ping-mee-self-service-platform/_bmad-output/initiative-ping-mee-portal/epic-platform-and-sign-in/story-prepare-the-test-environment-plan.md

title, type, ticket, created, status, baseline_revision, route, route_source, risk, review, review_source, lenses_ran, review_loop_iteration, context

title	type	ticket	created	status	baseline_revision	route	route_source	risk	review	review_source	lenses_ran	review_loop_iteration	context
Prepare the test environment	chore	2	2026-10-15	built	840bea1cba	oneshot	auto	medium	quick	pinned	quick	0	{project-root}/_bmad-output/architecture/architecture-ping-mee-self-service-platform-2026-10-15/ARCHITECTURE-SPINE.md

Intent

Problem: Entries 4 and 5 need a test OU with a scoped service account, a dedicated OIDC application in the production authentik, the internal CA bundle, the Zoraxy route and a test mailbox. A person must create these in the production systems; none of it exists yet.

Approach: Provide a runbook, a domain-controller script that creates the test OU, service account, groups and test users with only the spine's delegated rights, and a verification script that proves the rights over LDAPS. The person runs them and writes down the values; this entry is done only when they confirm the verification passed.

Implementation Notes

Oneshot route: the output is documents and two PowerShell scripts under docs/test-environment/, no application code. The agent cannot reach the homelab from the development machine (it is on a different domain), and creating objects in the production directory is the person's action, so the scripts are not run by the agent. Syntax is checked with the PowerShell parser only.

Plan Change Log

Review Triage Log

Pass 1 (quick lens). Counts: high 1, medium 8, low 1, false 1.

#	Finding	Verdict	Route	Evidence
1	The check script can print "All checks passed." when a request throws	high	patch	A .NET exception ends only the statement when $ErrorActionPreference is Continue; Report was never called. Fixed with Stop, try/catch around steps 2, 3 and 6.
2	Generated passwords are lost if a later step fails	medium	patch	Passwords were printed only after delegation; the setup now runs inside try/finally so they always print.
3	Checks test only one of six allowed attributes	medium	patch	The check now writes and restores all six; the header states what is not covered (create, delete, reset).
4	Read rights are not limited as AD-2 says	medium	defer	AD gives authenticated users broad read by default; the fix is to soften the spine wording, which is a spec edit. README states the fact.
5	-WhatIf on a rerun reports creating existing objects	medium	patch	Existence checks are read-only and now run in both modes.
6	Any error counts as "does not exist"	low	patch	Test-Dn now catches only the identity-not-found error; direct correction.
7	CA export may miss the intermediate chain	medium	patch	README now exports the whole chain and checks it with openssl s_client.
8	Redirect URI presented as final	medium	patch	README says the sign-in ticket will use this path and where to edit it.
9	Step D.1 may mean editing the production LDAP source	medium	patch	README now checks read-only first and stops if the source does not cover the test OU.
10	Port 8000 exposure not mentioned	medium	patch	README note: bind to 127.0.0.1 or firewall to Zoraxy.
11	Ticket numbering 1.2 / 1.5 inconsistent	false	rejected	tickets.py prints these refs (epic id, entry id).

Verification

Commands:

• PowerShell parser check on both scripts -- expected: no syntax errors

Manual checks (if no CLI):

• The person runs the setup script on the domain controller and the verification script from a machine that can reach it; every check prints PASS.