diff --git a/development/completion-evidence.md b/development/completion-evidence.md index 050f9f9..426a496 100644 --- a/development/completion-evidence.md +++ b/development/completion-evidence.md @@ -140,3 +140,55 @@ archive: (1) изменение ассерта в stale-тесте объясн Verdict: **PASS**. Critical и Important findings отсутствовали. Minor hygiene: удалены случайные `.DS_Store` файлы из `specs` до archive/commit. + +## 2026-08-25-remove-frontend-hook-token-params + +**Change:** remove-frontend-hook-token-params (schema `wealth-ledger-sdd`) +**Archive path:** `specs/openspec/changes/archive/2026-08-25-remove-frontend-hook-token-params` +**Specs sync:** `skip_specs: true`; change закрывает audit-derived frontend +architecture item без изменения observable product requirements. + +### Delivery Map + +| Area | Status | Outcome | +| --- | --- | --- | +| frontend | affected | `usePortfolio`, `useBrokerageAccounts`, `useBrokerageOperations` и `useBrokerageEvents` больше не принимают `accessToken`; protected query gating централизован в shared `useAuthenticatedQuery`; page/app callers перестали читать auth state только ради token plumbing; добавлены regression tests | +| backend | N/A | API contract и backend behavior не менялись | +| specs | affected | OpenSpec change заархивирован как process/audit remediation без delta specs | +| docs | N/A | As-built product docs не менялись; Completion Evidence добавлен отдельным финальным docs-коммитом | + +### Delivery commits + +| Repo | Commit | Subject | +| --- | --- | --- | +| frontend | `268acdf2e1057ed0f6c19384bfb6477aff773d1d` | refactor: centralize frontend auth query gating | +| backend | — | N/A | +| specs | `6e2890f86f5316fdb821b043084461314eb8cf13` | docs(specs): archive frontend auth query gating change | +| docs | current evidence commit | docs: record frontend auth query gating evidence | + +### Verification + +| Command (repo) | Наблюдённый результат | +| --- | --- | +| `npm run test:run -- src/shared/api` (frontend, RED baseline before implementation) | failed as expected because `./authenticated-query` did not exist | +| `npm run test:run -- src/shared/api` (frontend) | pass; 2 files / 4 tests | +| `npm run test:run -- src/entities/portfolio/api/usePortfolio.test.tsx src/entities/broker-operation/api/useBrokerageOperations.test.tsx src/entities/brokerage-account/api/useBrokerageAccounts.test.tsx src/entities/brokerage-event/api/useBrokerageEvents.test.tsx` (frontend) | pass; 4 files / 4 tests | +| `npm run test:run -- src/pages/accounts src/pages/account src/pages/account-operations src/pages/account-events src/app/ui` (frontend) | pass; 6 files / 29 tests | +| `npm run typecheck` (frontend) | pass | +| `rg "usePortfolio\\([^\\n,]+,\\s*accessToken\|useBrokerageAccounts\\(accessToken\|useBrokerageOperations\\([^\\n]+accessToken\|useBrokerageEvents\\([^\\n]+accessToken" frontend/src -n` (workspace) | no matches | +| `bash specs/scripts/verify-workspace-change.sh remove-frontend-hook-token-params` (workspace, pre-archive, Node 22.21.0) | pass; Delivery Map verified frontend/specs=affected, backend/docs/runtime-openapi=N/A; frontend canonical verification passed | +| `openspec archive remove-frontend-hook-token-params --skip-specs --yes --store wealth-ledger-specs` (specs) | pass; archived as `2026-08-25-remove-frontend-hook-token-params` | +| `npm run verify` (frontend, post-archive, Node 22.21.0) | pass; runtime/openapi/hygiene/typecheck/lint/vitest/knip/deps/build/bundle-budget без ошибок; 21 test files / 67 tests; initial JavaScript payload 510597 bytes | +| `openspec validate --specs --strict --store wealth-ledger-specs` (specs, post-archive) | pass; 20 passed, 0 failed | +| `bash scripts/verify-openspec-authority.sh` (specs, post-archive) | pass; OpenSpec CLI 1.10.0, authority `wealth-ledger-specs` | + +### Independent read-only review + +Verdict: **PASS**. Critical и Important findings отсутствовали; Minor findings +отсутствовали. Reviewer подтвердил, что четыре targeted hooks и их callers +больше не передают `accessToken`, auth gating централизован в shared API layer, +query params/keys, `staleTime` и `retry: false` сохранены, а оставшееся +использование `accessToken` в T-Bank connection ViewModel соответствует +явному non-goal Design. Residual risk: full AuthProvider login/refresh/logout +path enabling/disabling authenticated queries покрыт ограниченно; direct +session snapshot transition через `configureAuthClient` покрыт regression test.