QA: comments and notifications regression pack #96

New Issue

fable-5 · 2026-07-04T14:52:53+02:00

fable-5 commented

2026-07-04 14:52:53 +02:00

Context

The social features complete the product; their permission and delivery semantics get a pinned regression suite.

Scope

Extend the e2e packs: comment permission matrix (per pond setting), watch/notify/digest flows with two users (API-level where UI adds nothing), notification permission-revocation delivery test, digest grouping snapshot; update the fixture documentation.

Acceptance criteria

pack green in CI within budget; flaky-free across 5 consecutive runs
matrix documented alongside the M5 permission pack
digest snapshot pins the mail structure (change requires explicit snapshot update)

Technical notes

ADR 0014.

Dependencies

Depends on #60, #92, #94, #95.

Size: ~1 day

Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add de and en), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.

## Context The social features complete the product; their permission and delivery semantics get a pinned regression suite. ## Scope Extend the e2e packs: comment permission matrix (per pond setting), watch/notify/digest flows with two users (API-level where UI adds nothing), notification permission-revocation delivery test, digest grouping snapshot; update the fixture documentation. ## Acceptance criteria - [ ] pack green in CI within budget; flaky-free across 5 consecutive runs - [ ] matrix documented alongside the M5 permission pack - [ ] digest snapshot pins the mail structure (change requires explicit snapshot update) ## Technical notes - ADR 0014. ## Dependencies Depends on #60, #92, #94, #95. **Size**: ~1 day --- *Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add `de` **and** `en`), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.*

fable-5 added this to the M9 — Comments & notifications milestone 2026-07-04 14:52:53 +02:00

fable-5 added the

qa

label 2026-07-04 14:52:53 +02:00

fable-5 referenced this issue

2026-07-11 23:09:49 +02:00

Watches: follow pages and ponds #93

fable-5 referenced this issue

2026-07-11 23:31:54 +02:00

Notification generation and in-app notification center #94

fable-5 referenced this issue from a commit

2026-07-12 00:00:35 +02:00

Pin the comments/notifications semantics as a regression pack (#96)

fable-5 referenced this issue from a commit

2026-07-12 00:01:26 +02:00

Fix lint errors in the social pack (#96)

fable-5 referenced this issue from a commit

2026-07-12 00:02:15 +02:00

Format the social pack (#96)

fable-5 commented

2026-07-12 00:13:13 +02:00

Implemented in 6d51c0d (+ lint/format follow-ups f28913e/92c71c3; pipeline green, 8/8).

Comment permission matrix — extended the M5 permission-matrix pack (permission-matrix.spec.ts, its header documents the enlarged subject × surface table as the AC asks): under the default readers policy every reader writes, the outsider gets 404 on read and write, anonymous 401; the label-restricted editor cannot even see the secret page's thread (404 on list and create); under editors the reader turns into an explicit 403 while reading stays open — the 404-vs-403 policy holds across the new surface.

Watch/notify flows with two users — new API-level social.spec.ts (own CI step; API-level as scoped, since the bell/panels are plain renderings of these endpoints and have their own packs): a comment notifies the watcher and never the actor; read-all clears the badge and a fresh request still sees it (server state); a watcher revoked mid-flight receives nothing new (delivery-time re-check); and the digest job runs end to end through the #86 manual trigger.

Digest grouping snapshot — digest.snapshot.db.test.ts pins the mail structure with a committed vitest snapshot (subject + body: per-pond → per-page grouping with counts and actor names, open-app and unsubscribe framing); the signed token is normalized to <TOKEN>, everything else must match byte for byte — changing the mail now requires an explicit snapshot update.

Acceptance criteria

pack green in CI within budget; flaky-free across 5 consecutive runs — both packs ran five consecutive local rounds (8/8 tests each round, ~1.2 s per round) plus the green CI run; the packs provision their own pond and clean up, so they are order-independent.
matrix documented alongside the M5 permission pack — same file, extended header.
digest snapshot pins the mail structure — committed __snapshots__/digest.snapshot.db.test.ts.snap.

Fixture documentation: the matrix header now describes the comment surface; the social pack's header records its fixture strategy (throwaway pond via the seeded quota headroom, fixture-viewer as the watcher).

Implemented in `6d51c0d` (+ lint/format follow-ups `f28913e`/`92c71c3`; pipeline green, 8/8). **Comment permission matrix** — extended the M5 permission-matrix pack (`permission-matrix.spec.ts`, its header documents the enlarged subject × surface table as the AC asks): under the default `readers` policy every reader writes, the outsider gets 404 on read *and* write, anonymous 401; the **label-restricted editor cannot even see the secret page's thread** (404 on list and create); under `editors` the reader turns into an explicit 403 while reading stays open — the 404-vs-403 policy holds across the new surface. **Watch/notify flows with two users** — new API-level `social.spec.ts` (own CI step; API-level as scoped, since the bell/panels are plain renderings of these endpoints and have their own packs): a comment notifies the watcher and never the actor; read-all clears the badge and a fresh request still sees it (server state); **a watcher revoked mid-flight receives nothing new** (delivery-time re-check); and the digest job runs end to end through the #86 manual trigger. **Digest grouping snapshot** — `digest.snapshot.db.test.ts` pins the mail structure with a committed vitest snapshot (subject + body: per-pond → per-page grouping with counts and actor names, open-app and unsubscribe framing); the signed token is normalized to `<TOKEN>`, everything else must match byte for byte — changing the mail now requires an explicit snapshot update. **Acceptance criteria** - *pack green in CI within budget; flaky-free across 5 consecutive runs* — both packs ran five consecutive local rounds (8/8 tests each round, ~1.2 s per round) plus the green CI run; the packs provision their own pond and clean up, so they are order-independent. - *matrix documented alongside the M5 permission pack* — same file, extended header. - *digest snapshot pins the mail structure* — committed `__snapshots__/digest.snapshot.db.test.ts.snap`. Fixture documentation: the matrix header now describes the comment surface; the social pack's header records its fixture strategy (throwaway pond via the seeded quota headroom, fixture-viewer as the watcher).

fable-5 closed this issue

2026-07-12 00:13:14 +02:00

Sign in to join this conversation.