76 lines
9.6 KiB
Markdown
76 lines
9.6 KiB
Markdown
# Authenticated website verification — October 4, 2026
|
|
|
|
The focused local phase passed 15 browser/backend checks and 42 relevant automated tests. The website compiled successfully, including TypeScript, in one build. These results establish isolated website behavior; they do not establish authenticated production behavior.
|
|
|
|
| Workflow | Result | Evidence and limits |
|
|
| --- | --- | --- |
|
|
| Telemetry sessions | PASS, isolated Firebase E2E | 25 owned sessions; initial 10, then 20 and 25; newest-first ordering; replay, GPX/CSV downloads, and deletion verified through the browser and backend. The fixtures use the website's supported inline telemetry format; R2 bundle retrieval was not tested. |
|
|
| Device sessions | PASS for website UI/proxy; actual backend unverified | 25 sessions from the existing token-verifying local fixture API; initial 10, then 20 and 25; newest-first ordering, current-session protection, retained revoke buttons, and successful revoke verified. This is not PostgreSQL session-service E2E. |
|
|
| Community discovery | PASS, isolated Firebase E2E | Populated and empty results; absent/null `clubId` personal rides included; private and club rides excluded; both directions of blocking excluded. |
|
|
| Two-step wizard | PASS, isolated Firebase E2E | Browser configuration and review, publication, matching Firestore record and accepted organizer participant, and persistence after reload. |
|
|
| Live radar | PASS, isolated Firebase E2E | Two authorized SDK publishers; inspector coordinates and projected marker positions changed; actual elapsed-time stale/disconnected transitions occurred without writes; empty/error/denied states, revoked access, real Firestore `removeTarget`, and browser Leave Pack persistence verified. |
|
|
| Billing fallback | PASS | The actual local `/api/billing/portal` request returned 404 and the account page displayed the fallback notice. |
|
|
| Actual billing portal | BLOCKED | No portal route or legitimate isolated billing configuration exists in the inspected website/backend. No portal response was mocked or represented as portal verification. |
|
|
| Authenticated production | NOT RUN | This phase was local. No deployment, production fixtures, commits, pushes, or mobile changes were made. |
|
|
|
|
## Isolation and configuration
|
|
|
|
The running emulator hub independently reported Auth `127.0.0.1:9199` and Firestore `127.0.0.1:8188`. The dedicated configuration is `firebase.website-qa.json`, which loads the current root `firestore.rules` and indexes. The rules SHA-256 was `4b67b2d16235b8259a57852a386f7c8bf98dddf0c6e0588e51209e819f327cf0` and remained unchanged.
|
|
|
|
Browser Firebase, website Firebase Admin, fixture Admin, and authorized publisher clients all used `demo-motorsignal-web-qa`. The browser's actual Firebase app options, Auth emulator configuration, and Firestore host were asserted. Authenticated server discovery returned the same seeded project records. The fixture API verified token audience/issuer before issuing isolated opaque sessions. Server HTTP forwarding targeted `http://127.0.0.1:8189`. The browser harness aborted external destinations. No production environment file was overwritten.
|
|
|
|
The handoff's `NEXT_PUBLIC_USE_FIREBASE_EMULATOR` flag is not the flag used by current source. The actual flag is `NEXT_PUBLIC_FIREBASE_EMULATORS`, together with explicit project and emulator ports. Emulator host variables alone were not used as proof of project isolation.
|
|
|
|
## Reproduced fixes and changed files
|
|
|
|
- `website/app/api/group-rides/route.ts`: accept absent/null club association, consistent with the current schema and rules.
|
|
- `website/app/api/account/sessions/route.ts` and `website/app/api/account/sessions/[sessionId]/route.ts`: forward successful 204 revocations with a null body; previously they threw and returned 500.
|
|
- `website/components/group-rides/live-pack-radar.tsx`: clear cached presence and stop listeners on access revocation/errors; reject late callbacks; distinguish stream failures from an empty pack.
|
|
- `website/components/group-rides/group-rides-management.tsx`: keep inaccessible requested ride IDs in real radar mode so reload after Leave Pack shows the clearance barrier rather than a simulated pack; reject a cached summary for a different ride.
|
|
- New focused regression files: `website/tests/community-personal-rides.test.ts`, `website/tests/website-session-proxy.test.ts`, and `website/tests/radar-access-lifecycle.test.tsx`. Failures were observed before the corresponding product fixes.
|
|
- Reused/extended `tools/verify_isolated_e2e.mjs` and `website/test-support/qa-auth-backend.mjs`; added `tools/verify_website_authenticated.mjs`, `tools/website-qa-isolation.mjs`, and `firebase.website-qa.json`.
|
|
|
|
Earlier harness failures caused by incomplete telemetry fixture fields or an incorrect wizard selector were corrected in the harness, not treated as product defects. Earlier failed runs are retained as evidence.
