[Phantom8420]

Summary

• Auth: session moves from a JS-readable token to an httpOnly cookie with an anti-CSRF header; sign-in and ownership challenges are single use (replay blocked).
• On-chain anchoring: with a relayer configured, mint and every lifecycle event are mirrored to the NFT and registry contracts first, so duplicates, out-of-order steps and revoked products are refused by the chain (502, nothing recorded off-chain). Token id is derived from GTIN + serial and optional in the API and UI.
• Verification: npm run smoke:chain deploys to a local Hardhat node and drives a full product life, reading the contracts directly. Runs in CI.
• Tests: Playwright e2e (demo journey, mint, unknown token) plus axe checks on six pages; randomized invariant tests for the registry; 42 backend, 16 frontend, 18 contract tests.
• Frontend: route and QR-scanner code splitting (initial bundle 130 kB gzip, scanner loads on demand), skip link, reduced-motion support; axe found and I fixed low contrast, unlabelled links and QR images.
• Ops: structured JSON request logs with request ids, richer /api/health, advisory Slither job, a deploy workflow that skips itself until Vercel secrets exist, and a duplicate-key fix in docker-compose.

Notes

• The login response no longer contains a token; scripts can use a cookie jar or an existing bearer.
• The nonce store is in memory (documented); multi-instance needs a shared store.
• Docker build is still unverified locally (daemon off).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
authen-tick	Ready	Preview	Oct 6, 2026 7:48am UTC