patrickandClaude Sonnet 5
45ecd69ee9
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (pull_request) Canceled after 0s
CI / Web (dms-browser) (push) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
CI / Web (pdf-viewer) (push) Canceled after 0s
CI / Web (shl) (push) Canceled after 0s
Supply-Chain-Scan (Go) / govulncheck (push) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (pull_request) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (pull_request) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (pull_request) Canceled after 0s
CI / Web (dms-browser) (pull_request) Canceled after 0s
CI / Web (pdf-viewer) (pull_request) Canceled after 0s
CI / Web (shl) (pull_request) Canceled after 0s
Core-Schnittstellen-Vertragstests / contract-tests (pull_request) Canceled after 0s
Supply-Chain-Scan (Go) / govulncheck (pull_request) Canceled after 0s
Supply-Chain-Scan (npm) / npm-audit (pull_request) Canceled after 0s
Core-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
RBAC-Rollenhierarchie-Pflichtgate / rbac-policy-invariant (pull_request) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (pull_request) Canceled after 0s
Backend (kleinstmoeglich, wie im Ticket vorgesehen): - internal/auth: TokenIssuer.IssueWithTTL, LoginService.LoginWithTTL (additiv, bestehende Issue/Login unveraendert) - internal/totp: LoginWithTOTPTTL (durchlaeuft denselben 2FA-Ablauf) - cmd/account-api: neue Route POST /auth/mobile-login (JSON-Token statt Cookie, 90 Tage TTL statt 30 Minuten) Android-App (android/dms-capture, Kotlin, Gradle-Projekt): - CameraX-Erfassung mit Live-Vorschau, erneuter Aufnahme, Mehrseiten- Sammlung (AC2) - Ruft ausschliesslich die bestehende DOC-01-Upload-API auf, kein neuer Backend-Uploadpfad (AC3) -- echter Architektur-Fund dabei: dms-app erwartet ein audience-gebundenes Modul-Token (aud=dms), kein rohes Sitzungstoken; App tauscht ueber den bereits bestehenden Endpunkt POST /auth/module-token (Cookie-Header), dokumentiert im Pruefprotokoll - Room-basierte Offline-Warteschlange mit sichtbarem Status, WorkManager fuer automatische Nachreichung ohne Nutzeraktion (AC4) - Verstaendliche Fehlermeldungen bei Groessen-/Typ-Ablehnung statt nur Fehlercode (AC5) - Internes APK, kein Play-Store-Zwang (AC6) Real getestet: Ende-zu-Ende-Auth-Kette (Login -> Modul-Token -> Bearer gegen echten dms-app) auf Host 204, 13/13 Kotlin-Unit-Tests gruen, echter APK-Build auf Host 236 (Android-SDK dort vorhanden, kein Install auf der Entwicklungsmaschine, Gradle projektlokal nachgezogen statt System-Install). Offen (Pruefprotokoll): Kamera-/Offline-/Smoke-Install-Pruefungen brauchen einen Android-Emulator; kein System-Image auf Host 236 installiert, Nachinstallation bewusst nicht ohne Rueckfrage vorgenommen. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>