lilleman
ea4777c099
Declare plugin settings in the manifest, resolve them from the environment
CI / full-gate (push) Successful in 2m52s
2026-08-23 13:17:03 +02:00
lilleman
bba048e38f
Refuse a throwaway plugin storage secret in bootstrap, before any role is created
CI / full-gate (push) Successful in 2m56s
2026-08-18 23:24:34 +02:00
lilleman
bf638dfb19
Give a plugin a Postgres database of its own
CI / full-gate (push) Successful in 2m58s
2026-08-18 23:12:13 +02:00
lilleman
5cc6c3d93e
Todo: note the code-field hint landed, the paste fix did not
CI / full-gate (push) Successful in 2m49s
Mirror / github-mirror (push) Successful in 6s
2026-08-18 22:07:21 +02:00
lilleman
a64a60644d
Todo: record the flow-POST proxy findings for the verification-code fix
CI / full-gate (push) Successful in 2m44s
2026-08-18 22:00:31 +02:00
lilleman
950eb5a911
Todo: record the manifest-over-.env decision for plugin config
CI / full-gate (push) Successful in 2m47s
2026-08-18 21:55:35 +02:00
3f9787df48
Follow symlinked plugin folders, and keep a plugin .npmrc out of the image
CI / full-gate (push) Successful in 2m44s
2026-08-18 07:49:51 +02:00
616040fda6
Refuse a shadowing barrel copy, and record the packaging contract
CI / full-gate (push) Successful in 2m45s
2026-08-17 22:34:56 +02:00
fee4fe632b
Let a plugin carry its own package.json and npm dependencies
CI / full-gate (push) Successful in 2m53s
2026-08-17 22:23:53 +02:00
lilleman
8a5d2dfd6c
Make the two persona references self-contained now that the section is gone
CI / full-gate (push) Successful in 2m40s
2026-08-05 23:42:58 +02:00
lilleman
a005acb93d
Cut non-essential prose from docs and comments, and require the same of every future change
...
CI / full-gate (push) Successful in 2m38s
README loses the competitor comparison, the personas and the repeated philosophy; the
five near-identical E2E command blocks become a table plus one command, and the file
map a clause per entry. AGENTS.md keeps every decision but drops the narrative around
them. todo.md's completed items collapse to their task line — git holds the rest.
Comments lose restatement, README duplication and history ("used to", "originally",
dated notes). AGENTS.md gains a Prose discipline section making this a standing pass on
every change rather than a one-off cleanup.
src/compose.test.ts now expects 6 documented E2E run commands, not 10, since the README
states the command once instead of per suite.
2026-08-05 23:41:12 +02:00
lilleman
f5240ef7f6
Record macOS as a supported dev host and the commands still unverified there
CI / full-gate (push) Successful in 2m37s
Mirror / github-mirror (push) Successful in 3s
2026-08-05 22:55:48 +02:00
lilleman
073ec294e9
Run the E2E runner as the invoking user so its artifacts aren't root-owned
CI / full-gate (push) Successful in 2m37s
2026-08-05 22:25:17 +02:00
lilleman
ab5c24deb7
Cut the node_modules prose to one home each; drop a stray tracked file
CI / full-gate (push) Successful in 2m38s
2026-08-05 19:52:09 +02:00
lilleman
bcf4d7fb1f
Install deps above WORKDIR so no root-owned node_modules lands in the checkout
CI / full-gate (push) Successful in 2m45s
2026-08-05 18:18:49 +02:00
lilleman
f76cd2a267
Todo updates
CI / full-gate (push) Successful in 2m42s
2026-08-05 17:48:55 +02:00
lilleman
edcd9fefc8
Deleting a group revokes the permissions it granted
2026-08-05 15:39:08 +02:00
lilleman
1787754781
Extend the read-only treatment to OAuth2 clients and write-intent GETs
2026-08-05 15:38:56 +02:00
lilleman
765f349007
Model the read/write split in the UI: read-only views, self-revoke and inherited-grant guards
2026-08-05 15:38:37 +02:00
lilleman
29d654c012
Permissions are a fixed list from plugin code; grant them on Users and Groups
2026-08-05 15:38:21 +02:00
lilleman
fb4382be9d
Enforce the permission-name rule at discovery, for every plugin
2026-08-05 15:38:00 +02:00
lilleman
27fee5f8a3
Permission names are <resource>:<action>, replacing the catch-all admin permission
2026-08-05 15:37:39 +02:00
lilleman
9412b90946
