docs(e2e): record second CLI-only attempt — all gaps verified closed
Rebuilt the rich To-Do app end-to-end through `pic` alone (no raw admin curl) after the gap fixes landed, and appended a per-finding verification table + transcript to the report. Confirms B1/B2/F1–F4/S1–S3/O1 closed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
MechaCat02
@@ -22,6 +22,14 @@ fans out to an external SSE subscriber, and the cron trigger registers and runs.
|
||||
**no `pic` command at all** and forced me to drop to raw `curl` against the admin API — and
|
||||
without the first one, *every* app created through the CLI serves `404` on every route.
|
||||
|
||||
> ## ✅ RE-TEST 2026-06-12 — ALL GAPS CLOSED (verified live)
|
||||
>
|
||||
> After remediation (commits `04a24ea`, `ae2134e`, `7ffbb8d`, `b831138`), I rebuilt the **entire
|
||||
> app a second time CLI-only, with zero raw `curl` against the admin API** (app `todoapp2`,
|
||||
> domain `todos2.local`). Every finding below is now fixed and verified end-to-end. See the
|
||||
> [Re-test verification](#re-test-verification--2026-06-12) section at the bottom for the
|
||||
> per-finding evidence. The original findings are preserved as-is for the record.
|
||||
|
||||
---
|
||||
|
||||
## App as built
|
||||
@@ -193,3 +201,61 @@ The two CLI gaps that turn "I built an app" into "…but it 404s and has no real
|
||||
(domain claims)** and **B2 (topic registration)**. Both already have working admin APIs; they
|
||||
just need thin `pic` wrappers (mirroring the existing `routes`/`triggers` commands). Ship those
|
||||
two and a CLI-only developer can build this entire app without ever touching `curl`.
|
||||
|
||||
---
|
||||
|
||||
# Re-test verification — 2026-06-12
|
||||
|
||||
Second pass after the fix commits (`04a24ea` CLI gaps, `ae2134e` `ctx.request.method`,
|
||||
`7ffbb8d` `users::email_available`, `b831138` docs). I rebuilt the whole app as a **fresh,
|
||||
CLI-only** flow against the same live instance — new app `todoapp2`, domain `todos2.local`,
|
||||
**no raw `curl` to any `/api/v1/admin/*` endpoint**. Data-plane HTTP calls (the app's own
|
||||
traffic) still use curl, as a real end-user client would.
|
||||
|
||||
## Status table
|
||||
|
||||
| # | Finding | Status | Evidence |
|
||||
|---|---------|--------|----------|
|
||||
| B1 | No domain-claim command | ✅ Fixed | `pic apps domains add todoapp2 todos2.local` → claim created; routes then match. Help text even explains the 404-without-claim trap. |
|
||||
| B2 | No pubsub topic command | ✅ Fixed | `pic topics create --app todoapp2 activity --external` → `external_subscribable:true`; SSE subscriber received the published event. |
|
||||
| F1 | `deploy`/`apps create` ignore `--output json` | ✅ Fixed | Both now emit the full JSON object; I captured every script id straight from `deploy --output json` (no follow-up `scripts ls`). |
|
||||
| F2 | No `pic users` command | ✅ Fixed | `pic users ls/show/reset-password` all work; listed Carol+Dave, showed Carol, minted a 1-shot reset token. |
|
||||
| F3 | Password login interactive-only | ✅ Fixed | `printf 'admin' \| pic login --username admin --password-stdin` logged in non-interactively. |
|
||||
| F4 | No `ctx.request.method` | ✅ Fixed | One `todos.rhai` now serves **GET+POST** and one `todo_item.rhai` serves **PATCH+DELETE** by branching on `ctx.request.method`; unsupported verb returns my `405`. Script count dropped 7→5, routes 6→4. |
|
||||
| S1 | `find_by_email` forbidden for anon registration | ✅ Fixed | New `users::email_available(email)` → bool works from the anonymous register route; duplicate email now returns a clean `409`, no more `users: forbidden`/502. |
|
||||
| S2 | `statusCode`-gated envelope (double-nest) | ✅ Documented | Behaviour noted in stdlib docs (`b831138`); my scripts use explicit `statusCode` and responses are flat. |
|
||||
| S3 | Rhai `replace()` returns `()` footgun | ✅ Documented | Bearer-parsing note added; `auth.sub_string(7)` after `starts_with` is the idiom used. |
|
||||
| O1 | Dev-mode needs undocumented ack var | ✅ Documented | `PICLOUD_DEV_INSECURE_KEY` now documented alongside `PICLOUD_DEV_MODE`. |
|
||||
|
||||
## CLI-only build transcript (abridged, all succeeded)
|
||||
|
||||
```
|
||||
pic login --username admin --password-stdin # F3
|
||||
pic apps create todoapp2 --output json # F1 → captured id
|
||||
pic apps domains add todoapp2 todos2.local # B1
|
||||
pic deploy <f>.rhai --app todoapp2 --output json # F1 → captured 5 script ids
|
||||
pic routes create --script <id> --path /todos # ANY-method route (F4 in-script branch)
|
||||
pic routes create --script <id> --path /todos/:id --path-kind param
|
||||
pic topics create --app todoapp2 activity --external # B2
|
||||
pic triggers create-cron --app todoapp2 --script <cleanup> --schedule "0 0 3 * * *"
|
||||
pic users ls --app todoapp2 # F2
|
||||
```
|
||||
|
||||
## Data-plane journey (all green)
|
||||
|
||||
```
|
||||
register carol/dave 201 / 201
|
||||
duplicate carol (email_available, S1) 409 {"error":"email already registered"}
|
||||
login carol/dave 43-char tokens
|
||||
POST /todos (method-branch create, F4) 201 ×2
|
||||
GET /todos (same script, list, F4) 200 count:2
|
||||
PATCH /todos/:id complete 200
|
||||
dave PATCH/DELETE carol's todo 403 / 403 (ownership)
|
||||
carol DELETE 200
|
||||
PUT /todos (unsupported verb) 405 (in-script method guard)
|
||||
no-auth GET /todos 401
|
||||
realtime SSE on activity received {"kind":"created",...,"topic":"activity"}
|
||||
```
|
||||
|
||||
**Conclusion: a CLI-only developer can now build this entire app — auth, storage, CRUD,
|
||||
ownership, cron, and a realtime feed — without ever touching `curl` against the admin API.**
|
||||
|
||||
Reference in New Issue
Block a user