- ticketService.requestDocverToken fetches withBasePath("/api/auth/token")
instead of /api/documents/token — same handler, shorter URL
- update referencing comments in authService/apiClient/config
- ticket-auth-flow test now asserts the actual URL hit, guarding a silent
revert to the old path
- versioning endpoints (/api/documents/versions*) unchanged — no short-path
equivalents exist
Co-Authored-By: Claude Code <noreply@anthropic.com>
- Removed client-side HMAC verification; server now handles all HMAC checks.
- Updated ticket processing logic to improve UX and security.
- Adjusted API request handling to return discriminated results based on HTTP status.
- Enhanced error messages for better clarity on authentication failures.
- Added unit tests for the new token endpoint to ensure compliance with updated contract.
- Cleaned up unused code and comments related to previous HMAC handling.
- Split `verifyAddinTicket` into two functions: `verifyAddinTicketHmac` (ignores expiration) and `verifyAddinTicket` (checks expiration).
- Add `hasVersionByUser` function to check if a document has been previously worked on by a user, allowing expired tickets to be accepted if the user has a history with the document.
- Update OpenAPI specification to reflect changes in ticket expiration handling.
- Introduce new scripts for installing and uninstalling the Word add-in on Windows and macOS, providing a streamlined process for sideloading the add-in.
- Enhance tests for ticket verification to cover new functionality regarding expired tickets and user history.
Rename tests/wordaddin/ticket-auth-crash-repro.test.ts to
ticket-auth-flow.test.ts and strip the temporary [DBG-r3p1] markers.
The debug session closed with an environment cause (stale Next server
holding the port / corrupted .next chunks), not a code defect, so the
suite stays as regression coverage for the signInWithTicket service
layer: single token fetch per fid, token reuse on reopen without
re-hitting /token, memory-fallback session teardown, and no uncaught
throw/rejection on every failure path (missing/invalid ticket, expired
ticket, server 401, webview without crypto.subtle).
Co-Authored-By: Claude Code <noreply@anthropic.com>
2026-10-27 11:54:29 +07:00
Renamed from tests/wordaddin/ticket-auth-crash-repro.test.ts (Browse further)