More todos
CI / full-gate (push) Successful in 2s
Mirror / github-mirror (push) Successful in 3s
2026-08-05 14:18:09 +02:00
lilleman
225569b08a
More todos
CI / full-gate (push) Successful in 3s
Mirror / github-mirror (push) Successful in 2s
2026-08-05 12:08:09 +02:00
lilleman
32154fbbc0
Record the unpinned Playwright worker pool as an open decision
CI / full-gate (push) Successful in 2m43s
Mirror / github-mirror (push) Successful in 7s
2026-08-05 11:21:57 +02:00
lilleman
690d67728b
Watch what a beforeAll logs, and record where each message came from
CI / full-gate (push) Successful in 2m48s
2026-08-05 11:15:37 +02:00
lilleman
e808f87fbd
Fail an E2E test on anything the browser logs, in all three engines
CI / full-gate (push) Successful in 2m51s
2026-08-05 11:00:25 +02:00
lilleman
81043edfc6
Count both paths of a rename in the docs-only CI skip
2026-08-05 10:15:09 +02:00
lilleman
b1b01f8bdc
More todos
CI / full-gate (push) Successful in 7s
2026-08-05 08:35:08 +02:00
lilleman
c54f5e2c51
New todos
CI / full-gate (push) Has been cancelled
2026-08-05 08:33:49 +02:00
lilleman
cfeee10fa8
Wrap each popover menu and give it a caller-named id
CI / full-gate (push) Successful in 2m43s
2026-08-05 01:58:11 +02:00
lilleman
5d9bdebf59
Close the popup menus on an outside click, via the popover API
CI / full-gate (push) Successful in 2m40s
2026-08-05 01:37:58 +02:00
lilleman
64d1387df2
Scope the profile-menu assertion to the menu itself
CI / full-gate (push) Successful in 2m38s
Mirror / github-mirror (push) Successful in 7s
2026-08-05 01:08:09 +02:00
lilleman
3c64621515
Remove the dead Profile link from the sidebar profile menu
CI / full-gate (push) Successful in 2m39s
2026-08-05 01:01:14 +02:00
lilleman
2b09635ed5
Hold the one-verb rule in AGENTS.md instead of a unit test
CI / full-gate (push) Successful in 2m38s
Mirror / github-mirror (push) Successful in 6s
2026-08-05 00:52:09 +02:00
lilleman
34b668d49f
Use one verb per action in the English UI: sign in, sign out, create account
CI / full-gate (push) Successful in 2m39s
2026-08-05 00:34:05 +02:00
lilleman
46548ae758
Narrow the settings-cog test assertions and record the icon-registry contract
CI / full-gate (push) Successful in 2m37s
Mirror / github-mirror (push) Successful in 6s
2026-08-05 00:20:34 +02:00
lilleman
8f7ab55267
Remove the Settings cog and its Preferences menu from the sidebar footer
CI / full-gate (push) Successful in 2m37s
2026-08-05 00:08:35 +02:00
lilleman
7948596105
New todos
CI / full-gate (push) Successful in 7s
Mirror / github-mirror (push) Successful in 6s
2026-08-04 23:48:26 +02:00
lilleman
89a234b841
Add a todo for guarding the double-clicked submit without client JS
CI / full-gate (push) Successful in 2m38s
2026-08-04 10:40:37 +02:00
lilleman
93139ea058
Stability round two: no language links on POST-rendered pages, scoped observers, Vary only where it varies
CI / full-gate (push) Successful in 2m37s
2026-08-04 00:10:31 +02:00
lilleman
245d1ad5b5
Add i18n support: per-locale catalogs, URL-driven locale, translated core and examples
CI / full-gate (push) Successful in 2m37s
2026-08-03 22:37:27 +02:00
lilleman
f38b5373bd
Say user throughout, noting Ory's identity naming in the docs
2026-08-03 17:41:40 +02:00
lilleman
9966b6bd46
Record the authorization vocabulary decision in AGENTS.md
2026-08-03 17:41:40 +02:00
lilleman
04fe5b1e06
Cut the security-model threat table down to what the code cannot show
2026-08-03 17:41:40 +02:00
lilleman
3486e0ad00
Rename the Keto User namespace to Identity, matching Kratos
2026-08-03 17:41:40 +02:00
lilleman
8f9f79ac30
Document the users, groups and roles model in README
2026-08-03 17:41:40 +02:00
lilleman
4b4ac178ab
Record the open CSRF token-binding decision as a todo item
2026-08-03 17:41:40 +02:00
lilleman
5a5803b265
Review fixes: denylist-conditional revoke, Ory secret wiring, exp guard test
2026-08-03 17:41:40 +02:00
lilleman
a2204782fa
Review fixes: re-mint path, real session lifetime, full secret checklist
2026-08-03 17:41:40 +02:00
lilleman
lilleman