AUTH4D-74 cross-stack verification of the completed features
AUTH4D-74 adds no endpoints. It verifies the feature-completion work (AUTH4D-55 to AUTH4D-72) end to
end on the AUTH4D-29 (repository file docs/api-spec/auth4d-29.md) harness: the unmodified API Worker and console BFF in one
workerd isolate, real D1 migrations, Durable Objects, the email queue and the local mailbox.
Running
pnpm --filter @auth4/integration exec vitest run --config auth4d-29/vitest.config.ts auth4d-74
node infra/smoke/local.mjsThe suite also runs as part of pnpm test:integration (scripts/verify/release.mjs). It is
excluded from the per-ticket configuration that pnpm test runs, because it needs the AUTH4D-29
harness entry and global setup.
Scenarios (tests/integration/auth4d-74.completion.test.ts)
| Feature | End to end | Cross-tenant negative |
|---|---|---|
| Branding (AUTH4D-56/57/58/62) | Console PATCH, then the branding in GET /t/{tenantId}/login/context, the device verify JSON and the verification email |
Other tenant’s pages show {}; foreign client 404 on login context; foreign user code refused; foreign owner 403/404 on read and PATCH |
| Device sign-in (AUTH4D-59/60) | login_required, inline email code, signed_in, approvable, approval, one device-code grant |
Flow cannot send a code through another tenant; a session is not a session in another tenant; foreign approval refused, codes untouched |
| Browser SDK refresh (AUTH4D-63/65) | @auth4/sdk-browser with refresh: true: rotation in the renewal window, replay of a retired token revokes the family, SDK signs out |
Refresh token refused at another tenant with either client and not burned |
| Guest upgrade (AUTH4D-64/66/67) | SDK signInAsGuest, hosted-page upgrade; native guest, upgrade intent, email link, one poll; auth4_guest gone, also after refresh |
Guest token refused by another tenant’s intent and linking routes; handle and poll secret resolve to expired_token elsewhere |
| Team (AUTH4D-70/71) | Invite, email link #token=, accept (direct and carried through console sign-in), viewer and admin limits, removal ends access |
Foreign owner 403 on team routes, 404 on revoke; token accepted by another account is invalid_invitation and not consumed |
| Billing retention (AUTH4D-72) | Deleting a tenant keeps minimized invoices and payments in retained_* and removes live billing rows |
Other tenant’s live billing untouched and nothing of it retained; deleted tenant not served |
Secret-leak scan
The harness scan (tests/integration/auth4d-29/harness/setup.ts) fails a file when any observed
credential appears in the captured Worker logs. AUTH4D-74 adds native upgrade poll secrets,
device and page CSRF tokens, invitation tokens, the tenant Discord client secret, and the
RESEND_API_KEY, STITCH_CLIENT_SECRET and STITCH_WEBHOOK_SECRET bindings when a run supplies
them.
Smoke checks (infra/smoke/smoke.mjs)
Full mode now also checks application branding and device settings, the team routes and an unknown invitation token, the login context (with and without its flow cookie), branding and the session decision on the device page, and the guest claim with a native upgrade intent. Guest sign-in is only enabled for the smoke project on a loopback stack; elsewhere that check is skipped when it is off.
Source: docs/api-spec/auth4d-74.md