lilleman b5af4ba6cd E2E for token timeout + refresh (todo §4); full-stack auth-refresh.spec.ts (real Ory stack): a lapsed session JWT is silently re-minted from the live Kratos session (roles re-read from Keto), and cleared once the session is revoked; ory/kratos/e2e.yml shortens the tokenizer ttl to 8s + adds JWT_CLOCK_SKEW_SEC config so re-mint fires at expiry; scope visual suite to visual.spec.ts

2026-06-18 11:32:23 +02:00

..

app.test.ts

Secure cookie flags + CSRF for our own POST forms (todo §4); SECURE_COOKIES toggle on session/CSRF cookies; csrf.ts signed double-submit token + body.ts form reader; logout is now a CSRF-guarded POST form

2026-06-18 11:12:32 +02:00

app.ts

Secure cookie flags + CSRF for our own POST forms (todo §4); SECURE_COOKIES toggle on session/CSRF cookies; csrf.ts signed double-submit token + body.ts form reader; logout is now a CSRF-guarded POST form

2026-06-18 11:12:32 +02:00

auth-card.test.ts

Render SSO buttons per configured Kratos OIDC provider (todo §4); flow-view collects oidc nodes → auth-card submit buttons, server-side visibility, drop mockup #sso-toggle CSS

2026-06-17 18:20:45 +02:00

body.test.ts

Secure cookie flags + CSRF for our own POST forms (todo §4); SECURE_COOKIES toggle on session/CSRF cookies; csrf.ts signed double-submit token + body.ts form reader; logout is now a CSRF-guarded POST form

2026-06-18 11:12:32 +02:00

body.ts

Secure cookie flags + CSRF for our own POST forms (todo §4); SECURE_COOKIES toggle on session/CSRF cookies; csrf.ts signed double-submit token + body.ts form reader; logout is now a CSRF-guarded POST form

2026-06-18 11:12:32 +02:00

bootstrap.test.ts

Bootstrap: print first-run login banner (URL + seeded creds + change-before-prod warning)

2026-06-17 16:22:48 +02:00

bootstrap.ts

Tighten §3 comments (todo §3); drop stale 'next §3 item' forward-refs, condense compose/Ory/bootstrap headers

2026-06-17 17:00:47 +02:00

compose.test.ts

Unify §3 test overlaps (todo §3); fold the 5× image-pin checks into one compose.test.ts scan + same-version sidecar test, drop the duplicate committed-JWKS re-validation in config.test.ts

2026-06-17 17:07:39 +02:00

config.test.ts

E2E for token timeout + refresh (todo §4); full-stack auth-refresh.spec.ts (real Ory stack): a lapsed session JWT is silently re-minted from the live Kratos session (roles re-read from Keto), and cleared once the session is revoked; ory/kratos/e2e.yml shortens the tokenizer ttl to 8s + adds JWT_CLOCK_SKEW_SEC config so re-mint fires at expiry; scope visual suite to visual.spec.ts

2026-06-18 11:32:23 +02:00

config.ts

E2E for token timeout + refresh (todo §4); full-stack auth-refresh.spec.ts (real Ory stack): a lapsed session JWT is silently re-minted from the live Kratos session (roles re-read from Keto), and cleared once the session is revoked; ory/kratos/e2e.yml shortens the tokenizer ttl to 8s + adds JWT_CLOCK_SKEW_SEC config so re-mint fires at expiry; scope visual suite to visual.spec.ts

2026-06-18 11:32:23 +02:00

context.test.ts

Consolidate related unit tests (todo §0): 59 → 42 cases, assertions preserved

2026-06-15 10:47:47 +02:00

context.ts

Tighten code comments + README (todo §0): denser, drop redundant prose; no behavior change

2026-06-15 10:30:06 +02:00

cookie.test.ts

Consolidate related unit tests (todo §0): 59 → 42 cases, assertions preserved

2026-06-15 10:47:47 +02:00

cookie.ts

Tighten code comments + README (todo §0): denser, drop redundant prose; no behavior change

2026-06-15 10:30:06 +02:00

csrf.test.ts

Secure cookie flags + CSRF for our own POST forms (todo §4); SECURE_COOKIES toggle on session/CSRF cookies; csrf.ts signed double-submit token + body.ts form reader; logout is now a CSRF-guarded POST form

