Sprint D: hardening e2e, /search redirect, scroll restore fix.

Admin review smoke tests, CWV budgets, unified gallery at /, and explicit body unlock when closing the photo modal so scroll position restores.
2026-08-04 22:17:43 -04:00
parent 071bda243b
commit 26faf33a95
15 changed files with 265 additions and 342 deletions
@@ -22,6 +22,7 @@ Never commit lockfile URLs that embed tokens.
 | Variable | Required | Purpose |
 |----------|----------|---------|
 | `PLAYKIT_BASE_URL` | yes (default in `env-defaults.json`) | Public viewer host |
+| `PLAYKIT_ADMIN_BASE_URL` | no (default `punimtagadmindev.levkin.ca`) | FastAPI admin UI for `admin.review-pages.spec.ts` |
 | `PLAYKIT_API_BASE_URL` | no | LAN API (see `env-defaults.json`) |
 | `E2E_ADMIN_EMAIL` | for auth specs | Prefer `e2e@levkine.ca` — **not** `admin@admin.com` |
 | `E2E_ADMIN_PASSWORD` | for auth specs | Dedicated e2e password (Vaultwarden / Infisical) |
@@ -65,6 +66,10 @@ not enabled in this CI job yet.
 19. PROD smoke (`prod.smoke.spec.ts`, opt-in via `PROD_BASE_URL`): `/api/health` + login page load on the public PROD host — dormant until the PROD LXC exists (see ROADMAP)
 20. Manage Users real CRUD + causal cross-session effect (`admin.manage-users-actions.spec.ts`): admin creates/edits/deletes a user through the actual panel (not just open/close), and deactivating a user via the UI immediately revokes that user's *already open* NextAuth session (jwt callback re-checks `isActive`, Kolby #57 fix) — every run creates a disposable `e2e-manage-test-*` account and deletes it in a `finally`, never touching the shared punimtagdev/MirrorMatch DB's real accounts
 21. Timing budgets (`timing-budgets.ts`): every `timings.measure()` call site is followed by `expectWithinBudget()` against a shared `BUDGET_MS` bucket — a step getting order-of-magnitude slower reds the test, not just a Pushgateway sample nobody's watching
+22. Gallery scroll restore (`viewer.scroll-restore.spec.ts`): scroll down, open `?photo=` modal, Escape closes and restores scroll Y
+23. Core Web Vitals budget (`viewer.web-vitals.spec.ts`, `web-vitals-budgets.ts`): LCP + CLS gates on anonymous home gallery load
+24. Admin review pages smoke (`admin.review-pages.spec.ts`): FastAPI admin login on `punimtagadmindev` → Identify, Auto-Match, Approve Identified load
+25. `/search` legacy URLs redirect to `/` with query string preserved (incl. `peopleMode` / `tagsMode`)

 See repo root [`ROADMAP.md`](../ROADMAP.md) for gaps and next steps.