|
|
|
|
## Commands and results
|
|
|
|
All commands ran from `C:\Users\Bill\Desktop\flutter-app`. The focused harness used these process-only settings:
|
|
|
|
```powershell
|
|
$env:NEXT_PUBLIC_FIREBASE_EMULATORS='true'
|
|
$env:NEXT_PUBLIC_FIREBASE_QA_PROJECT_ID='demo-motorsignal-web-qa'
|
|
$env:NEXT_PUBLIC_FIREBASE_AUTH_EMULATOR_PORT='9199'
|
|
$env:NEXT_PUBLIC_FIREBASE_FIRESTORE_EMULATOR_PORT='8188'
|
|
$env:FIREBASE_PROJECT_ID='demo-motorsignal-web-qa'
|
|
$env:GCLOUD_PROJECT='demo-motorsignal-web-qa'
|
|
$env:FIRESTORE_EMULATOR_HOST='127.0.0.1:8188'
|
|
$env:FIREBASE_AUTH_EMULATOR_HOST='127.0.0.1:9199'
|
|
$env:MOTORSIGNAL_API_BASE_URL='http://127.0.0.1:8189'
|
|
$env:QA_FOCUSED_WEBSITE='true'
|
|
```
|
|
|
|
| Command | Result |
|
|
| --- | --- |
|
|
| `firebase emulators:start --config firebase.website-qa.json --only auth,firestore --project demo-motorsignal-web-qa` | Ready; hub verified the configured loopback ports. |
|
|
| `npm --prefix website run dev -- --hostname 127.0.0.1 -p 3100` | Local website ready with the process settings above. |
|
|
| `node website/test-support/qa-auth-backend.mjs` with `QA_DEVICE_SESSION_COUNT=25` | Local token-verifying fixture listening on 8189. |
|
|
| `node tools/verify_isolated_e2e.mjs` with `QA_WEBSITE_MODE=seed` | 5 owned users, 25 telemetry sessions, and 7 scoped group-ride fixtures seeded. |
|
|
| Same entry point with `QA_WEBSITE_MODE=run`, `QA_RUN_LABEL=completed` | Exit 0; 15/15 checks passed. |
|
|
| `node website/node_modules/vitest/vitest.mjs run --root website tests/community-personal-rides.test.ts tests/website-session-proxy.test.ts tests/radar-access-lifecycle.test.tsx tests/group-rides-page.test.tsx tests/telemetry-replay-export.test.tsx tests/firebase-client-emulator.test.ts --maxWorkers=1 --testTimeout=15000 --reporter=default --reporter=json --outputFile=../output/playwright/authenticated-20261004/focused-tests-completed.json` | Exit 0; 6 files, 42 tests passed. |
|
|
| Focused harness with `QA_WEBSITE_MODE=build` | Exit 0; runs the installed Next `build` once in `website`; TypeScript passed. The local artifact is built with demo Firebase configuration. |
|
|
| Focused harness with `QA_WEBSITE_MODE=cleanup` | Owned user and ride trees removed; cleanup assertions passed. |
|
|
| Focused harness with `QA_WEBSITE_MODE=audit` | Preservation and production-target guard evidence in the files below. |
|
|
| Focused harness with `QA_WEBSITE_MODE=service-audit` | All six owned website, fixture, and emulator endpoint ports refused connections after shutdown. |
|
|
|
|
For the recorded harness/test commands, Node was invoked directly using `C:\Users\Bill\AppData\Roaming\devbox-pro\resources\nodejs\24\win\node.exe`; the available `node.cmd`/npm shim did not reliably propagate failing exit codes. `rtk` was unavailable, so native commands were used.
|
|
|
|
The build reported three whole-project filesystem-tracing warnings at lines 37, 42, and 71 of the pre-existing, unchanged `website/app/api/account/rides/[rideId]/telemetry/route.ts`. They were not fixed within this phase. Tests also printed the existing Vite configuration warning, jsdom canvas limitation, and legacy test emulator connection warning; no test failed. Deliberate denied-access tests emitted expected Firestore permission errors. Broad Flutter/production guest suites were not restarted.
|
|
|
|
## Evidence, cleanup, and Git
|
|
|
|
Evidence directory: `output/playwright/authenticated-20261004/`. Primary files are `results-completed.json`, `focused-tests-completed.json`, `created-ride.json`, `emulator-topology.json`, `website-build.log`, `website-build-result.json`, `guard-results.json`, `cleanup.json`, `service-cleanup.json`, `git-before.json`, and `git-final.json`. GPX/CSV downloads and failure-only screenshots are retained there. Generic unavailable/missing stream states also have focused component coverage; deletion under current rules produces a real permission-denied barrier in the browser.
|
|
|
|
The final cleanup removed five owned Auth users, eight group-ride trees including the browser-created ride, their presence/participant records, and the owned user trees containing telemetry and blocks. The QA browser and local services were stopped. The local fixture backend's in-memory device sessions disappear when it stops. No pre-existing emulator project was cleared wholesale.
|
|
|
|
Main branch/HEAD remain `release/v1.0.2-build102-community-feed` / `bd278cdfd3619242a3056c6a2738abb0aff70feb`. The main worktree retains its pre-existing changes plus the scoped files/evidence above, with nothing staged. Next dev temporarily generated development type paths in `website/next-env.d.ts`; the single build returned it to the original clean HEAD content, independently asserted by the audit. All other unrelated baseline hashes remain unchanged. The deployment worktree remains clean on `deploy/website-20261004` / `69662eae46b92b2d824558b40a82fd487d15ba1b`. Complete final status, including untracked files, and preservation hashes are recorded in `git-final.json`.
|