From 72b737bd4d0bd3026aa9d1dbc710eced7d0efc5f Mon Sep 17 00:00:00 2001 From: Graham Barber Date: Tue, 14 Jul 2026 11:01:23 -0700 Subject: [PATCH] archive profile-avatars, sync auth spec with avatar requirements --- .../.openspec.yaml | 0 .../2026-07-14-profile-avatars}/design.md | 0 .../2026-07-14-profile-avatars}/proposal.md | 0 .../specs/auth/spec.md | 0 .../2026-07-14-profile-avatars}/tasks.md | 0 openspec/specs/auth/spec.md | 21 ++++++++++++++++++- 6 files changed, 20 insertions(+), 1 deletion(-) rename openspec/changes/{profile-avatars => archive/2026-07-14-profile-avatars}/.openspec.yaml (100%) rename openspec/changes/{profile-avatars => archive/2026-07-14-profile-avatars}/design.md (100%) rename openspec/changes/{profile-avatars => archive/2026-07-14-profile-avatars}/proposal.md (100%) rename openspec/changes/{profile-avatars => archive/2026-07-14-profile-avatars}/specs/auth/spec.md (100%) rename openspec/changes/{profile-avatars => archive/2026-07-14-profile-avatars}/tasks.md (100%) diff --git a/openspec/changes/profile-avatars/.openspec.yaml b/openspec/changes/archive/2026-07-14-profile-avatars/.openspec.yaml similarity index 100% rename from openspec/changes/profile-avatars/.openspec.yaml rename to openspec/changes/archive/2026-07-14-profile-avatars/.openspec.yaml diff --git a/openspec/changes/profile-avatars/design.md b/openspec/changes/archive/2026-07-14-profile-avatars/design.md similarity index 100% rename from openspec/changes/profile-avatars/design.md rename to openspec/changes/archive/2026-07-14-profile-avatars/design.md diff --git a/openspec/changes/profile-avatars/proposal.md b/openspec/changes/archive/2026-07-14-profile-avatars/proposal.md similarity index 100% rename from openspec/changes/profile-avatars/proposal.md rename to openspec/changes/archive/2026-07-14-profile-avatars/proposal.md diff --git a/openspec/changes/profile-avatars/specs/auth/spec.md b/openspec/changes/archive/2026-07-14-profile-avatars/specs/auth/spec.md similarity index 100% rename from openspec/changes/profile-avatars/specs/auth/spec.md rename to openspec/changes/archive/2026-07-14-profile-avatars/specs/auth/spec.md diff --git a/openspec/changes/profile-avatars/tasks.md b/openspec/changes/archive/2026-07-14-profile-avatars/tasks.md similarity index 100% rename from openspec/changes/profile-avatars/tasks.md rename to openspec/changes/archive/2026-07-14-profile-avatars/tasks.md diff --git a/openspec/specs/auth/spec.md b/openspec/specs/auth/spec.md index 11c4afb..aa42b75 100644 --- a/openspec/specs/auth/spec.md +++ b/openspec/specs/auth/spec.md @@ -4,7 +4,7 @@ TBD - created by archiving change bootstrap-finance-app. Update Purpose after archive. ## Requirements ### Requirement: ATProto OAuth login -The system SHALL authenticate users via AT Protocol OAuth using handle-based login. The user enters their handle (or DID); the system resolves it, performs the OAuth authorization flow (PAR, PKCE, DPoP) against the user's authorization server, and establishes an application session on success. The system SHALL request only the `atproto` scope and SHALL NOT access the user's PDS data after authentication. +The system SHALL authenticate users via AT Protocol OAuth using handle-based login. The user enters their handle (or DID); the system resolves it, performs the OAuth authorization flow (PAR, PKCE, DPoP) against the user's authorization server, and establishes an application session on success. The system SHALL request only the `atproto` scope and SHALL NOT make authenticated requests to the user's PDS after authentication. Resolving and rendering profile pictures from public ATProto profile data — without using the OAuth session or any application credential — is permitted. #### Scenario: Successful login with allowlisted handle - **WHEN** a user whose DID is in the allowlist completes the OAuth flow @@ -53,3 +53,22 @@ The system SHALL persist application sessions and OAuth client state (state stor - **WHEN** the server process restarts and a user presents a previously issued valid session cookie - **THEN** the session is honored because it is persisted in SQLite +### Requirement: Profile picture display +The system SHALL display user profile pictures resolved from public ATProto profile data, keyed by the user's current handle and fetched by the browser without application credentials. Avatars SHALL appear in the navigation user chip alongside the handle, and in categorization provenance displays in place of the handle text, where the handle SHALL be revealed in a popover on hover or keyboard focus and the DID SHALL remain available via an accessible label. When an avatar cannot be loaded or does not exist, the UI SHALL fall back to the textual handle presentation. + +#### Scenario: Nav chip shows avatar +- **WHEN** an authenticated user views any app page +- **THEN** the navigation user chip shows their avatar together with their handle + +#### Scenario: Provenance avatar with popover +- **WHEN** a user hovers over or keyboard-focuses the actor avatar in a transaction's categorization history +- **THEN** a popover reveals the actor's handle, and the DID is exposed via an accessible label + +#### Scenario: Avatar unavailable +- **WHEN** an avatar image fails to load or the actor has no profile picture +- **THEN** the UI renders the actor's handle as text, and no provenance information is lost + +#### Scenario: Server fetches no profile data +- **WHEN** pages containing avatars are rendered +- **THEN** all profile-image requests originate from the browser against public endpoints, and the application server performs no profile-data requests + -- 2.51.2