randomayzer/docs/VK_MANUAL_SMOKE_TEST.md

Manual VK ID OAuth 2.1 Smoke Test Guide

This guide describes how to perform an end-to-end manual verification of VK ID login without checking secrets into git or CI.

---

1. Prerequisites & Environment Setup

Create or update your local .env.local (never commit this file):

# VK ID Application Credentials (from https://dev.vk.com/admin)
VK_APP_ID="<your_vk_app_id>"
VK_CLIENT_SECRET="<your_vk_client_secret>"

# Canonical Application URLs
APP_BASE_URL="http://localhost:3000"
VK_REDIRECT_URI="http://localhost:3000/api/auth/vk/callback"

# Security Keys
AUTH_SECRET="<32_char_random_hex_for_session>"
TOKEN_ENCRYPTION_KEY="<32_char_random_hex_for_aes_gcm>"

# Storage Driver (memory or database)
STORAGE_DRIVER="memory"

In the VK Developer Console:

• Add http://localhost:3000/api/auth/vk/callback to the list of Authorized Redirect URIs.
• Set Trusted Domain to localhost:3000.

---

2. Step-by-Step Test Procedure

Step A: Start Server

npm run dev

Step B: Initiate OAuth Login

1. Open http://localhost:3000 in your browser.
2. Click Войти через VK ID.
3. Verify redirection to https://id.vk.com/authorize with:
   • client_id matching VK_APP_ID
   • redirect_uri matching VK_REDIRECT_URI
   • code_challenge (S256 hash)
   • code_challenge_method=s256
   • state (unpredictable base64url string)

Step C: Complete Authorization

1. Authorize the application on the VK screen.
2. VK redirects to http://localhost:3000/api/auth/vk/callback?code=...&state=....
3. Check network and cookies:
   • Response sets randomayzer_session cookie (HttpOnly; SameSite=Lax).
   • Browser is redirected to / (or specified redirectTarget).
   • Header displays the logged-in user's name and avatar.

Step D: Inspect Active Session

Visit http://localhost:3000/api/auth/me:

{
  "authenticated": true,
  "user": {
    "id": "usr_...",
    "vkUserId": "...",
    "firstName": "...",
    "lastName": "...",
    "avatarUrl": "..."
  }
}

Step E: Test Giveaway Creation & Scoped Listing

1. Create a new giveaway via UI or POST /api/giveaways.
2. Visit GET /api/giveaways: observe that only giveaways created by this user are returned.
3. Open incognito window without cookie \rightarrow GET /api/giveaways returns 401 Unauthorized.

Step F: Test Logout

1. Click Выйти in header (or POST /api/auth/logout).
2. Verify randomayzer_session cookie is cleared.
3. Verify GET /api/auth/me returns {"authenticated": false}.