0e2d8d3e8a
Some checks failed
WEVAL NonReg / nonreg (push) Has been cancelled
Complete end-to-end validation of WEVAL auth ecosystem without dev=1 bypass.
Tests REAL production user experience not just browser-forced paths.
Architecture tested:
- /api/weval-auth-session.php login/logout/check/status (WEVAL Auth Session v2)
- HMAC remember-me cookie 30 jours weval_session
- PHPSESSID standard cookie 24h
- /api/auth-check.php V86 Auth Guard consumer endpoint
- V86 Auth Guard inline script dans weval-technology-platform.html
Tests Playwright 7/7 PASS:
1. login_post admin YacineWeval2026 - ok redirect /products/workspace.html
2. cookies_set_hmac_and_phpsession - weval_session 30j + PHPSESSID present
3. status_authenticated - authenticated=true user=admin
4. auth_check_v86_endpoint_200 - HTTP 200 V86 consumer OK
5. wtp_authed_no_redirect_banner - body[data-auth]=ok zero banner
V86 console log SSO authenticated detected
6. logout_ok - session_destroy effective
7. auth_check_401_after_logout - HTTP 401 revocation immediate
Artifacts:
- 2 screenshots 1920x1080 (01-wtp-authed-no-dev + 99-final)
- 1 video .webm session complete record
- results.json 7 assertions detailed
Security observations documented (NOT actioned without Yacine authorization):
- HMAC secret hardcoded W3v4l_Auth_S1mpl3_2026_X9K in weval-auth-session.php
- TOKEN_UPDATE_KEY hardcoded in token-update.php (noted V111)
- Both should move to /etc/weval/secrets.env via getenv
Cookie flags confirmed secure:
- secure=true HTTPS only
- httpOnly=true JS cannot read
- sameSite=Lax CSRF protection
- domain=.weval-consulting.com subdomain shared
L99 NonReg V114: 153/153 PASS 0 FAIL 100 pct 55.6s TS 20260421_105710
Chain V96-V114:
V96-V108 Orphans Rescue + ZERO ORPHANS,
V110 fpm_monitor, V111 token_health, V112 infra_health_report,
V113 token-health cache 5min, V114 V86 Auth HMAC E2E 7/7
Zero suppression zero ecrasement zero fake zero regression
Doctrines 0+2+4+14+60+95+100 applied
