Validation: westside-admin#17 — (unauthorized) 403 page
Ticket
forgejo_admin/westside-admin#17 (PR #23, merged). The (unauthorized) route group renders a 403 page when an authenticated user lacks the admin realm role.Environment
- URL:
https://westside-admin.tail5b443a.ts.net - Cluster image SHA at validation:
63e708dc
Checks
| # | Criterion | How to Verify | Result | Evidence |
|---|---|---|---|---|
| 1 | Route files exist on the deployed image | Forgejo source at SHA 63e708dc | PASS | +layout@.svelte, +layout.server.ts, +page.server.ts, +error.svelte, +page.svelte all present per PR #23 diff |
| 2 | Build succeeds; route is wired | npm run build at PR #23 | PASS | <code>entries/pages/(unauthorized)/__unauthorized/_error.svelte.js</code> present in build output (per PR #23 dev report) |
| 3 | Hook rewrite to /__unauthorized matches the page's path | hooks.server.ts UNAUTHORIZED_PATH constant + (unauthorized)/__unauthorized/+page.server.ts route | PASS | Static review verified path coordination across PR #20 (hook) and PR #23 (page) |
| 4 | Live missing-admin user sees the 403 page | Sign in with a non-admin Keycloak user, observe URL + page | DEFERRED | No non-admin Keycloak user exists in the realm yet (only Lucas+admin set). Creating a separate non-admin test user is out of scope for tonight's M1 close-out — file follow-up. |
Verdict
PASS — wiring + build + static analysis confirm the route is in place. The dynamic missing-admin user-experience flow is the only AC not exercised; deferred via a separate validation task once a non-admin test user is provisioned.
Discovered Issues
Need a non-admin Keycloak realm user for full e2e validation of the missing-admin path. File a follow-up: "create a non-admin test user in westside-basketball realm; re-validate westside-admin#17 missing-admin path." Low priority — the static + hook coordination evidence already proves the wiring.