2026-06-18 11:12:32 +02:00

csrf.ts

Secure cookie flags + CSRF for our own POST forms (todo §4); SECURE_COOKIES toggle on session/CSRF cookies; csrf.ts signed double-submit token + body.ts form reader; logout is now a CSRF-guarded POST form

2026-06-18 11:12:32 +02:00

dashboard.test.ts

Secure cookie flags + CSRF for our own POST forms (todo §4); SECURE_COOKIES toggle on session/CSRF cookies; csrf.ts signed double-submit token + body.ts form reader; logout is now a CSRF-guarded POST form

2026-06-18 11:12:32 +02:00

dashboard.ts

Secure cookie flags + CSRF for our own POST forms (todo §4); SECURE_COOKIES toggle on session/CSRF cookies; csrf.ts signed double-submit token + body.ts form reader; logout is now a CSRF-guarded POST form

2026-06-18 11:12:32 +02:00

data-table.test.ts

Make markup semantic + add semantic DOM principle (todo §1); page <h1>, skip link, row-header <th scope=row>, descriptive error pages

2026-06-15 16:53:07 +02:00

discovery.test.ts

Discover plugins at boot (todo §2); scan plugins/, import + validate each plugin.ts default export, fail loud on bad plugin/conflict

2026-06-16 12:11:04 +02:00

discovery.ts

Tighten code comments + README (todo §2); trim verbose §2 headers, drop stale planned/next-item markers, correct README status

2026-06-16 16:31:57 +02:00

field.test.ts

Add field + auth-card partials (todo §1); data-driven .field (label/icon/hint/server error) and auth-card shell (head/SSO/body/alt)

2026-06-15 13:16:36 +02:00

filter-bar.test.ts

Add data-driven filter-bar partial (todo §1); GET form: search/segmented/select/chips/daterange + applied pills

2026-06-15 12:04:25 +02:00

flow-view.test.ts

Render SSO buttons per configured Kratos OIDC provider (todo §4); flow-view collects oidc nodes → auth-card submit buttons, server-side visibility, drop mockup #sso-toggle CSS

2026-06-17 18:20:45 +02:00

flow-view.ts

Render SSO buttons per configured Kratos OIDC provider (todo §4); flow-view collects oidc nodes → auth-card submit buttons, server-side visibility, drop mockup #sso-toggle CSS

2026-06-17 18:20:45 +02:00

gen-jwks.test.ts

Generate + mount the JWT signing JWKS (todo §3); ES256 gen-jwks tool, committed dev key, key-rotation docs

2026-06-17 13:24:31 +02:00

gen-jwks.ts

Tighten §3 comments (todo §3); drop stale 'next §3 item' forward-refs, condense compose/Ory/bootstrap headers

2026-06-17 17:00:47 +02:00

guards.test.ts

Auth guards (todo §4); guards.ts: requireSession/can/check + GuardError, app.ts maps GuardError → 303 /login or 403 (never 500)

2026-06-18 10:10:15 +02:00

guards.ts

Auth guards (todo §4); guards.ts: requireSession/can/check + GuardError, app.ts maps GuardError → 303 /login or 403 (never 500)

2026-06-18 10:10:15 +02:00

hooks.test.ts

Address whole-project review (todo §2); wire plugin hooks (onBoot/onRequest/onResponse), document template trust boundary, tidy discovery

2026-06-16 16:23:08 +02:00

hooks.ts

Address whole-project review (todo §2); wire plugin hooks (onBoot/onRequest/onResponse), document template trust boundary, tidy discovery

2026-06-16 16:23:08 +02:00

hydra.test.ts

Unify §3 test overlaps (todo §3); fold the 5× image-pin checks into one compose.test.ts scan + same-version sidecar test, drop the duplicate committed-JWKS re-validation in config.test.ts

2026-06-17 17:07:39 +02:00

icons.test.ts

Add lucide icon sprite partial (todo §1); src/icons.ts generates only-used symbols from pinned lucide-static

2026-06-15 11:44:40 +02:00

icons.ts

Add lucide icon sprite partial (todo §1); src/icons.ts generates only-used symbols from pinned lucide-static

