Codex/web session foundation web - #110
Open
switz wants to merge 8 commits into
Open
Conversation
Run Timber on the fixed trusted HTTPS origin and proxy only the segment-safe browser lifecycle and reviewed resource families. The proxy replaces relay metadata, preserves browser transport, and leaves authentication, capability, and mutation authorization to the User Service. Add a small relative-URL session/library client with credentialed no-store requests and fresh CSRF tokens for mutations. The one-command setup keeps certificates and the stable confidential client secret outside Git and configures the API through .NET Secret Manager without printing the secret. Verified with:\n- pnpm test:browser-session (10 passed)\n- pnpm typecheck\n- pnpm lint (exit 0; existing warnings outside changed files)\n- pnpm exec oxlint on changed config, proxy, tests, and setup files\n- pnpm build
Exercise the real development-persona authorization-code flow through already-running Timber and User Service processes. Verify the browser-safe account contract, library reachability, and bounded logout without supervising services, querying PostgreSQL, or exposing credentials in test artifacts. Verified with: - pnpm test:smoke:browser-session - pnpm typecheck - pnpm exec oxlint tests/browserSession.smoke.spec.ts 'src/app/(bare)/browser-session-development/page.tsx' - pnpm exec oxfmt --check tests/browserSession.smoke.spec.ts 'src/app/(bare)/browser-session-development/page.tsx' package.json
Document the one-command mkcert and User Service setup, fixed local origins, manual service startup, proxy security responsibilities, and focused checks. Mark production-backed sign-in and mutations as approval-gated so the development profile cannot be mistaken for deployment authorization. Verified with: - pnpm exec oxfmt --check README.md docs/browser-session-development.md - git diff --check
Replace redirect-stage Playwright failures before callback code and state can enter test output. Preserve only a fixed stage name plus the current origin and path, and keep the original error out of the reporter. Verified with: - pnpm test:smoke:browser-session - pnpm typecheck - pnpm exec oxlint tests/browserSession.smoke.spec.ts - pnpm exec oxfmt --check tests/browserSession.smoke.spec.ts
Make trusted HTTPS setup a required step before Vite starts, because development always loads the fixed certificate and local CA. Document Chromium installation as a one-time prerequisite for the optional Playwright smoke. Verified with: - pnpm exec oxfmt --check README.md docs/browser-session-development.md - git diff --check
Run the pure browser-session client and proxy suites under a small Node-only Vitest configuration. Restrict Playwright discovery to the single browser-visible development-persona smoke test. Verification: - pnpm test:browser-session (10 passed) - pnpm typecheck - pnpm exec playwright test --list (1 smoke) - targeted oxlint and oxfmt - pnpm install --frozen-lockfile
Include localhost in the trusted development certificate and document the exact Google Web OAuth callback, local launch profile, and Chrome entry point. The credential command reads the client secret without echo and sends both values to .NET Secret Manager over standard input. It does not place the secret in Git, shell history, argv, or a child-process environment. Verified with: - node --check scripts/setup-browser-session-development.mjs - pnpm typecheck - pnpm lint - pnpm test:browser-session - pnpm build
|
You have reached your Codex usage limits for security reviews. Please try again later. |
Production-backed Timber proxies to relisten.net and only needs trusted local TLS. Keep .NET, the RelistenApi checkout, the local client secret, and User Service configuration in the full-local setup path. Select the recovery command from the active target so a missing production certificate never directs a developer into local API setup. Verified with: pnpm typecheck; pnpm test:browser-session; pnpm lint; pnpm build; and a production setup run with dotnet absent from PATH and a nonexistent API checkout.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.