4 Commits

Include renames

Author	SHA1	Message	Date
Hartmut	19aeb2ba04	rename(phase 3): compose/DB/infra + stray code refs capakraken → nexus (#62) ... rename(phase 3): compose/DB/infra + stray code refs capakraken → nexus (#62) Co-authored-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com> Co-committed-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com>	2026-05-21 20:07:18 +02:00
Hartmut	b41c1d2501	rename(phase 1): CapaKraken → Nexus across code, UI, docs, CI (#61) ... rename(phase 1): CapaKraken → Nexus across code, UI, docs, CI (#61) Co-authored-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com> Co-committed-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com>	2026-05-21 16:28:40 +02:00
Hartmutandclaude-flow	8429bd86d4	test(e2e): fix dev-system test suite — storageState + strict-mode + signout ... Fixes 8 failures from the first test run: 1. Rate limiter exhaustion (5/8 failures) Admin was logged in 9× across the suite, hitting the 5/15min auth limit. Fix: global-setup.ts logs in once per role and saves storage state; all non-login tests use storageState so they skip the form. Total admin logins per suite run: 3 (global setup + 2 explicit tests). 2. Strict-mode violations (2/8 failures) toBeVisible() matched 3 email cells / 2 permission-error nodes. Fix: .first() on both locators. 3. Auth.js v5 signout confirmation page (1/8 failures) GET /auth/signout renders a confirm form rather than immediately redirecting. Fix: signOut() helper clicks the submit button. Note: running the suite right after a previous run may fail if the in-memory rate limit hasn't reset (15-min window). Restart the dev server, or add E2E_TEST_MODE=true to apps/web/.env.local to bypass. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-04-01 19:09:49 +02:00
Hartmutandclaude-flow	3d8a256d52	fix(auth): use token.sid to avoid Auth.js jti claim conflict ... Auth.js v5 manages token.jti internally and overwrites it after the jwt callback. Storing our session UUID in token.sid ensures the value we persist in active_sessions matches what the signed cookie carries. - jwt callback: token.sid = jti (was token.jti) - session callback: read from token.sid - signOut event: falls back to token.jti for backward compat with any sessions created before this change Also adds Playwright dev-system test suite (playwright.dev.config.ts + e2e/dev-system/) that validates login, session registry health, and RBAC enforcement against the running localhost:3100 dev server. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-04-01 19:00:44 +02:00