From f82f15d86374f3c1b2d7d58bbe63e5d1ee87711c Mon Sep 17 00:00:00 2001 From: John Coffey Date: Fri, 18 Sep 2026 12:53:59 -0700 Subject: [PATCH] Contract: note the browser sign-in check after the OAuth fix --- docs/spec/contract.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/spec/contract.md b/docs/spec/contract.md index 6d59b33..5195588 100644 --- a/docs/spec/contract.md +++ b/docs/spec/contract.md @@ -248,7 +248,8 @@ interface working throughout: Verified over the API with a test account: `stalwart-webui` signs in to both callbacks and exchanges its code for a token; the same client with a foreign redirect URI, an unregistered `client_id`, and anonymous dynamic registration -are all refused (401). To roll back, set the two settings back, destroy the +are all refused (401). Signing in to `/admin` and `/account` in a browser +was confirmed working the same day. To roll back, set the two settings back, destroy the client and reload settings. This is the state C-5 and C-6 make the default. ## Acceptance tests