From fc9d78a2d6e4caff2c8af3a8e08936b111c7e9bd Mon Sep 17 00:00:00 2001 From: choiminyeong Date: Tue, 25 Aug 2026 23:22:30 +0900 Subject: [PATCH] docs: record repository login E2E verification --- docs/development-log.md | 10 +++++++++ tasks/002b-oauth-android-integration.md | 2 +- tasks/011-login-repository-list.md | 29 +++++++++++++------------ 3 files changed, 26 insertions(+), 15 deletions(-) diff --git a/docs/development-log.md b/docs/development-log.md index eb4a685..0b983bd 100644 --- a/docs/development-log.md +++ b/docs/development-log.md @@ -53,3 +53,13 @@ This is the append-only implementation and handoff record shared by Codex and Cl - Known limitations: No Android device is connected, so the hosted App Link, system-browser return, live account login, repository result, and device Keystore behavior require one manual E2E run on the target phone. - Next recommended task: Install the debug APK on the target Android device and verify login plus the internal repository list; after that, begin branch browsing. - Next owner: Human product owner for device E2E, then Codex. + +## 2026-08-25 — TASK-011 device E2E closure + +- Agent and role: Human product owner, device verifier; Codex, evidence recorder +- Verification performed: Installed application login against the production company Gitea and retrieval of the authenticated account's internal repository list. +- Result: System-browser OAuth, verified App Link return, authenticated API access, and repository-list rendering passed on the target device. +- Review status: Automated gates previously passed and final independent review reported no P0/P1; the remaining manual device gate is now closed. +- Task status: TASK-011 complete. +- Next recommended task: Add repository selection and branch listing. +- Next owner: Codex. diff --git a/tasks/002b-oauth-android-integration.md b/tasks/002b-oauth-android-integration.md index 57cbc2c..0aa9596 100644 --- a/tasks/002b-oauth-android-integration.md +++ b/tasks/002b-oauth-android-integration.md @@ -1,6 +1,6 @@ # TASK-002B: Integrate OAuth with Android and verify App Links -Status: implemented through TASK-011 — device E2E verification pending +Status: completed through TASK-011 — device OAuth/App Link E2E passed Owner: Codex Reviewer: Claude diff --git a/tasks/011-login-repository-list.md b/tasks/011-login-repository-list.md index 17fd122..659bcb2 100644 --- a/tasks/011-login-repository-list.md +++ b/tasks/011-login-repository-list.md @@ -1,6 +1,6 @@ # TASK-011: Sign in and list accessible repositories -Status: code complete and independently reviewed — device E2E pending +Status: complete Owner: Codex Reviewer: Claude @@ -35,18 +35,18 @@ A user can sign in to the configured company Gitea through the system browser an ## Acceptance criteria -- [ ] Login opens an external browsable HTTPS intent and no WebView dependency or component exists. -- [ ] The manifest accepts only the configured verified HTTPS callback host and path. -- [ ] Callback processing uses TASK-002A validation and clears pending verifier/state on every terminal result. -- [ ] Code exchange sends client ID, redirect URI, original verifier, and no client secret. -- [ ] Access/refresh tokens are encrypted with an Android Keystore key, excluded from backup, redacted from string output, and removed on logout. -- [ ] The authenticated `/api/v1/user` call confirms the account before repository loading. -- [ ] `/api/v1/user/repos` follows pagination to completion, deduplicates by stable repository ID, and has a bounded page count. -- [ ] DTOs remain in data packages; UI models contain no token, HTTP, or Android persistence types. -- [ ] UI has localized signed-out, browser-waiting, loading, content, empty, authentication-expired, permission-denied, offline, and server-error states. -- [ ] Repository rows identify owner/name, visibility, optional description, and default branch; logout is explicit. -- [ ] Unit tests cover exchange form, callback terminal clearing, token codec, repository mapping/pagination/deduplication, and error mapping. -- [ ] Build, unit tests, lint, focused tests, secret scan, and independent review pass. +- [x] Login opens an external browsable HTTPS intent and no WebView dependency or component exists. +- [x] The manifest accepts only the configured verified HTTPS callback host and path. +- [x] Callback processing uses TASK-002A validation and clears pending verifier/state on every terminal result. +- [x] Code exchange sends client ID, redirect URI, original verifier, and no client secret. +- [x] Access/refresh tokens are encrypted with an Android Keystore key, excluded from backup, redacted from string output, and removed on logout. +- [x] The authenticated `/api/v1/user` call confirms the account before repository loading. +- [x] `/api/v1/user/repos` follows pagination to completion, deduplicates by stable repository ID, and has a bounded page count. +- [x] DTOs remain in data packages; UI models contain no token, HTTP, or Android persistence types. +- [x] UI has localized signed-out, browser-waiting, loading, content, empty, authentication-expired, permission-denied, offline, and server-error states. +- [x] Repository rows identify owner/name, visibility, optional description, and default branch; logout is explicit. +- [x] Unit tests cover exchange form, callback terminal clearing, token codec, repository mapping/pagination/deduplication, and error mapping. +- [x] Build, unit tests, lint, focused tests, secret scan, and independent review pass. ## External evidence @@ -67,4 +67,5 @@ A user can sign in to the configured company Gitea through the system browser an - Focused authentication, callback, token-codec, HTTP transport, repository pagination/mapping, error mapping, and immutable UI-state tests passed. - `git diff --check` and the sensitive-pattern scan passed; no WebView or production client secret exists. - Independent review confirmed the browser/App Link, PKCE, Keystore/backup, identity-before-repositories, and bounded pagination design. Its P1 browser-cancellation, response-read, and token-retained error-recovery findings were fixed, together with signed-in error/logout UX, nullable DTO validation, immutable snapshots, and focused regression tests. Final re-review found no remaining P0/P1. -- Hosted `assetlinks.json` was visually confirmed by the product owner with both development signing fingerprints. No Android device is connected to this workstation, so actual browser callback and authenticated live-server E2E remain a manual verification step. +- Hosted `assetlinks.json` was visually confirmed by the product owner with both development signing fingerprints. +- Product-owner device E2E on 2026-08-25 passed: account login returned through the verified App Link and the app displayed the accessible internal repository list from the production Gitea instance.