pal-e-docs

Review: Update jersey and checkout pages to support session auth without token

review-696-2026-03-29 Doc

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

Section Present Notes
Type YES Feature
Lineage YES Child of #196, depends on basketball-api dual-auth, story WS-S18
Repo YES forgejo_admin/westside-landing
User Story YES As a logged-in parent / I want jersey and checkout to work with Keycloak session / so I don't need the email token link
Context YES Thorough -- explains current token-only flow, what changes, and why both modes must coexist
File Targets YES 2 files to modify, 4 files explicitly excluded. Line numbers provided.
Acceptance Criteria YES 6 concrete criteria with checkboxes
Test Expectations YES 4 manual tests + npm run build
Constraints YES Import paths, token mode isolation, URL-param-only detection
Checklist YES Standard 3-item checklist
Related YES Links to project and parent spike issue
Template score: 11/11 sections present and complete.

File Target Verification

  • src/routes/(app)/jersey/+page.svelte -- EXISTS. Line 110-111 confirmed: token = $page.url.searchParams.get('token'). Line 206 confirmed: raw fetch() to /jersey/checkout?token=....
  • src/routes/(app)/checkout/+page.svelte -- EXISTS. Line 27-28 confirmed: token extraction. Line 86 confirmed: raw fetch() to /checkout/create-session?token=....
  • src/lib/api.js -- EXISTS. apiFetch exported at line 15.
  • src/lib/keycloak.js -- EXISTS. isAuthenticated exported at line 120.
All file targets verified. Line numbers are accurate.

Traceability Check

  • Story label: story:WS-S18 -- present on board item #696.
  • Arch label: arch:westside-app -- present on board item #696.
  • Story definition: WS-S18 is defined on project-westside-basketball project page: "As a parent, I want to receive a branded email with jersey ordering link so that I can order without bringing cash." No standalone story note exists, but the project page serves as the canonical reference.
  • Type label: type:feature -- present on board item #696.
Traceability: PASS. All three labels present (story, arch, type). Story defined on project page.

Dependency Check -- BLOCKER

  • basketball-api #255 ("Add dual-auth dependency for jersey and checkout routes") -- STATE: OPEN. This ticket explicitly depends on the backend dual-auth endpoints being in place. Without them, the frontend apiFetch calls to /jersey/player-info?player_id=X and /checkout/create-session?player_id=X with Bearer auth will have no backend to hit.
  • Parent issue #196 (spike) -- OPEN. This is the parent spike, not a hard blocker.
Dependency: BLOCKED. Cannot move to todo until basketball-api #255 is merged and deployed.

Decomposition Assessment

  • Discrete changes: 2 files, same pattern applied to both (add player_id param support, swap fetch for apiFetch in session mode, add signin redirect for unauthenticated session mode).
  • Estimated scope: Well within single-agent capacity. Two files, same transformation pattern, clear acceptance criteria.
  • Risk: Low. Both modes are URL-param-detectable, changes are isolated to two pages, and the "do not touch" list is explicit.
Decomposition: PASS. This is a clean 2-file ticket with one logical change pattern.

Acceptance Criteria Quality

  • All 6 criteria are concrete, testable, and follow When/Then format.
  • Both auth modes (token and session) are covered.
  • Unauthenticated redirect case is covered.
  • Missing: no AC for what happens when ?player_id= is present but the API returns a non-200 (error handling in session mode). Minor nit -- agent can infer from existing token-mode error handling.
AC Quality: PASS with minor nit.

Recommendations

  • BLOCKER: Wait for basketball-api #255 to merge. This ticket must stay in backlog until the backend dual-auth endpoints exist. Move to todo only after #255 is merged and deployed.
  • Minor: Consider adding an AC for session-mode API error handling (e.g., "When API returns 403 in session mode, show appropriate error message"). Not a gate -- agent can derive this from existing patterns.
  • Minor: The Lineage section says "Depends on: backend dual-auth ticket (basketball-api)" but does not specify the exact issue number (#255). Adding the explicit reference would improve traceability.

Summary

The ticket is excellently scoped -- template 11/11, file targets verified with accurate line numbers, traceability labels all present, clean 2-file decomposition. The sole blocker is the open dependency on basketball-api #255. Once that backend work is merged, this ticket is ready to move to todo immediately with no further refinement needed.