RenewCMS

account_verification.feature

refac: reamaining auth surface rewrite, T0

2026-09-24 05:11:49 +02:00

account_verification.qa.md

refac: reamaining auth surface rewrite, T0

2026-09-24 05:11:49 +02:00

api_client_global_error_handling.feature

feat: typed API client (useApi) and session store (useSession) with the global 401, unverified-403, 429 and offline handling from states.md

2026-09-25 17:33:40 +02:00

api_client_global_error_handling.qa.md

feat: typed API client (useApi) and session store (useSession) with the global 401, unverified-403, 429 and offline handling from states.md

2026-09-25 17:33:40 +02:00

article_publishing.feature

refac: authenticated user can publish and unpublish an article; an unknown id returns 404

2026-09-23 22:54:44 +02:00

article_publishing.qa.md

refac: authenticated user can publish and unpublish an article; an unknown id returns 404

2026-09-23 22:54:44 +02:00

article_title_rules.feature

refac: article title rules are the same in the API request and the domain; an invalid title returns 400 instead of 500

2026-09-23 20:04:09 +02:00

article_title_rules.qa.md

refac: article title rules are the same in the API request and the domain; an invalid title returns 400 instead of 500

2026-09-23 20:04:09 +02:00

auth_shell_login_conformance.feature

fix: login match design reference

2026-09-25 21:28:12 +02:00

auth_shell_login_conformance.qa.md

fix: login match design reference

2026-09-25 21:28:12 +02:00

cancel_pending_registration.feature

refac: reamaining auth surface rewrite, T0

2026-09-24 05:11:49 +02:00

cancel_pending_registration.qa.md

refac: reamaining auth surface rewrite, T0

2026-09-24 05:11:49 +02:00

delete_article_cascades_images.feature

refac: deleting an article also deletes its images, and deleting a missing article returns 404

2026-09-23 23:42:18 +02:00

delete_article_cascades_images.qa.md

refac: deleting an article also deletes its images, and deleting a missing article returns 404

2026-09-23 23:42:18 +02:00

edit_article_body.feature

refac: authenticated user can edit an article's body; an unknown id returns 404

2026-09-23 23:24:03 +02:00

edit_article_body.qa.md

refac: authenticated user can edit an article's body; an unknown id returns 404

2026-09-23 23:24:03 +02:00

get_current_user.feature

refac: GET /v1/auth/me

2026-09-25 15:17:39 +02:00

get_current_user.qa.md

refac: GET /v1/auth/me

2026-09-25 15:17:39 +02:00

hasher_domain_interface.feature

fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

2026-09-25 05:58:37 +02:00

hasher_domain_interface.qa.md

fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

2026-09-25 05:58:37 +02:00

image_upload_rules.feature

refac: allowed image types and the size limit are a domain rule checked by the use case, not by the persistence layer

2026-09-24 00:03:29 +02:00

login_and_password_reset_rate_limiting.feature

fix: login and password reset requests are rate-limited per client (not in the README; there is currently no brute-force protection on the public auth routes)

2026-09-25 05:33:02 +02:00

login_and_password_reset_rate_limiting.qa.md

fix: login and password reset requests are rate-limited per client (not in the README; there is currently no brute-force protection on the public auth routes)

2026-09-25 05:33:02 +02:00

login_screen.feature

feat: login page T0

2026-09-25 20:15:29 +02:00

login_screen.qa.md

feat: login page T0

2026-09-25 20:15:29 +02:00

not_found_errors.feature

fix: reading a single article follows the same rule as the list: anyone can read an online article, a verified user can also read an offline one, and an unknown or hidden id returns 404

2026-09-24 16:32:40 +02:00

not_found_errors.qa.md

refac: missing user or article is reported with a domain not-found error instead of a raw GORM error, and the API answers 404 for it

2026-09-23 18:55:05 +02:00

nuxt_ui_shell_foundation.feature

feat: PrimeVue replaced by Nuxt UI using token files from web/src/theme, with AuthShell, DashboardShell, AppBoot and the route guards from routes.md

2026-09-25 17:09:34 +02:00

nuxt_ui_shell_foundation.qa.md

feat: PrimeVue replaced by Nuxt UI using token files from web/src/theme, with AuthShell, DashboardShell, AppBoot and the route guards from routes.md

2026-09-25 17:09:34 +02:00

public_article_listing.feature

fix: reading a single article follows the same rule as the list: anyone can read an online article, a verified user can also read an offline one, and an unknown or hidden id returns 404

2026-09-24 16:32:40 +02:00

public_article_listing.qa.md

refac: authenticated user can list all articles, including offline ones, while the public list only shows online ones

2026-09-23 22:36:41 +02:00

public_article_read.feature

fix: reading a single article follows the same rule as the list: anyone can read an online article, a verified user can also read an offline one, and an unknown or hidden id returns 404

