[Kzoeps]

Refs TECH-683.

Problem

The TECH-683 sign-in changes in #8 (account chooser, stale remembered devices, "confirm it's you", shared-email lookups, signup consent skip, email login_hint) had little browser coverage, so regressions in the real Chrome flow would go unnoticed.

Fix

• New Playwright specs for those journeys, plus prompt=none.
• The synthetic client gains an untrusted client, and the secondary client opts into the signup consent skip; the sandbox stack trusts primary + secondary.
• Flow docs in tests/flows/ updated to match.

Test-only; the one src line allows the sandbox-only untrusted fixture client's metadata URL.

Confidence Score: 5/5

The PR appears safe to merge; no blocking issues were found.

Summary

Adds browser coverage for account choice, stale remembered devices, signup consent, email hints, silent sign-in and shared-email lookups.

• The browser suite follows shared-email sign-in through the chosen account.
• The browser suite checks that stale devices need a fresh email code.
• The browser suite follows email hints and silent OAuth sign-in.
• The browser suite distinguishes trusted signup consent skips from other signups.
• The browser suite covers account confirmation limits and password changes.

_{Reviews (2) · Last reviewed commit: "tests/browser: complete chooser sign-in ..." · Reviewed by Greptile}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 46 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: bc99afb1-6c95-41a9-bb40-d202b309d161

Commits

Reviewing files that changed from the base of the PR and between a2292ab and db2c61b.

Files selected for processing: 17

• src/features/oauth-authorization/provider.mjs
• tests/atmosphere/stacks/hypercerts-entryway.yaml
• tests/browser/account-chooser.spec.mjs
• tests/browser/account-confirm.spec.mjs
• tests/browser/oauth-remembered-device.spec.mjs
• tests/browser/oauth-sign-in-hints.spec.mjs
• tests/browser/oauth-signup-consent-skip.spec.mjs
• tests/browser/shared-email-lookups.spec.mjs
• tests/browser/support/account-password.mjs
• tests/browser/support/email-chooser-fixture.mjs
• tests/browser/support/oauth-client.mjs
• tests/browser/support/remembered-device.mjs
• tests/contracts/provider-client-fetch.test.mjs
• tests/fixtures/synthetic-client.mjs
• tests/flows/account-device-lifecycle.md
• tests/flows/otp-client-oauth.md
• tests/playwright.config.mjs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[Ashex]

Reviewed all 17 changed files against base/merge-base a5eef50, head f69f820. Standards and Spec were separate sequential passes, not independent parallel reviews. Originating TECH-683, its discussion and owning ePDS parity matrix were fetched directly from Linear.

Standards

0 retained findings. Reviewed repository architecture/custody/testing guidance and all twelve discretionary smell heuristics; no unsupported restructuring requests retained. Security review covered the exact-URL private metadata exception (redirect refusal, size/time bounds, safe-fetch fallback), fixture client trust/credentials and callback isolation, verified-email/DID selection, stale-device proof, replay and account confirmation. No new concrete security defect confirmed in this diff.

Spec

1 P2 coverage finding inline: neither chooser journey completes authorization for the first shared-email DID. The second journey's provisional first-DID selection is abandoned before consent. This leaves the explicit per-account completed-session acceptance unchecked. Full TECH-683 acceptance is not established: joining-PDS import and cross-node journeys remain outside this fixture evidence.

Documentation

Static cold-reader walkthrough checked both changed flow guides against source, prerequisites, ordered steps, trust terminology, test navigation, fixture/database-aging limitations and repeat-run isolation. No separate actionable readability defect retained. Examples were not executed. The PR description's test-only/no-runtime-change wording is imprecise: provider.mjs adds one exact managed metadata URL to the private-network fetch exception; it does not grant consent trust to that client.

SonarCloud and verification limits

PR 14 gate OK, 0 issues and 0 hotspots (complete single pages), no justified triage mutations. GitHub's successful SonarCloud check is attached to this exact head, completed 2026-11-03; MCP does not separately expose its revision. Metrics: 937 new lines, 0 new lines to cover, so the gate is not browser execution or acceptance evidence. Dependency-risk query unavailable: Advanced Security disabled.

Ran read-only git source/diff/history/status inspection and git diff --check (passed), gh metadata/comments/reviews/check-runs, Linear and Sonar MCP reads. No tests/builds/installations/application execution or sandbox lifecycle actions; no host tests. Browser, contract, formatting, architecture and strict-type gates were not independently executed; MJS has checkJs=false. Existing checks expose no first-party test execution. Current AiaB evidence is required. Source, branch and existing untracked work were preserved. Missing docs/agents/issue-tracker.md is a skill setup gap; explicitly provided Linear MCP worked.

[Kzoeps]

@Ashex re: "joining-PDS import and cross-node journeys remain outside this fixture evidence":

• Cross-node: done in the follow-up tests/profiles (TECH-683): cross OAuth sign-in across two PostgreSQL nodes #18. The two-node PostgreSQL profile now runs a full OAuth sign-in with email, code, account choice and consent alternating nodes (each step checked against the serving boot ID), plus a tampered choice refused on both nodes.
• Joining-PDS import: the import itself belongs to TECH-697, so that check has moved out of TECH-683 and into TECH-697.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud