Commit1a0ac2e
docs(audit): record login-lockout root cause + password-form restore
1 file changed+19−01a0ac2e81c9f4d85bc4b8cb7814a2fed1b9e841e
1 changed file+19−0
ModifiedAUDIT-2026-07-07-CHECKLIST.md+19−0View fileUnifiedSplit
@@ -26,6 +26,25 @@ Legend: ✅ done & verified · 🔄 in progress · ⬜ not started · 🚫 block
2626## Phase 2 — Review hardening (commit `6b75ac1`)
2727- ✅ Fail-CLOSED on DB error in `assertRepoReadable` (was fail-open) — flagged by automated review
2828
29## Phase 2.5 — LOGIN LOCKOUT root cause (commit `2aefa37`)
30**Why the owner is locked out of gluecron.com:** a previous agent's `signin-v2`
31redesign shipped PASSWORDLESS — `GET /login` renders `SignInV2`, which had OAuth +
32passkey + magic-link but **no username/password field** (subheading literally said
33"no new passwords"). The live site still shows a password box only because it runs
34OLDER code. Deploying as-is would have DELETED password login and locked the owner
35out worse.
36- ✅ Restored a real password `<form action=/login>` (username + password + Sign in +
37 Forgot-password link) above the Google/GitHub/passkey/magic options in `signin-v2.tsx`.
38- ✅ Verified: `/login` renders 200 with password+username fields, posts to `/login`,
39 Google + GitHub buttons present, `/forgot-password` link present. web-routes 13/13.
40- ✅ Owner password reset to a known value via `scripts/reset-admin-password.ts`
41 (account `ccantynz`, now site-admin). It failed on live because live = old passwordless code.
42- ⏳ After deploy: owner logs in at `/login` with `ccantynz` + password. Google/GitHub
43 BUTTONS will show; for them to COMPLETE, OAuth client id/secret must be set in DB at
44 `/admin/github-oauth` and `/admin/google-oauth` (owner is admin now, can do this post-login).
45- ⚠️ Deploy risk: `self-deploy.sh` runs `db:migrate`; if the live DB has migration drift it
46 may fail+rollback (safe — keeps current). Watch `/admin/deploys`.
47
2948## Phase 3 — Verification
3049- ✅ Full suite baseline (stashed): 23 fail / 2896 pass
3150- ✅ Full suite with fixes: 23 fail / 2910 pass (+14 new, **0 new failures**)
3251