename a profile-menu entry	2026-11-08 21:25:11 +01:00
lilleman	3179be0d11	Answer prose round 1: 0 🔴, 10 🟡 (0 misread); define code health, restore the topic index, give each decision a premise of its own	2026-11-08 21:09:19 +01:00
lilleman	4c8ba083ce	Answer stability round 1: 0 🔴, 2 🟡 (0 misread); repoint the compose test's comment, split the :read guards' reasons	2026-11-08 21:09:19 +01:00
lilleman	7ad46d0adf	Move the decisions out of AGENTS.md into docs/decisions.md	2026-11-08 21:00:53 +01:00
lilleman	f8a611992a	Answer stability round 1: 0 🔴, 5 🟡 (0 misread); test the setting and idless-nav rules, fix discovery's header	2026-11-08 20:47:52 +01:00
lilleman	fdef624300	Answer prose round 1: 0 🔴, 3 🟡 (0 misread); drop the conflicts header, make the CI/CD pointer a bare link	2026-11-08 20:47:52 +01:00
lilleman	9b1b201f65	Split conflict detection out of plugin.ts and the CI/CD section out of the README	2026-11-08 20:39:49 +01:00
lilleman	9ded502be3	Answer stability round 1: 0 🔴, 4 🟡 (0 misread); test the guards the split rewrote	2026-11-08 20:33:19 +01:00
lilleman	ea6c32a7db	Answer prose round 1: 0 🔴, 5 🟡 (0 misread); comments match the stages, item 59's detail reads plainly	2026-11-08 20:16:41 +01:00
lilleman	c4eb9dde1f	Answer security round 1: 0 🔴, 0 🟡 (0 misread); route on the method and path read before the hooks	2026-11-08 19:57:54 +01:00
lilleman	b4579131a2	Split handleRequest into named stages, so the stage order is written once	2026-11-08 19:55:26 +01:00
lilleman	77e3d46769	Rename ShellUser.menu to profileLinks, so menu keeps one meaning in the shell	2026-11-08 19:35:14 +01:00
lilleman	523e8b3724	Answer stability round 1: 1 🔴, 3 🟡 (0 misread); scope the visual selector, check label and cover the gaps	2026-11-08 19:25:57 +01:00
lilleman	a558f8340f	Answer prose round 1: 0 🔴, 0 🟡 (0 misread); apply the nits	2026-11-08 19:25:57 +01:00
lilleman	777c0bd86d	Let a plugin add links to the profile menu, and list the setting conflict kind	2026-11-08 19:17:57 +01:00
lilleman	c3ca92713e	Point the request-wrapper comments at request-tracking.ts	2026-11-08 15:10:53 +01:00
lilleman	b19b43685c	Answer stability round 1: 2 🔴, 3 🟡 (0 misread); refuse a trailing-slash range, full plugin route, merged tests, compose passes TRUSTED_PROXIES	2026-11-08 15:06:19 +01:00
lilleman	a69593eb72	Put the caller, site and route on every request's span and log line	2026-11-08 14:59:55 +01:00
lilleman	9af29ffdb9	Answer stability round 1: 1 🔴, 4 🟡 (0 misread); assetHref in the test fakes, one shared buildContext option set, default pinned, upgrade note and AGENTS.md corrected	2026-11-08 14:41:19 +01:00
lilleman	404f2584ac	Add buildPaginationModel and ctx.assetHref, and bump the plugin contract to 0.5.0	2026-11-08 14:32:05 +01:00
lilleman	4239ee12f0	Answer stability round 1: 0 🔴, 3 🟡 (0 misread); gate test pins each source, builtin-route name, exact CSS wording	2026-11-08 14:18:39 +01:00
lilleman	a2493edff2	Move test-only tooling to src/test-tooling, split positive, warn on undeclared gated permissions	2026-11-08 14:09:20 +01:00
lilleman	5aa62e2742	Record reading cost for item 51's chunk	2026-11-08 14:09:20 +01:00
lilleman	a3b8632d5c	Answer prose round 1: 0 🔴, 1 🟡 (0 misread); the secrets checklist reads in one pass, and four comments shrink or say granted	2026-11-03 21:46:57 +01:00
lilleman	fefc7cee30	Plan 0.5.0 from the ten highest-scoring items; reserve the plugin id error, translate the duplicate-group refusal, and correct four comments and README passages	2026-11-03 21:43:57 +01:00
lilleman	8ffbb0b70d	Answer stability round 1: 0 🔴, 4 🟡 (0 misread); the driver decides what parses so a multi-host DSN still works, and the nine-key test shrinks to four	2026-10-31 13:56:46 +01:00
lilleman	217a36252e	Keep a URL config value out of the boot error that rejects it	2026-10-31 13:48:43 +01:00
lilleman	396ce93a2f	Answer prose round 1: 0 🔴, 0 🟡 (0 misread); the redundant comment goes, the changelog entry shrinks to one sentence	2026-10-31 13:43:04 +01:00
lilleman	5be561c4ba	Answer stability round 1: 0 🔴, 3 🟡 (0 misread); the tests quote each non-secret value and run one case per type, the config.ts URL leak is filed as item 55	2026-10-31 13:43:04 +01:00
lilleman	8f7bc59b38	Keep a secret setting's raw value out of the boot error that rejects it	2026-10-31 13:38:27 +01:00
lilleman	3592a30f98	Answer prose round 1: 0 🔴, 2 🟡 (0 misread); the view header calls the link a URL, the always-present code loses its guard, the test comment goes	2026-10-31 13:11:21 +01:00
lilleman	00fe8b0dd2	Answer stability round 1: 0 🔴, 2 🟡 (0 misread); the admin recovery journey gets an E2E, the Kratos comments no longer claim a mailed link	2026-10-31 13:11:21 +01:00
lilleman	4cb21d8909	Link the admin's recovery-code notice to the flow the code was minted on	2026-10-31 13:05:06 +01:00
lilleman	ccb4d32d39	Answer prose round 1: 0 🔴, 4 🟡 (0 misread); comments say what the forms post where, restating test comments go	2026-10-31 12:59:28 +01:00
lilleman	053438f968	Answer product-owner round 1: 0 🔴, 2 🟡 (0 misread); the submit sends a same-origin Referer, Kratos' redirect to this host keeps the chosen locale	2026-10-31 12:59:28 +01:00
lilleman	29d496a02e	Answer stability round 1: 0 🔴, 2 🟡 (0 misread); the submit test pins manual redirects and the 5xx boundary, recovery gets its E2E, the Referer is sent	2026-10-31 12:59:28 +01:00
lilleman	03d7be61b3	Keep the code-flow submit within the function limits and list its routes	2026-10-31 12:43:16 +01:00
lilleman	ead604f49d	Accept a verification or recovery code pasted with whitespace around it	2026-10-31 12:41:11 +01:00