§25: navigation contract drift gate + route-guard truth-up - #63
Merged
Conversation
NavigationContractTests (arch tier, CI merge gate) machine-enforces the NavigationFlow.md routes/auth table against the RouteAttribute and AuthorizeAttribute reality of MMCA.Common.UI: set-equality of routes, auth-posture consistency in both directions, and an 8-route non-vacuity floor, with the doc embedded as a resource. The gate surfaced three real drifts, fixed here: the three notification pages carried NO route-level [Authorize] despite the documented Authenticated/Role-gated contract (now guarded; the send role gate stays consumer-declared and the doc says so), the template-leftover /counter page was routable but undocumented (deleted, plus its orphaned resx pairs), and /forbidden was documented Authenticated while the route is open (doc corrected to Any). Verified red on a seeded posture drift, green on the trued-up files; full suite 2227/2227; FACTS regenerated (fitness counts unchanged, executes 46->49). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…n scans The route guards added for §25 surface as endpoint metadata on the Razor Components endpoints, so the backend-less gallery threw (no IAuthenticationService) and all three ui-e2e legs failed. The gallery now registers a cookie-toggled GalleryFakeAuthenticationHandler (gallery_auth=1 authenticates a fixed principal, everything else stays anonymous) plus the full authorization stack, and GalleryAuthenticationStateProvider mirrors the request user in both render phases (HttpContext during SSR, host handoff in circuits), replacing the always-anonymous stub. The three notification scans seed the cookie; login/register/components scans stay deliberately signed-out. Full UI E2E suite locally green 23/23 (chromium). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ships the #25 maturity lever (the scorecard's stated gap: "NavigationFlow.md has no drift gate, Routes.razor auth wiring untested"):
NavigationContractTests(arch tier, CI merge gate): reflects everyRouteAttributecomponent inMMCA.Common.UIand asserts NavigationFlow.md's routes table matches reality exactly: no undocumented routes, no phantom rows, and the documented auth posture (Anonymous/Any vs Authenticated) must match the presence of[Authorize]on the page. 8-route non-vacuity floor; the doc rides as an embedded resource.The gate immediately surfaced three real drifts, fixed in the same change:
/notifications,/notifications/inbox,/notifications/send), despite the doc promising Authenticated/Role-gated. All three now carry@attribute [Authorize], soAuthorizeRouteViewactually guards them; the send page's role/claim gate remains consumer-declared (NavItem filter) + server-side API authz, and the doc now says exactly that./counter(Blazor template leftover, referenced by nothing) was routable but undocumented: deleted, along with its three orphaned resx key pairs (en + es)./forbiddenwas documented Authenticated but the route is open: doc corrected to Any with the in-shell rendering explained.Verification
MMCA.Common.slnxsuite: 2227/2227 green.Behavior note for consumers: anonymous hits on the notification routes now redirect to /login instead of rendering a shell whose API calls fail; this ships to ADC/Store with the next release + pin sweep.
🤖 Generated with Claude Code