docs: record frontend auth query gating evidence

2026-08-25 14:31:25 +03:00
parent 373c18a2f1
commit 68f1d8f398
1 changed files with 52 additions and 0 deletions
@@ -140,3 +140,55 @@ archive: (1) изменение ассерта в stale-тесте объясн

 Verdict: **PASS**. Critical и Important findings отсутствовали. Minor hygiene:
 удалены случайные `.DS_Store` файлы из `specs` до archive/commit.
+
+## 2026-08-25-remove-frontend-hook-token-params
+
+**Change:** remove-frontend-hook-token-params (schema `wealth-ledger-sdd`)
+**Archive path:** `specs/openspec/changes/archive/2026-08-25-remove-frontend-hook-token-params`
+**Specs sync:** `skip_specs: true`; change закрывает audit-derived frontend
+architecture item без изменения observable product requirements.
+
+### Delivery Map
+
+| Area | Status | Outcome |
+| --- | --- | --- |
+| frontend | affected | `usePortfolio`, `useBrokerageAccounts`, `useBrokerageOperations` и `useBrokerageEvents` больше не принимают `accessToken`; protected query gating централизован в shared `useAuthenticatedQuery`; page/app callers перестали читать auth state только ради token plumbing; добавлены regression tests |
+| backend | N/A | API contract и backend behavior не менялись |
+| specs | affected | OpenSpec change заархивирован как process/audit remediation без delta specs |
+| docs | N/A | As-built product docs не менялись; Completion Evidence добавлен отдельным финальным docs-коммитом |
+
+### Delivery commits
+
+| Repo | Commit | Subject |
+| --- | --- | --- |
+| frontend | `268acdf2e1057ed0f6c19384bfb6477aff773d1d` | refactor: centralize frontend auth query gating |
+| backend | — | N/A |
+| specs | `6e2890f86f5316fdb821b043084461314eb8cf13` | docs(specs): archive frontend auth query gating change |
+| docs | current evidence commit | docs: record frontend auth query gating evidence |
+
+### Verification
+
+| Command (repo) | Наблюдённый результат |
+| --- | --- |
+| `npm run test:run -- src/shared/api` (frontend, RED baseline before implementation) | failed as expected because `./authenticated-query` did not exist |
+| `npm run test:run -- src/shared/api` (frontend) | pass; 2 files / 4 tests |
+| `npm run test:run -- src/entities/portfolio/api/usePortfolio.test.tsx src/entities/broker-operation/api/useBrokerageOperations.test.tsx src/entities/brokerage-account/api/useBrokerageAccounts.test.tsx src/entities/brokerage-event/api/useBrokerageEvents.test.tsx` (frontend) | pass; 4 files / 4 tests |
+| `npm run test:run -- src/pages/accounts src/pages/account src/pages/account-operations src/pages/account-events src/app/ui` (frontend) | pass; 6 files / 29 tests |
+| `npm run typecheck` (frontend) | pass |
+| `rg "usePortfolio\\([^\\n,]+,\\s*accessToken\|useBrokerageAccounts\\(accessToken\|useBrokerageOperations\\([^\\n]+accessToken\|useBrokerageEvents\\([^\\n]+accessToken" frontend/src -n` (workspace) | no matches |
+| `bash specs/scripts/verify-workspace-change.sh remove-frontend-hook-token-params` (workspace, pre-archive, Node 22.21.0) | pass; Delivery Map verified frontend/specs=affected, backend/docs/runtime-openapi=N/A; frontend canonical verification passed |
+| `openspec archive remove-frontend-hook-token-params --skip-specs --yes --store wealth-ledger-specs` (specs) | pass; archived as `2026-08-25-remove-frontend-hook-token-params` |
+| `npm run verify` (frontend, post-archive, Node 22.21.0) | pass; runtime/openapi/hygiene/typecheck/lint/vitest/knip/deps/build/bundle-budget без ошибок; 21 test files / 67 tests; initial JavaScript payload 510597 bytes |
+| `openspec validate --specs --strict --store wealth-ledger-specs` (specs, post-archive) | pass; 20 passed, 0 failed |
+| `bash scripts/verify-openspec-authority.sh` (specs, post-archive) | pass; OpenSpec CLI 1.10.0, authority `wealth-ledger-specs` |
+
+### Independent read-only review
+
+Verdict: **PASS**. Critical и Important findings отсутствовали; Minor findings
+отсутствовали. Reviewer подтвердил, что четыре targeted hooks и их callers
+больше не передают `accessToken`, auth gating централизован в shared API layer,
+query params/keys, `staleTime` и `retry: false` сохранены, а оставшееся
+использование `accessToken` в T-Bank connection ViewModel соответствует
+явному non-goal Design. Residual risk: full AuthProvider login/refresh/logout
+path enabling/disabling authenticated queries покрыт ограниченно; direct
+session snapshot transition через `configureAuthClient` покрыт regression test.