coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Connect P04 audited recovery to fresh-MFA platform browser flow
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 54s
Details
Account journey acceptance / journeys (push) Successful in 5s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 21:05:33 +02:00
parent b2cce8dd7c
commit 58e07dd4df
7 changed files with 201 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/browser_journeys.mjs
View file

@ -51,6 +51,15 @@ try{
await evaluate(`Array.from(document.forms).find(f=>f.action.endsWith("/recover")).querySelector("button").click()`);
await waitFor('document.body.innerText.includes("Confirm change")');
await check(`document.body.innerText.includes("does not reset a password") && document.body.innerText.includes("cannot bypass")`,'P04 restoration explains factor boundary');
await identity('admin');await navigate('/platform/factor-recovery');
await check(`document.body.innerText.includes("Access is not available")`,'P04 tenant admin cannot recover shared factor');
await identity('operator');await navigate('/platform/factor-recovery');
await evaluate(`document.querySelector('input[name="user"]').value='alice';document.querySelector('input[name="reference"]').value='case-1';document.querySelector('form button').click()`);
await waitFor('document.body.innerText.includes("Review the selected authenticator")');
await check(`document.body.innerText.includes("all applications") && !!document.querySelector('input[name="identity_verified"][required]')`,'P04 scope and identity verification before mutation');
await evaluate(`document.querySelector('input[name="identity_verified"]').checked=true;Array.from(document.forms).find(f=>f.querySelector('input[name="confirmation"]')).querySelector('button').click()`);
await waitFor('document.body.innerText.includes("Authenticator recovery recorded")');
await check(`document.body.innerText.includes("case-1") && document.body.innerText.includes("Enroll a replacement") && !document.body.innerText.includes("server-only-token")`,'P04 receipt and replacement onboarding without credentials');
await navigate('/logout');
await check(`document.body.innerText.includes("Log out of this portal?")`,'U11 logout requires confirmation');
await evaluate(`document.querySelector('form[action="/logout"] button').click()`);