2026-06-15 11:44:40 +02:00

jwks.test.ts

JWKS fetch + cache + rotation (todo §4); cachingJwks: TTL cache + rotation-on-miss reload (throttled, last-good on error), createJwksProvider routes file/base64/http + primes at boot

2026-06-18 10:01:40 +02:00

jwks.ts

JWKS fetch + cache + rotation (todo §4); cachingJwks: TTL cache + rotation-on-miss reload (throttled, last-good on error), createJwksProvider routes file/base64/http + primes at boot

2026-06-18 10:01:40 +02:00

jwt-middleware.test.ts

Session re-mint on TTL expiry (todo §4); resolveSession flags a lapsed token, app.ts hot path re-mints via remintSession (roles re-read from Keto → fresh cookie) only when a live Kratos session backs it; a dead session clears the stale cookie

2026-06-18 10:25:05 +02:00

jwt-middleware.ts

Session re-mint on TTL expiry (todo §4); resolveSession flags a lapsed token, app.ts hot path re-mints via remintSession (roles re-read from Keto → fresh cookie) only when a live Kratos session backs it; a dead session clears the stale cookie

2026-06-18 10:25:05 +02:00

jwt.test.ts

Consolidate related unit tests (todo §0): 59 → 42 cases, assertions preserved

2026-06-15 10:47:47 +02:00

jwt.ts

Tighten code comments + README (todo §0): denser, drop redundant prose; no behavior change

2026-06-15 10:30:06 +02:00

keto-client.test.ts

Add Keto fetch client (todo §4); createKetoClient(): check / list / expand relations + write / delete tuples

2026-06-17 17:33:59 +02:00

keto-client.ts

Add Keto fetch client (todo §4); createKetoClient(): check / list / expand relations + write / delete tuples

2026-06-17 17:33:59 +02:00

keto.test.ts

Unify §3 test overlaps (todo §3); fold the 5× image-pin checks into one compose.test.ts scan + same-version sidecar test, drop the duplicate committed-JWKS re-validation in config.test.ts

2026-06-17 17:07:39 +02:00

kratos-admin.test.ts

Login completion (todo §4); /auth/complete: roles from Keto → metadata_public projection → tokenize → plainpages_jwt cookie; fix tokenizer projection metadata_admin→metadata_public (whoami strips admin metadata)

2026-06-17 23:15:28 +02:00

kratos-admin.ts

Login completion (todo §4); /auth/complete: roles from Keto → metadata_public projection → tokenize → plainpages_jwt cookie; fix tokenizer projection metadata_admin→metadata_public (whoami strips admin metadata)

2026-06-17 23:15:28 +02:00

kratos-public.test.ts

Logout (todo §4); GET /logout clears plainpages_jwt + revokes the Kratos session (createLogoutFlow → redirect to Kratos logout URL → /login); wire shell Sign out link

2026-06-18 10:35:07 +02:00

kratos-public.ts

Logout (todo §4); GET /logout clears plainpages_jwt + revokes the Kratos session (createLogoutFlow → redirect to Kratos logout URL → /login); wire shell Sign out link

2026-06-18 10:35:07 +02:00

kratos.test.ts

Login completion (todo §4); /auth/complete: roles from Keto → metadata_public projection → tokenize → plainpages_jwt cookie; fix tokenizer projection metadata_admin→metadata_public (whoami strips admin metadata)

2026-06-17 23:15:28 +02:00

list-query.test.ts

Add parseListQuery helper (todo §1); read a list URL into { q, filters, sort, page, pageSize }, defaults+clamp, zero-throw

2026-06-15 13:38:34 +02:00

list-query.ts

Add parseListQuery helper (todo §1); read a list URL into { q, filters, sort, page, pageSize }, defaults+clamp, zero-throw

2026-06-15 13:38:34 +02:00

login.test.ts

Logout (todo §4); GET /logout clears plainpages_jwt + revokes the Kratos session (createLogoutFlow → redirect to Kratos logout URL → /login); wire shell Sign out link

2026-06-18 10:35:07 +02:00

login.ts

Session re-mint on TTL expiry (todo §4); resolveSession flags a lapsed token, app.ts hot path re-mints via remintSession (roles re-read from Keto → fresh cookie) only when a live Kratos session backs it; a dead session clears the stale cookie

