mathias
9848156cb3
Gherkin spec for connecting YouTube/Vimeo accounts and configuring optional per-provider BYO AI credentials: connections sync subscriptions, tokens/keys are stored only as secret references (never in the clear), revocation stops watching but preserves history. Encodes the secrets-by-reference and data-isolation guardrails (ADR-002, ADR-006, data-model).
44 lines
1.6 KiB
Gherkin
44 lines
1.6 KiB
Gherkin
Feature: Connect and manage video accounts
|
|
As a user
|
|
I want to connect my YouTube or Vimeo account and have my subscriptions tracked
|
|
So that Tapir watches the channels I already follow
|
|
|
|
Scenario: Connect a YouTube account
|
|
Given I have no connected video accounts
|
|
When I connect my YouTube account
|
|
Then the connection is stored with status "active"
|
|
And my refresh token is stored only as a secret reference
|
|
And my subscriptions are synced
|
|
|
|
Scenario: Connect a Vimeo account
|
|
Given I have no connected video accounts
|
|
When I connect my Vimeo account
|
|
Then the connection is stored with status "active"
|
|
And my subscriptions are synced
|
|
|
|
Scenario: Tokens are never stored in the clear
|
|
When I connect any video account
|
|
Then no OAuth token value is stored in the database
|
|
And only an opaque secret reference is stored
|
|
|
|
Scenario: Revoking a connection stops watching but keeps history
|
|
Given I have a connected YouTube account with summaries
|
|
When I revoke the connection
|
|
Then the connection status becomes "revoked"
|
|
And no new videos are watched for that connection
|
|
And my existing summaries remain readable
|
|
|
|
Scenario Outline: BYO AI credential is optional and per-provider
|
|
When I configure a BYO provider "<provider>"
|
|
Then the credential is stored only as a secret reference
|
|
And it is used only as the fallback when local AI fails
|
|
|
|
Examples:
|
|
| provider |
|
|
| anthropic |
|
|
| openai |
|
|
| gemini |
|
|
|
|
# Stage 1 (Future B): connecting a new user's account requires no code change.
|
|
# Isolation: a user can only ever see and manage their own connections.
|