frontend-go-live-check 1.0.0 → 1.2.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 1.1.0
+
+- **Sign-in with Google, Microsoft, Apple, UAE PASS and any OpenID Connect server.**
+  - `frontend-go-live-check login`: sign in once by hand; the session is saved (`go-live-check.session.json`, ignored by Git) and reused.
+  - `"method": "token"`: a test token (header, cookie, localStorage or sessionStorage).
+  - `ciLogin`: a separate sign-in for pipelines.
+  - Expired sessions are reported, including when the app's API answers 401.
+- **Every sign-in button is found and checked, whatever it says.** It is found by its text, label, logo, where a click leads (the provider is never contacted), the provider's script, or the libraries in the code. The checks: HTTPS, `state`, PKCE instead of the token flow, the return address, the UAE PASS environment (staging or production) and `acr_values`, and what users see after a cancelled sign-in.
+- The report, the PDF and the Word file list every sign-in method found. `doctor` shows how the tool will sign in and when the saved session expires.
+- The README has a new *Sign-in* section.
+
 ## 1.0.0
 
 First release.
@@ -17,4 +28,5 @@ First release.
 - Every request the app makes: slow, large, repeated, too many, uncompressed, not cached, sensitive values in addresses.
 - Lag: how long scripts freeze each page; a light load test (several users at once, GET only).
 - Design consistency: web fonts that fail, too many fonts and sizes; broken in-page anchors; form field types.
+- Evidence pictures in the HTML report too; npm README with pictures; GitLab pipeline that publishes to npm with trusted publishing.
 - `frontend-go-live-check ci github|gitlab|azure|bitbucket|jenkins`: a pipeline that approves or rejects the merge.