2.8 KiB
2.8 KiB
QA procedure: Integration catalogue and role-aware copy (roles sync pass 6)
Spec: features/roles_sync_integration_catalogue.feature. Vitest + Vue Test Utils under task test:web. Static data, no /v1 call, no live server.
Honesty rules
- Baseline
task test:webfirst. 1. Runner cannot execute: NOT RUN. 2. Report new and edited specs and baseline failures. - The two section intros are the user-approved proposals, not design copy; mark them as such in the report.
Automated (Vitest)
| Spec | Cases |
|---|---|
| data/tests/apiCatalogue.spec.ts (extend) | the nine routes have chip "Needs permission" and a description ending Needs the permission "<label>"; no route keeps "Owner or admin"; Owner only routes keep their chip; the 403 caption is missing_permission for the nine; the Errors table 403 row and its note; the Authentication card sentence; the two intros; the permission label equals lib/permissionNames.ts for the key the router requires |
| views/tests/IntegrationView.spec.ts or the existing integration spec (extend) | the chip renders, mobile shows it in the chips line, search "permission" and "missing_permission" returns the routes, "owner or admin" does not |
| data/tests/apiGating.spec.ts (new) | a fixed table of the nine routes (plus DELETE /v1/user/{id}) and the keys of api/router.go; fails if a label changes |
Visual (task visual:check)
Run task visual:check -- integration. States of the "Integration" group: 2 (Media group, POST /v1/media/), 4 Authentication, 6 Errors, 9a to 9j Custom content types, and the search states 8c-8e. Board sample data: the origin https://cms.renew.example, the board's media list and purge samples. Light, dark, desktop, mobile within 10 %. Not clock-sensitive. The board is from before the new DELETE /v1/user/{id} card and the Users group count of 7, which may exceed 10 % on that group (see G5).
Manual checks
- Real server: call each gated route with a key whose creator's role lacks the permission and read the 403 body
missing_permission. - Search palette keyboard flow with the new chip.
task lint:webgreen;task test:webexit 0.
Design gaps and notes
- G1 screens/integration.md "Custom content types round" still says "Owner or admin" and "Only owners and admins can do this."; pass 6 supersedes it. The user should refresh that file.
- G2 Open item 5 of the change log (do owner-only routes answer
missing_permission?) is not verified here; "Owner only" chips are unchanged. - G3 Both intros are proposals approved by the user, not from the design.
- G4 Left alone, out of scope: screens/schema.md and the Schema frames ("Owner or admin" for Schema), states.md "Sites and authors: roles" and the 403 owner_only rows, screens/profile.md Display name copy.
- G5 The DELETE /v1/user/{id} card is not on the Integration board.