50 lines
3.0 KiB
Markdown
50 lines
3.0 KiB
Markdown
# Slice 3 Manual Verification
|
|
|
|
Run one step at a time against `http://localhost:3000/`. Use a disposable project or avoid saving changes to an existing project. Do not use real credentials; use the example values below.
|
|
|
|
## Step 1 — Secret lifecycle and browser exposure
|
|
|
|
1. Open **Actions & Bindings** and locate **Secrets**.
|
|
2. Create a Bearer token secret named `Manual Bearer` with token `manual-bearer-value`.
|
|
3. Confirm the saved record shows only its name, authentication type, opaque ID, and lifecycle controls—not the token.
|
|
4. Confirm the token input was masked while entering it and cleared after creation.
|
|
5. Click **Replace value**, enter `manual-bearer-replaced`, and confirm the old or new token is not displayed afterward.
|
|
|
|
Expected: credential entry is masked, create/replace succeeds, and stored values are never redisplayed.
|
|
|
|
## Step 2 — Compatible selection and canonical isolation
|
|
|
|
1. Create one secret for each remaining mode using disposable values: Basic, API-key header, and API-key query.
|
|
2. Edit a REST action and select each authentication mode in turn.
|
|
3. Confirm **Stored secret** offers only secrets matching the selected mode.
|
|
4. Select `Manual Bearer` for Bearer mode.
|
|
5. Inspect canonical JSON and confirm the action contains `authenticationType: "bearerToken"` and an opaque `secretReferenceId` only.
|
|
6. Confirm canonical JSON contains none of the usernames, passwords, tokens, API-key names, or API-key values entered above.
|
|
|
|
Expected: guided choices are type-compatible and canonical state contains only the opaque reference.
|
|
|
|
## Step 3 — Execution and redaction
|
|
|
|
1. Configure the referenced action as `GET https://httpbingo.org/anything`.
|
|
2. Use **Test Action** or Preview execution.
|
|
3. Confirm HTTP 200.
|
|
4. Inspect the response and confirm the reflected Authorization value is `[REDACTED]`, with neither Bearer token value present.
|
|
5. Repeat proportionally with API-key header and query secrets. Confirm reflected values and the query-bearing reflected URL contain `[REDACTED]`.
|
|
|
|
Expected: all credential modes execute server-side and no stored value returns to the browser.
|
|
|
|
## Step 4 — Failure safety and deletion protection
|
|
|
|
1. With an action still referencing `Manual Bearer`, try deleting that secret.
|
|
2. Confirm deletion is blocked and names the referencing action.
|
|
3. Change the action to Anonymous, which clears the secret reference.
|
|
4. Delete `Manual Bearer` and confirm it disappears.
|
|
5. Delete all other disposable secrets.
|
|
6. Select a protected mode without a secret and confirm the diagnostic requests a server-side secret reference; execution must fail clearly rather than execute anonymously.
|
|
|
|
Expected: referenced deletion is blocked, unreferenced deletion succeeds, missing credentials fail safely, and no protected action silently executes anonymously.
|
|
|
|
## Completion gate
|
|
|
|
Record each step as PASS or FAIL with observed behavior. Do not save disposable secret references into a valued project. If all four steps pass, reconcile final Slice 3 evidence and request explicit Slice 3 sign-off.
|