curo1305andClaude Sonnet 4.6
ba30ada87a
5 plans across 4 waves covering ADMIN-08..12, CODE-06, CODE-09: - 09-01 (W1): backend GET /api/admin/overview + 8 ADMIN-11 tests - 09-02 (W1): AdminLayout + AdminSidebar + AdminOverviewView + getAdminOverview API - 09-03 (W2): extract 4 admin tab components to standalone views - 09-04 (W3): nested /admin route + to.matched.some guard + D-08/D-09/D-10 redirects + Tailwind safelist (sky+amber) + login redirect + delete AdminView/tabs - 09-05 (W4): CODE-09 comment purge for Phase 9 + retroactive Phase 8 backend sub-packages + human UAT checkpoint All locked decisions D-01..D-16 mapped to tasks; safelist corrected to include sky (OneDrive) and amber (audit badges) per RESEARCH.md Pattern 7. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2.8 KiB
2.8 KiB
phase, slug, status, nyquist_compliant, wave_0_complete, created
| phase | slug | status | nyquist_compliant | wave_0_complete | created |
|---|---|---|---|---|---|
| 9 | admin-panel-rearchitecture | draft | false | false | 2026-06-12 |
Phase 9 — Validation Strategy
Per-phase validation contract for feedback sampling during execution.
Test Infrastructure
| Property | Value |
|---|---|
| Framework | pytest (backend) + manual browser/vitest (frontend) |
| Config file | backend/pytest.ini |
| Quick run command | cd backend && pytest tests/test_admin_overview.py -x |
| Full suite command | cd backend && pytest -v |
| Estimated runtime | ~60 seconds |
Sampling Rate
- After every task commit: Run
cd backend && pytest tests/test_admin_overview.py -x(after overview endpoint tasks) - After every plan wave: Run
cd backend && pytest -v - Before
/gsd:verify-work: Full suite must be green - Max feedback latency: 60 seconds
Per-Task Verification Map
| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|---|---|---|---|---|---|---|---|---|---|
| overview-endpoint | 09-0N | Wave 1 | ADMIN-11 | Admin data leak | Response never contains credentials_enc, doc content |
Integration | pytest tests/test_admin_overview.py::test_overview_aggregate |
No — Wave 0 gap | ❌ |
| overview-no-sensitive | 09-0N | Wave 1 | ADMIN-11 | Sensitive field exposure | credentials_enc and document content absent from response |
Security | pytest tests/test_admin_overview.py::test_overview_no_sensitive_fields |
No — Wave 0 gap | ❌ |
| admin-guard | 09-0N | Wave 2 | ADMIN-12 | Privilege escalation | Non-admin navigating to /admin/users redirected to / |
Integration (browser) | Manual browser test or Playwright | N/A | ❌ |
| adminview-deleted | 09-0N | Wave 3 | ADMIN-08 | Dead code | AdminView.vue absent from repo |
Static | grep -r "AdminView" frontend/src/ | grep -v AdminLayout | grep -v AdminOverview |
N/A | ❌ |
| tailwind-safelist | 09-0N | Wave 3 | CODE-06 | Visual regression | Dynamic provider color classes render in prod build | Build | npm run build + visual check |
N/A | ❌ |
Wave 0 Gaps
Test files that must be created before feature code:
backend/tests/test_admin_overview.py— covers ADMIN-11 aggregate query + security invariants (no sensitive fields)
Security Invariants (Must All Pass)
GET /api/admin/overviewnever returnscredentials_enc,password_hash, or document contentGET /api/admin/overviewis admin-only (get_current_admindep enforced)- Non-admin user accessing
/admin/*routes is redirected to/bybeforeEachguard - Admin user accessing non-admin routes (
/,/settings, etc.) is redirected to/admin