fix: remediate branch review findings

This commit is contained in:
Josh Creek
2026-09-14 11:47:58 +01:00
parent 4af33709a3
commit 86f1c21e4d
38 changed files with 65833 additions and 58545 deletions
+8 -4
View File
@@ -87,10 +87,14 @@ teardown deletes the users each run creates, so repeated local runs do not need
Chromium is the only configured browser project. Playwright traces and screenshots are retained on
failure under `test-results`.
Known gap: the password-reset scenarios use an ordinary signed-in session rather than a recovery link,
because following a real recovery link currently bounces to `/signin` - the browser client in
`src/routes/+layout.ts` has no cookie `set`/`remove` method, so it cannot persist the session it parses
out of the URL. `createRecoveryLink` in `tests/bdd/support/app.ts` is ready for when that is fixed.
Password-reset scenarios follow recovery links generated by the local Supabase stack and verify both
the rejected old password and accepted replacement password. The application waits for Supabase to
confirm the recovery session before enabling the replacement form.
After sign-in, the application automatically stores a versioned, per-user read-only copy of every
Pokédex and its referenced artwork. Offline navigation opens a static viewer; all mutation and
authentication controls remain unavailable until connectivity returns. A successful sign-out removes
the user-specific snapshot and artwork caches from the device.
The current National Dex maximum is deliberately asserted as 1025. When adding a new generation,
update that expectation together with Pokémon data, the corresponding game/dex files, database seed,