Repository navigation
Restore one-off login proof and product team addresses - #131
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One-off codes created a valid UOA session but omitted its original-proof reference from the HTTP response, so Nessie rejected redemption. Product sign-in also offered cross-product teams whose address lookup still required the organisation's founding domain, leaving landing-page tiles disabled.
Changes
Use one token-pair serializer for ordinary exchange and debug-code redemption, including the original assurance reference and deadline.
Pass the refresh family's original assurance into current organisation admission. Refresh does not invent proof or extend its lifetime.
Resolve tenant addresses with the existing server-owned product team policy. Registered products can address active organisations across founding domains; other clients retain domain isolation. Ambiguous organisation labels fail closed in both directions.
Update Zod, Undici and Happy DOM to patched versions required by the high/critical dependency audit. Use the Zod 4 record API and a compatible form resolver, with explicit input/output types for the three transforming forms. Correct the existing invoice fixture's missing query mocks and required tax attestation.
Keep the public API contract and enterprise integration documentation aligned. No identity copies, membership changes, automatic renames or database migration.
Validation
CI passed: workspace build, 2,687 API unit tests, 929 PostgreSQL integration tests and the high/critical dependency audit. Four pre-existing tests remain skipped (three unit, one integration).
Windows Maxis:
API and Admin typechecks and lint passed. High/critical dependency audit passed.
API unit coverage: 2,687 tests passed across the full run and focused reruns; 3 existing skips. Six initial bootstrap failures were missing Auth build artifacts; after building that prerequisite, all eight tests in those two files passed. The new oversized-collection regression also passed.
Local Admin coverage: 157 tests passed across the full run and focused rerun. The older invoice fixture was updated to exercise its current required fields. Existing invoice preview requests emit connection-refused diagnostics in this isolated fixture; no unhandled test errors remain.
Before the dependency update: 9 existing debug-login integration tests, 3 original-proof HTTP integration tests, 6 hostname RLS tests and 4 product-address integration tests passed against an isolated PostgreSQL database on the Mac host. All 13 tests in the proof, product-address and hostname RLS suites also passed with the updated validator. CI runs the complete database suite.
HTTP coverage exercises issue, redemption, confidential proof validation, refresh, parent revocation, authenticated address round trips, revoked product mapping, ambiguous labels and inactive entities. No native app inputs changed. Admin implementation edits are types only; its local rendered form tests cover validation and submission.
Nessie consumer correction is live from Nessie #1459; the address documentation is aligned by Nessie #1460. Production verification after deployment succeeded: a newly issued code from the installed Nessie app signed the browser into the correct team and survived reload. All six landing tiles are links and their authenticated destinations were verified: KiloMayo, UnlikeOtherAI, FullSend, Digiteq, Rafiki and Rafiki Media. A delayed Digiteq handoff expired as intended; its sign-in recovery then opened the correct team. The adversarial review found a separate write-admission gap, addressed by UOA #132.