Föreningskiosk

Avstämning 2026-09-08: Återstår. Registrerad köpares historik saknas. Underlag: docs/issue-audit-2026-09-08.md. Ingen ny regression eller produktionsdriftsättning i denna avstämning. Statusfält oförändrat.

Startad avgränsning 2026-09-26. Implementationen omfattar /account/purchases och detaljvy för den inloggade aktiva användarens egna inskickade köpunderlag, med förening, datum, totalsumma och historiska artikelögonblick samt responsiv/tillgänglig presentation och länk från Mitt konto. Exkluderat: gästköp, utkast/avbrutna köp, person-/träningsfält, export, betalningsintegration och administrativ åtkomst. Definition of Done: egen lista/detalj fungerar; annan användares eller fel tenantkopplad post ger 404; privat data exponeras inte; desktop/mobil och no-store verifieras; leverans sker separat efter godkännande.

Implementation klar lokalt för registrerad användares köphistorik: /account/purchases och detaljvy visar endast inloggad användares inskickade köp över föreningar, med historiska artikelvärden, datum och summa. Utkast, avbrutna köp och annan användares köp exponeras inte; främmande/ogiltigt köp ger 404. Privata kontakt-, person- och submission-fält ingår inte i läsmodellen. Verifierat: nätverkslös foundation 99 tester/838 assertions, isolerad MariaDB 3 tester/45 assertions, Vite production build, PHP/JS syntax samt Playwright desktop 1280 px, mobil 390/320 px och 320 px utan JavaScript. Navigation, paginering, tomt läge, 404 och frånvaro av horisontell overflow passerar. Återstår: godkänd commit/push, CI, separat produktionsleverans och manuell acceptans.

Implementation committed on main as 59a6b72 (Add purchase history for registered users). Commit contains the 14 scoped application and test files only. Push, CI, delivery and manual production verification remain.

Commit 59a6b72 pushed to main. Server-side CI passed for exact revision 59a6b72be9d7be65312816ba32c3ec5c8e0ba5d4 and produced a release artifact. Local main and origin/main are synchronized. Next workflow step is verification before production delivery.

Verification delivery support prepared locally. Exact CI artifact 59a6b72 SHA-256 e3806d2786c73717bd9f2ed612f030a61db70feab0cb390471164bcb7989b869 was fetched read-only and matched the purchase-history model, controller, buyer views, normalized routes and built responsive CSS. Delivery preflight pins active release 37e30ce, new release 59a6b72, protected vhost, production flags, active temporary test access, verified MariaDB TLS, buyer-only routes, ownership/minimized fields and built assets. Activation retains database/configuration/test data and automatically rolls back the release link on failed checks. Python delivery regression: 24 tests passed across new and inherited delivery contracts; PHP syntax passed. Support commit/push and production prepare/apply remain.

Production delivery support committed and pushed as d6035a6; server CI passed for exact support revision d6035a69289ad4da0142816fcf467b96d5267971. Self-contained delivery package uploaded to Remembrance at /home/bj/.local/share/foreningskiosk-purchase-history-133-d6035a6.tar.gz with SHA-256 807f278f47eefe37453de564578b382bdc1135aaf186985ec0cf65121cd37849. Package embeds the verified application release 59a6b72 with SHA-256 e3806d2786c73717bd9f2ed612f030a61db70feab0cb390471164bcb7989b869. No production activation performed.

Webserver package verification passed: outer archive SHA-256 matched 807f278f47eefe37453de564578b382bdc1135aaf186985ec0cf65121cd37849; support revision d6035a6 and application revision 59a6b72 matched; 5 delivery tests passed; PHP preflight syntax passed; embedded release.tar.gz checksum passed. No inactive release preparation or production activation performed yet.

Webserver inactive preparation passed for exact app release 59a6b72be9d7be65312816ba32c3ec5c8e0ba5d4. Release installation, active temporary test access, production security, verified database TLS, routes, buyer ownership scope, views, built CSS, Apache syntax and PHP-FPM configuration all passed. No current symlink, Apache configuration, credentials, database, feature flags, services, backup timers or test data were changed. Production activation remains separately gated.

Production activation passed for exact release 59a6b72be9d7be65312816ba32c3ec5c8e0ba5d4. Effective production configuration, verified database TLS, purchase-history routes, buyer ownership scope, views, built CSS, Apache/PHP syntax, atomic release switch, PHP-FPM reload, HTTPS authentication behavior and protected paths passed. Anonymous purchase-history requests redirected to login. No database, configuration, feature flag, personal data, purchase or backup timer changed. Manual authenticated buyer verification of own list/detail and cross-account denial remains.

Manual production acceptance passed with testuser-777: account purchase history empty state behaved correctly before a purchase; a completed account-linked test purchase then appeared in the cross-organization list; purchase detail showed the expected organization, date, historical article data, quantities and total; another account's purchase URL returned 404. Desktop/mobile behavior was accepted. All agreed acceptance criteria are met.