docs(android): trusted-devices/MFA live smoke-test screenshots #34

wtclaude · 2026-07-22T06:24:22Z

wtclaude commented

2026-07-22 06:24:22 +00:00

What & why

Adds docs/android/screenshots/ with captures from a live end-to-end smoke test of the Android trusted-device + recovery-code feature (app PR RunicGateway/Android-app#23), run against the local Node server + uomysticmoon MariaDB on an API 36 emulator. A README maps each image and records the verified flows.

Five screenshots:

Login 401 { totpRequired } step — authentication-code field, "Use a recovery code instead" toggle, "Trust this device" checkbox (ticked).
Account Security section (Trusted devices / Recovery codes).
Trusted Devices screen listing this device (device_name sent at login) with revoke / trust / untrust-all.
Recovery Codes show-once display after a password-stepped regenerate (copy / share).
Recovery-code login.

Verified flows (all passed)

2FA login + "Trust this device" → 200, token stored (device trusted).
Trust survives logout — a password-only re-login skipped TOTP entirely (clean 200, no preceding 401). This is the headline behaviour from PLAN §4.1.1.
Untrust-all cleared the server rows and the local token — the next password-only login correctly required TOTP again (401).
Recovery codes: generate (password step-up, shown once) + a successful recovery-code login (mobile login via recovery code → 200).

How it was tested

The screenshots are the test record; captured live via adb against the running server. Markdown README proofread.

Checklist

I have read CONTRIBUTING.md.
The change builds and existing checks pass locally.
I have added or updated docs where it makes sense.
My commits are reasonably scoped with clear messages.

AI-assisted contributions (required)

AI tools were used. Tool(s): Claude Code (Opus 4.8). I have reviewed and understand every change, and take responsibility for it. AI-authored commits carry a Co-Authored-By trailer.

License

I agree my contribution is licensed under this project's license (GNU GPL v3.0 or later).

🤖 Generated with Claude Code

https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

## What & why Adds `docs/android/screenshots/` with captures from a **live end-to-end smoke test** of the Android trusted-device + recovery-code feature (app PR RunicGateway/Android-app#23), run against the local Node server + `uomysticmoon` MariaDB on an API 36 emulator. A README maps each image and records the verified flows. Five screenshots: 1. Login `401 { totpRequired }` step — authentication-code field, "Use a recovery code instead" toggle, "Trust this device" checkbox (ticked). 2. Account **Security** section (Trusted devices / Recovery codes). 3. **Trusted Devices** screen listing this device (`device_name` sent at login) with revoke / trust / untrust-all. 4. **Recovery Codes** show-once display after a password-stepped regenerate (copy / share). 5. **Recovery-code login**. ## Verified flows (all passed) - 2FA login + "Trust this device" → `200`, token stored (`device trusted`). - **Trust survives logout** — a password-only re-login skipped TOTP entirely (clean `200`, no preceding `401`). This is the headline behaviour from PLAN §4.1.1. - Untrust-all cleared the server rows **and** the local token — the next password-only login correctly required TOTP again (`401`). - Recovery codes: generate (password step-up, shown once) + a successful recovery-code login (`mobile login via recovery code` → `200`). ## How it was tested The screenshots *are* the test record; captured live via adb against the running server. Markdown README proofread. ## Checklist - [x] I have read CONTRIBUTING.md. - [x] The change builds and existing checks pass locally. - [x] I have added or updated docs where it makes sense. - [x] My commits are reasonably scoped with clear messages. ## AI-assisted contributions (required) - [x] AI tools were used. Tool(s): `Claude Code (Opus 4.8)`. I have reviewed and understand every change, and take responsibility for it. AI-authored commits carry a `Co-Authored-By` trailer. ## License - [x] I agree my contribution is licensed under this project's license (**GNU GPL v3.0 or later**). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

wtclaude added 1 commit 2026-07-22 06:24:24 +00:00

@ e34284561f

docs(android): add trusted-devices/MFA live smoke-test screenshots

Live end-to-end smoke test of the Android trusted-device + recovery-code
feature (app PR RunicGateway/Android-app#23) against the local server +
MariaDB on an API 36 emulator. Adds android/screenshots/ with five
captures (login trust step, account Security section, Trusted Devices,
recovery-codes show-once, recovery-code login) and a README documenting
the verified flows — including that trust survives logout (password-only
re-login skipped TOTP) and untrust-all clears the local token.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr
@

whitlocktech approved these changes 2026-07-22 06:27:30 +00:00

whitlocktech merged commit 7d09475c53 into main

2026-07-22 06:27:39 +00:00

whitlocktech deleted branch docs/trusted-devices-screenshots

2026-07-22 06:27:40 +00:00

whitlocktech referenced this issue from a commit

2026-07-22 06:27:41 +00:00

Merge pull request 'docs(android): trusted-devices/MFA live smoke-test screenshots' (#34) from docs/trusted-devices-screenshots into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/docs#34