2026-06-18 10:25:05 +02:00

menu-config.test.ts

Add config/menu.ts central override + branding (todo §2); loadMenuConfig validates+merges, override applied to nav, branding into shell

2026-06-16 15:52:03 +02:00

menu-config.ts

Tighten code comments + README (todo §2); trim verbose §2 headers, drop stale planned/next-item markers, correct README status

2026-06-16 16:31:57 +02:00

menu.test.ts

Add menu/popover + theme-switch partials (todo §1); data-driven .menu (items/check-groups/positioning), Light/Auto/Dark switch, shell reuses both

2026-06-15 13:27:44 +02:00

nav-tree.test.ts

Add recursive nav-tree partial (todo §1); header/leaf × clickable/static, counts + aria-current

2026-06-15 11:59:26 +02:00

nav.test.ts

Add composeNav helper (todo §1); merge plugin nav fragments + central override (rename/group/order/hide), role-filter to a nav-tree model

2026-06-15 13:33:54 +02:00

nav.ts

Add composeNav helper (todo §1); merge plugin nav fragments + central override (rename/group/order/hide), role-filter to a nav-tree model

2026-06-15 13:33:54 +02:00

paginate.test.ts

Add paginate helper (todo §1); page model with row window + ellipsis sequence for pagination.ejs, clamped/guarded inputs

2026-06-15 13:50:15 +02:00

paginate.ts

Add paginate helper (todo §1); page model with row window + ellipsis sequence for pagination.ejs, clamped/guarded inputs

2026-06-15 13:50:15 +02:00

pagination.test.ts

Add data-driven pagination partial (todo §1); rows-per-page GET form + page-number links, zero-JS, query-param driven

2026-06-15 13:10:24 +02:00

plugin.test.ts

Loosen plugin id rule (todo §2); allow digits and dashes anywhere (^[a-z0-9-]+$)

2026-06-16 11:53:14 +02:00

plugin.ts

Tighten code comments + README (todo §2); trim verbose §2 headers, drop stale planned/next-item markers, correct README status

2026-06-16 16:31:57 +02:00

postgres.test.ts

Unify §3 test overlaps (todo §3); fold the 5× image-pin checks into one compose.test.ts scan + same-version sidecar test, drop the duplicate committed-JWKS re-validation in config.test.ts

2026-06-17 17:07:39 +02:00

router.test.ts

Mount plugin routes via the router (todo §2); match method+path under /<id>, resolve :params, permission gate, RouteResult→response

2026-06-16 12:22:15 +02:00

router.ts

Tighten code comments + README (todo §2); trim verbose §2 headers, drop stale planned/next-item markers, correct README status

2026-06-16 16:31:57 +02:00

server.ts

E2E for token timeout + refresh (todo §4); full-stack auth-refresh.spec.ts (real Ory stack): a lapsed session JWT is silently re-minted from the live Kratos session (roles re-read from Keto), and cleared once the session is revoked; ory/kratos/e2e.yml shortens the tokenizer ttl to 8s + adds JWT_CLOCK_SKEW_SEC config so re-mint fires at expiry; scope visual suite to visual.spec.ts

2026-06-18 11:32:23 +02:00

shell.test.ts

Secure cookie flags + CSRF for our own POST forms (todo §4); SECURE_COOKIES toggle on session/CSRF cookies; csrf.ts signed double-submit token + body.ts form reader; logout is now a CSRF-guarded POST form

2026-06-18 11:12:32 +02:00

static.ts

Serve per-plugin static assets (todo §2); /public/<id>/ → plugins/<id>/public/ via routePublic, core public/ unaffected

2026-06-16 15:18:20 +02:00

theme-switch.test.ts

Add menu/popover + theme-switch partials (todo §1); data-driven .menu (items/check-groups/positioning), Light/Auto/Dark switch, shell reuses both

2026-06-15 13:27:44 +02:00

view-resolver.test.ts

Consolidate tests (todo §2); merge HTTP static tests, fold 403 render into the live gated route, unify resolveViewPath cases

2026-06-16 16:42:46 +02:00

view-resolver.ts

Add per-plugin view resolver (todo §2); render plugins/<id>/views/<view>.ejs with nested names + traversal guard, core partials reachable via include()

2026-06-16 13:41:02 +02:00