43 lines
2.4 KiB
Markdown
43 lines
2.4 KiB
Markdown
# Real VK ID & API Live Smoke Test Runbook
|
|
|
|
This runbook outlines the live verification steps for testing VK ID OAuth 2.1 and authenticated VK operations without committing credentials into version control or CI.
|
|
|
|
---
|
|
|
|
## 1. Local Environment Preparation
|
|
|
|
Set in your `.env.local` file:
|
|
```bash
|
|
# VK ID Web Application Credentials
|
|
VK_APP_ID="<your_vk_app_id>"
|
|
VK_CLIENT_SECRET="<your_vk_client_secret>"
|
|
|
|
# Service Token for Public Operations
|
|
VK_SERVICE_TOKEN="<your_vk_service_token>"
|
|
|
|
# Canonical Local Configuration
|
|
APP_BASE_URL="http://localhost:3000"
|
|
VK_REDIRECT_URI="http://localhost:3000/api/auth/vk/callback"
|
|
|
|
# Cryptographic Keys (min 32 chars)
|
|
AUTH_SECRET="<random_hex_32_bytes>"
|
|
TOKEN_ENCRYPTION_KEY="<random_hex_32_bytes>"
|
|
```
|
|
|
|
---
|
|
|
|
## 2. Verification Checklist
|
|
|
|
- [ ] **A. OAuth Login Start**: Visit `/api/auth/vk/start` $\rightarrow$ Redirects to `https://id.vk.com/authorize` with PKCE `code_challenge` (S256).
|
|
- [ ] **B. OAuth Callback**: Authorize on VK screen $\rightarrow$ Redirected to `/api/auth/vk/callback`, sets HttpOnly cookie `randomayzer_session`.
|
|
- [ ] **C. Session Inspection**: Visit `/api/auth/me` $\rightarrow$ Returns authenticated user profile (name, avatar).
|
|
- [ ] **D. Public Post Preview**: Paste public VK post URL in `/giveaways/new` $\rightarrow$ Preview loads with `accessMode: "PUBLIC_SERVICE"`.
|
|
- [ ] **E. Private/Restricted Post Preview**: Paste post URL from closed group where organizer is member $\rightarrow$ Resolver falls back to `ORGANIZER_USER`.
|
|
- [ ] **F. Create Giveaway**: Submit giveaway form $\rightarrow$ Giveaway created with `organizerId: sessionUser.id`.
|
|
- [ ] **G. Import Participants**: Click Import Participants $\rightarrow$ Likes and comments fetched via `VkAuthContextResolver`.
|
|
- [ ] **H. Subscription Verification**: Run community subscription filter $\rightarrow$ Batch `groups.isMember` executed successfully.
|
|
- [ ] **I. Snapshot Locking**: Lock snapshot $\rightarrow$ Canonical hashes computed.
|
|
- [ ] **J. Deterministic Draw**: Execute draw $\rightarrow$ Winner selected via unbiased CSPRNG rejection sampling.
|
|
- [ ] **K. Public Audit**: Open `/api/giveaways/[id]/verify` in incognito window $\rightarrow$ Audit passes without authentication.
|
|
- [ ] **L. Token Expiry & Refresh**: Wait for access token expiry or simulate $\rightarrow$ Next API request automatically triggers server-side refresh without user interruption.
|
|
- [ ] **M. Logout**: Click logout $\rightarrow$ Session terminated, cookie destroyed.
|