RenewCMS/features/integration_api_key_routes.qa.md

QA procedure: Integration page, every API-key route documented

Superseded in part by roles_permissions_enforcement: the owner and admin 403 clauses now answer 403 "missing_permission" with the header X-Missing-Permission, decided by the caller's role permissions. An Admin can now invite and write sites, and a role without the needed permission is refused on routes that were open to every verified user.

No Go test: SPA only, no /v1 call, no API change. Samples and counts follow the real API; where the board differs (purge response, built-in type samples) the API wins.

Automated SPA (Vitest + Vue Test Utils, task test:web)

Files: extend web/src/views/__tests__/IntegrationView.spec.ts, web/src/views/__tests__/IntegrationSearch.spec.ts and the pure matcher spec if present. Same setup as the existing specs (router at /integration, stubbed scroll helpers, fake timers for the flash). No test freezes the system date. Also correct the superseded figures in the existing specs.

Cases (it.each for outlines):

1. Index order, 14 items, desktop index and mobile select.
2. Group table: titles, counts (Articles 8, Media 11, Sites and authors 2, "1 route" singular for Settings), method, path and access chip per route, "API key OK" chip.
3. ct-fields anchor above the first Content types route, not an index item; Field types table rows; sample field object.
4. PUT badge colours equal the PATCH colours.
5. Expanded card outline: request or query fields and error rows for the eight routes of the outline, with code-style captions.
6. Response samples: entries list shape, entry sample keys, media keyed by field key, built-in type has no icon, purge response has exactly the seven keys, purge-settings keys, POST cards without a status line.
7. GET /v1/media/: Query parameters (page, size), object response, 400 "The media query is invalid.". Real API: no X-Total-Count header and no "Invalid page or size." on media.
8. GET /v1/author/ page and size; GET /v1/site/.
9. Session only: derived "37 routes", six sub-groups in order, every /v1/system route in System (PATCH /v1/settings joins it), DELETE /v1/auth/register under Sign in and account, row styling, unchanged banner.
10. Errors table: eight rows (400, 401, 403, 404, 409, 422, 429, 500), both 403 texts plus the note, new 404 codes, 409 and 422 content, literal-body note, old "no 409 or 422 row" sentence absent.
11. Authentication copy.
12. Search: index size 85 (42 documented, 37 session-only, 6 public auth); each query of the outline with its announced count and second line; "entry" matches "entries"; cap line singular and plural.
13. Select PUT /v1/content-type/{key}: card expanded and focused, flash class then removed after 1500 ms, hash #ep-ct-update, index reads "Content types".
14. Scroll-spy marks Content types (state 9j).
15. Regression: the existing cases still pass.

Visual (task visual:check -- integration, desktop and mobile, light and dark)

References: docs/design/screens/integration.md, docs/design/source/IntegrationPage.dc.html, IntegrationSearch.dc.html, states of RenewCMS Screens Back-office.dc.html. Add setups to web/visual/states.ts with no /v1 call unmocked, using the board's sample data (events type, entry sample, fingerprint c41f9a7e).

state	setup
8c, 8d, 8f	updated counts
9a	scroll to ct-fields, open ct-create on curl
9b	open en-list on Response
9c	open en-update on fetch
9d	scroll to errors
9e	scroll to session
9f to 9i	search "entry", "capacity", "schema_incompatible", "content type"
9j	scroll-spy on Content types; mobile Jump to open

No clock-sensitive state exists. A diff exception needs the user's explicit approval.

Manual checks (screenshots cannot cover)

• The search palette and the Session only list on mobile (design tool did not confirm them), and dark mode.
• Keyboard and focus order across the new groups, hover, the 1.5 s flash and its reduced-motion ring.
• Scroll offset under the sticky bar for ct-fields and the last Session only sub-group.
• Long paths such as /v1/content-type/{key}/entry/{id} ellipsise in collapsed rows and in the palette on mobile.