mirror of
https://github.com/computerim/impactflow-discovery.git
synced 2026-08-27 06:20:36 +00:00
Joel Salmon
33674f92f4
Close the remaining Phase 1 DoD gaps and reconcile the browser flow with the auth layer. Goals (5 -> 7 prompts): - Add near-term (6-12mo) and long-term (3-5yr) goal prompts; collect raw text on the conversation and store AI-articulated goal summaries on the profile. Extractor articulates the person's own stated goals (mirror, not compass) and never fabricates. Alembic 003 adds the four columns. Cookie-based browser sessions (fixes frontend<->auth desync): - OAuth callback now sets httpOnly session cookies and redirects into the app instead of returning JSON. get_current_user gains a cookie fallback (X-API-Key -> Bearer -> cookie). refresh/logout read the refresh cookie and set/clear cookies. New shared auth.js (authedFetch) sends cookies and silently refreshes on 401. Static pages drop the bogus user_id and call the correct /me endpoints. Profile editing (read/edit/affirm): - PATCH /discovery/profile/me edits the prose (Ikigai summaries, overlap narrative, goals); owner-scoped, partial update, 409 when locked. Edit mode in profile.html with Save/Cancel. Also: bump default model to claude-sonnet-4-6, align ports to 8011 (OAuth redirect, CORS), add COOKIE_SECURE/POST_LOGIN_REDIRECT config, and refresh the README to match the shipped behavior. Tests: 33 passing (added cookie-auth, profile-edit, goal-extraction cases; factored a shared app_client fixture into conftest.py). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
42 lines
1.5 KiB
Python
42 lines
1.5 KiB
Python
from pathlib import Path
|
|
|
|
|
|
def test_discovery_page_uses_cookie_session_not_user_id():
|
|
"""The browser session is a server-set cookie, so the page must not mint
|
|
or carry a client-side user id, and all calls go through authedFetch."""
|
|
html = Path("app/static/discovery.html").read_text(encoding="utf-8")
|
|
|
|
assert "impactflow_user_id" not in html
|
|
assert "createUserId" not in html
|
|
assert "user_id" not in html
|
|
assert "authedFetch" in html
|
|
assert '/static/auth.js' in html
|
|
|
|
|
|
def test_profile_page_uses_me_endpoints_and_authed_fetch():
|
|
"""Profile reads/confirms via the user-scoped /me routes, authenticated by
|
|
the session cookie through authedFetch — not the old user_id-in-URL paths."""
|
|
html = Path("app/static/profile.html").read_text(encoding="utf-8")
|
|
|
|
assert "/discovery/profile/me" in html
|
|
assert "/discovery/profile/me/confirm" in html
|
|
assert "user_id" not in html
|
|
assert "authedFetch" in html
|
|
|
|
|
|
def test_profile_page_has_edit_affordance():
|
|
"""The read/edit/affirm DoD: an Edit control that PATCHes the profile."""
|
|
html = Path("app/static/profile.html").read_text(encoding="utf-8")
|
|
|
|
assert "renderEdit" in html
|
|
assert 'method: "PATCH"' in html
|
|
assert "Edit my words" in html
|
|
|
|
|
|
def test_auth_helper_sends_credentials_and_refreshes():
|
|
js = Path("app/static/auth.js").read_text(encoding="utf-8")
|
|
|
|
assert 'credentials: "include"' in js
|
|
assert "/api/auth/refresh" in js
|
|
assert "/api/auth/login" in js
|