Syrve / iiko read-only live test report (rerun)

Historical snapshot (2026-06-19). Configuration flags listed in this report describe the old runtime model and are retained only as test evidence. Do not copy them into current deployment profiles; registered Pay-host capabilities are now always on.

Date: 2026-06-19 (UTC ~06:55) Environment: Local dev — Pay API + YARP Gateway, PostgreSQL 16 (pay_test-postgres-1) Operator: Diagnostics iteration rerun (read-only test/health on existing connection) Pay API URL: http://localhost:5010 (Gateway → API http://localhost:20001) Syrve environment: Test Connection name: Test Syrve Live (existing) Connection ID: 019ede8e-5186-7034-b0fb-9076a17f1963 IikoRestaurantConnectionId: 019ede8e-5217-786e-8cee-c0b5445b6cb4

Configuration

• RuntimeCallsEnabled: true
• DocumentSync.Enabled: true
• PaymentWriteEnabled: false
• AllowTestEnvironmentWrites: false
• AllowProductionWrites: false
• Iiko.RuntimeApiCallsEnabled: true
• Iiko.RestSessionVerification.Enabled: true
• Iiko.RestSessionVerification.Login.VerificationStatus: verified_on_test_iiko
• Iiko.SessionLifecycleVerification.Enabled: true (with verified authorize/verify/logout RPC mapping)
• CredentialMode: Password (plain secret SHA1-hashed for REST /resto/api/auth)
• Secret ref: env:TEST_SYRVE_PASSWORD (value not recorded)

Result classification

FAIL_AUTH — server-info and bridge OK; REST session authentication returns HTTP 401 with provided test credentials.

Auth diagnostics (no secrets)

Field	Value
LastCheckStatus	auth_failed
DiagnosticCode	iiko_rest_session_auth_failed
SafeMessage	Syrve/iiko rejected credentials during REST session authentication.
AuthModeAttempted	PlainPassword
SessionTransport	RestSession
HttpStatusCode	401
ServerVersion	9.6.4007.0
ServerEdition	default

Steps

Step	Endpoint / Action	Expected	Actual	Status	Notes
1	Login (Pay)	token issued	JWT issued	PASS	Pay admin auth OK
2	Bridge	linked	already linked	PASS	Existing connection from prior smoke
3	Test connection	connected or clear auth diagnostic	auth_failed, diagnostic iiko_rest_session_auth_failed, HTTP 401	FAIL_AUTH	REST session rejected credentials
4	Health	diagnostic fields	matches test diagnostics	FAIL_AUTH	Runtime + iiko session flags all enabled
5	Sync documents	not run as primary gate	skipped	SKIP	Auth must pass before meaningful sync

Comparison with first smoke (20260619-0928)

Before	After (this rerun)
Generic auth_failed	iiko_rest_session_auth_failed + HTTP 401
No auth mode / transport	PlainPassword + RestSession
Endpoint gate sometimes masked as auth_failed	session_endpoint_not_found when lifecycle/REST endpoints not verified
Missing iiko runtime flags in health	Health exposes iikoRuntimeApiCallsEnabled, iikoRestSessionVerificationEnabled, iikoSessionLifecycleVerificationEnabled

Issues found

1. Required iiko env block is larger than two flags: Pay read-only profile needs verified REST login/logout plus session lifecycle RPC endpoint mapping (see docs/docs/deployment/environment-variables.md).
2. Without verified REST login status: failure surfaces as session_endpoint_not_found (endpoint gate), not credential rejection.
3. Test credentials: login test with env secret against https://200-137-733.iiko.it returns HTTP 401 — operator must confirm password or try SYRVE_CREDENTIAL_MODE=PasswordHash if secret is a precomputed hash.
4. New connection smoke on same iiko host: bridge insert can fail on IX_iiko_restaurant_connections_NormalizedServerHost duplicate — reuse existing connection or dedupe bridge by host.

Evidence

• SyncRunId: —
• DocumentsSeen: 0 (sync not executed after auth gate)
• Artifacts: local gitignored run attempted artifacts/syrve-live-readonly/20260619-094526/ (new connection bridge blocked)

Payment write

PaymentWriteEnabled remained false. No posting/write APIs invoked. No write audit entries.

Next steps

1. Operator: confirm live iiko credentials or supply SHA1 password hash with CredentialMode=PasswordHash.
2. Re-run read-only smoke on connection 019ede8e-5186-7034-b0fb-9076a17f1963 after credential fix.
3. Next phase (separate): design test-only live write facade around IikoConnector, with owner approval and tiny test payment — do not enable PaymentWriteEnabled until approved.