Define and validate restored-session setup state

2026-10-25 17:56:08 +01:00
parent 2957524af9
commit 54141e9ccb
7 changed files with 53 additions and 4 deletions
@@ -16,6 +16,11 @@ request and response envelopes; bearer values in fixtures are synthetic only.
 Twitch OAuth link and completion response envelopes are also versioned here;
 fixtures contain no real credentials or tokens.

+`GET /api/v1/auth/session` returns `authenticated: true` and the current
+`must_replace_credentials` flag from the administrator account. Restoring a
+session must not bypass first-run setup. Older servers omit this flag; clients
+must not interpret an absent flag as completed credential replacement.
+
 The shared boundary vocabulary includes the ordered permission levels in
 `contracts/v1/permissions.json` and the client/server compatibility result in
 `contracts/v1/version-negotiation.json`. Server-owned state is delivered as
@@ -49,4 +54,3 @@ only synthetic Twitch IDs and literal response templates.

 Typed command arguments use `bot-command-argument-definition.json` and remain
 literal validated data.
-