Heartbeat + clean-exit so slow sign-ins recover instead of stranding the user#154

Merged

aspiers merged 21 commits into

mainfrom

fix/otp-resend-after-par-expiry

May 5, 2026

Commits on May 4, 2026

test(e2e): repro OAuth dead-ends when PAR dies before user completes (NO FIX)

aspiers
and
claude
committed
docs(design): PAR expiry, heartbeats, and clean-exit strategy

aspiers
and
claude
committed
feat(auth-service): keep PAR alive while user sits on OTP / recovery form

aspiers
and
claude
committed
test(e2e): cover @par-heartbeat liveness end-to-end

aspiers
and
claude
committed
feat(auth-service,pds-core): redirect to OAuth client on sign-in failure instead of stranding the user

aspiers
and
claude
committed
docs(design): record heartbeat + clean-exit landed in the design doc

aspiers
and
claude
committed
fix(demo): mark /client-metadata.json route dynamic so EPDS_CLIENT_THEME takes effect

aspiers
and
claude
committed
fix: address PR #154 review feedback (CodeRabbit + Copilot + SonarQube + Blacksmith)

aspiers
and
claude
committed
fix(demo): default EPDS_CLIENT_THEME to amber so client-branding e2e passes out of the box

aspiers
and
claude
committed
test(e2e): rename "the user can try again" to "the OTP entry boxes are visible and enabled" and assert on every box

aspiers
and
claude
committed
fix(auth-service): forward no_heartbeat through recovery Verify form too

aspiers
and
claude
committed
test(auth-service,shared): bring new heartbeat / clean-exit code to 100% coverage

aspiers
and
claude
committed
fix: address SonarCloud quality-gate findings on PR #154

aspiers
and
claude
committed
test(auth-service): unit-test buildEpdsCallbackUrl + ratchet down functions threshold

aspiers
and
claude
committed
fix: address third-round PR #154 review feedback

aspiers
and
claude
committed
test(auth-service): replace `q.get(name)!` with a typed helper to clear Sonar S6606

aspiers
and
claude
committed
refactor(shared): extract resolveStartOverHref to fix Sonar dup-block gate

aspiers
and
claude
committed
fix(auth-service): inline "Send a new code" action on expired-OTP error

aspiers
and
claude
committed
test(e2e): allow inline action button alongside the OTP error message

aspiers
and
claude
committed
fix(auth-service): don't offer Resend when it cannot complete the sign-in

aspiers
and
claude
committed
test(auth-service): extract heartbeat-router test harness + replace ReDoS-prone regex

aspiers
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Heartbeat + clean-exit so slow sign-ins recover instead of stranding the user#154

Heartbeat + clean-exit so slow sign-ins recover instead of stranding the user#154
aspiers merged 21 commits into
mainfrom
fix/otp-resend-after-par-expiry

Commits on May 4, 2026

test(e2e): repro OAuth dead-ends when PAR dies before user completes (NO FIX)

docs(design): PAR expiry, heartbeats, and clean-exit strategy

feat(auth-service): keep PAR alive while user sits on OTP / recovery form

test(e2e): cover @par-heartbeat liveness end-to-end

feat(auth-service,pds-core): redirect to OAuth client on sign-in failure instead of stranding the user

docs(design): record heartbeat + clean-exit landed in the design doc

fix(demo): mark /client-metadata.json route dynamic so EPDS_CLIENT_THEME takes effect

fix: address PR #154 review feedback (CodeRabbit + Copilot + SonarQube + Blacksmith)

fix(demo): default EPDS_CLIENT_THEME to amber so client-branding e2e passes out of the box

test(e2e): rename "the user can try again" to "the OTP entry boxes are visible and enabled" and assert on every box

fix(auth-service): forward no_heartbeat through recovery Verify form too

test(auth-service,shared): bring new heartbeat / clean-exit code to 100% coverage

fix: address SonarCloud quality-gate findings on PR #154

test(auth-service): unit-test buildEpdsCallbackUrl + ratchet down functions threshold

fix: address third-round PR #154 review feedback

test(auth-service): replace `q.get(name)!` with a typed helper to clear Sonar S6606

refactor(shared): extract resolveStartOverHref to fix Sonar dup-block gate

fix(auth-service): inline "Send a new code" action on expired-OTP error

test(e2e): allow inline action button alongside the OTP error message

fix(auth-service): don't offer Resend when it cannot complete the sign-in

test(auth-service): extract heartbeat-router test harness + replace ReDoS-prone regex