Game guide · source of truth
Ledger

WEB-205

Admin System: audit log viewer (filters, diffs, chain verify, export), integrations, account (2-step, phone alerts via Web Push, PWA, sign out everywhere)

← Ledger

donestatus · web-admin
3✓ 3✗tests passed / failed
37.55Mtokens · 58 min
10evidence files · 1.1 MB

Evidence

From logs/evidence/WEB-205/. Click a thumbnail for the full image.

Images (10)

desktop/overview-light.png
desktop/overview-light.png · 68 kB
desktop/overview.png
desktop/overview.png · 68 kB
mobile/overview.png
mobile/overview.png · 88 kB
tablet/overview.png
tablet/overview.png · 63 kB
desktop/account.png
desktop/account.png · 109 kB
desktop/audit.png
desktop/audit.png · 198 kB
desktop/command-menu.png
desktop/command-menu.png · 108 kB
mobile/account.png
mobile/account.png · 199 kB
mobile/drawer.png
mobile/drawer.png · 141 kB
tablet/account.png
tablet/account.png · 105 kB

Tests

pass pgTAP incl. push targeting (114) · 40.9 s · raw log$ pnpm -s db:test
fail admin e2e: audit verify/filter/diff/export, integrations, account (replace authenticator, sign out everywhere), PWA files · 310.6 s · raw log$ cd apps/admin && pnpm build >/dev/null 2>&1 && ZOEN_EVIDENCE_TASK=WEB-205 pnpm exec playwright test tests/e2e/system.spec.ts tests/e2e/shell.spec.ts --workers=1 --reporter=line
pass pgTAP 125 incl. session revocation + approvals · 22.5 s · raw log$ pnpm -s db:test
fail admin e2e: audit, integrations, account (replace authenticator, sign out everywhere bites immediately), PWA files · 6.1 s · raw log$ cd apps/admin && pnpm build >/dev/null 2>&1 && ZOEN_EVIDENCE_TASK=WEB-205 pnpm exec playwright test tests/e2e/system.spec.ts --workers=1 --reporter=line
fail admin e2e: audit, integrations, account (replace authenticator, sign out everywhere bites immediately), PWA files · 225.2 s · raw log$ cd apps/admin && ZOEN_EVIDENCE_TASK=WEB-205 pnpm exec playwright test tests/e2e/system.spec.ts --workers=1 --reporter=line
pass admin e2e: audit, integrations, account (replace authenticator, sign out everywhere bites immediately), PWA files · 281.0 s · raw log$ cd apps/admin && ZOEN_EVIDENCE_TASK=WEB-205 pnpm exec playwright test tests/e2e/system.spec.ts --workers=1 --reporter=line

Notes

2026-10-04 18:14 UTC · Evidence logs/evidence/WEB-205: audit (verify chain, filters, diffs, export), account. SECURITY FIX: access tokens stayed valid after 'sign out everywhere' until expiry (stateless JWT) → has_perm/current_staff now also require the token's auth session to exist (private.session_alive; pgTAP 120) so revoked sessions lose access on the next request. Phone alerts: Web Push (VAPID) with per-device subscriptions, dispatch to staff allowed to see each notification (pgTAP 100), service worker + installable PWA (192/512/maskable icons from the accepted emblem — a proper 1024px app icon should be an art request). Test infra: setup reuses still-valid sessions (<50 min, API-checked), serial + retries; long e2e runs go to the background (foreground shell was killed under load avg 100–130 from other projects).