2026-09-24 16:32:40 +02:00

public_article_read.qa.md

fix: reading a single article follows the same rule as the list: anyone can read an online article, a verified user can also read an offline one, and an unknown or hidden id returns 404

2026-09-24 16:32:40 +02:00

registration_gate_and_verification_email.feature

refac: register only open while no verified acc exists, enforced by a use case rather than handler & sends verification email whose link uses the conf pub URL whose code expires after 2h

2026-09-24 03:36:37 +02:00

registration_gate_and_verification_email.qa.md

refac: register only open while no verified acc exists, enforced by a use case rather than handler & sends verification email whose link uses the conf pub URL whose code expires after 2h

2026-09-24 03:36:37 +02:00

registration_status_endpoint.feature

refac: GET /v1/auth/registration

2026-09-25 15:54:42 +02:00

registration_status_endpoint.qa.md

refac: GET /v1/auth/registration

2026-09-25 15:54:42 +02:00

request_password_reset.feature

fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

2026-09-25 05:58:37 +02:00

request_password_reset.qa.md

fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

2026-09-25 05:58:37 +02:00

reset_password.feature

refac: reamaining auth surface rewrite, T0

2026-09-24 05:11:49 +02:00

reset_password.qa.md

refac: reamaining auth surface rewrite, T0

2026-09-24 05:11:49 +02:00

runtime_settings_injection.feature

refac: runtime settings are read once at startup and passed in through the composition root; no handler, router or repository reads environment variables

2026-09-24 01:30:00 +02:00

runtime_settings_injection.qa.md

refac: runtime settings are read once at startup and passed in through the composition root; no handler, router or repository reads environment variables

2026-09-24 01:30:00 +02:00

serve_uploaded_images.feature

refac: GET /static/uploadedImages/{filename}

2026-09-25 15:40:21 +02:00

serve_uploaded_images.qa.md

refac: GET /static/uploadedImages/{filename}

2026-09-25 15:40:21 +02:00

stale_token_invalidation.feature

fix: resetting the password or cancelling a registration ends existing sessions: a token issued before the change is refused

2026-09-25 05:03:34 +02:00

stale_token_invalidation.qa.md

fix: resetting the password or cancelling a registration ends existing sessions: a token issued before the change is refused

2026-09-25 05:03:34 +02:00

trusted_proxy_client_ip_for_rate_limiting.feature

fix: rate limiting X-Real-IP from the real peer

2026-09-25 06:49:55 +02:00

trusted_proxy_client_ip_for_rate_limiting.qa.md

fix: rate limiting X-Real-IP from the real peer

2026-09-25 06:49:55 +02:00

unverified_users_and_reregistration.feature

refac: several unverified users can exist at once: an empty reset or verification code is stored as no value so it doesn't break the unique constraint, and deleting a user removes the row so the same username and email can register again

2026-09-24 01:59:24 +02:00

unverified_users_and_reregistration.qa.md

refac: several unverified users can exist at once: an empty reset or verification code is stored as no value so it doesn't break the unique constraint, and deleting a user removes the row so the same username and email can register again

2026-09-24 01:59:24 +02:00

upload_article_image.feature

refac: authenticated user can upload an image to an existing article and receives its public location; an unknown article returns 404 and a disallowed type returns 400

2026-09-24 00:33:26 +02:00

upload_article_image.qa.md

refac: authenticated user can upload an image to an existing article and receives its public location; an unknown article returns 404 and a disallowed type returns 400

2026-09-24 00:33:26 +02:00

use_case_baseline.feature

fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

2026-09-25 05:58:37 +02:00

user_response_field_hygiene.feature

fix: API responses never include a user's password, verification code or reset code hashes, or their expiry dates; verifying an account returns only the public user fields

2026-09-24 15:39:50 +02:00

user_response_field_hygiene.qa.md

fix: API responses never include a user's password, verification code or reset code hashes, or their expiry dates; verifying an account returns only the public user fields

2026-09-24 15:39:50 +02:00

verified_account_required.feature

fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

2026-09-25 05:58:37 +02:00

verified_account_required.qa.md

fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

2026-09-25 05:58:37 +02:00

web_test_runner.feature

chore: Vitest + Vue Test Utils test runner exposed as task test:web

2026-09-25 16:12:50 +02:00

write_not_found_errors.feature

refac: repository updates, image attachment and deletes report the domain not-found error for an unknown id, the same for articles, users and images, and the test fakes stop returning GORM errors

2026-09-23 22:09:06 +02:00

write_not_found_errors.qa.md

refac: repository updates, image attachment and deletes report the domain not-found error for an unknown id, the same for articles, users and images, and the test fakes stop returning GORM errors

2026-09-23 22:09:06 +02:00