- TestPhase8RedOAuthClientCommand drives the not-implemented command
stub's create path and fails with PHASE8_RED:oauth-command until the
real create/update/list behavior lands (D-19)
- oauth_client.go stub declares the exact PHP-parity flag/argument
contract (name, --redirect-uri=*, --scope=*, --auth-method,
--client-id, --list) so the RED test exercises the real command shape
- user/console_test.go's emailArg gains Flags(string) []string: bonfire's
Input interface (summercms.go) grew this method for D-19's repeatable
flags, and emailArg must satisfy it to keep building
Unit tests now expect Winter 500 HTML when the target user is already
active, and the inventory assertions match 169/22/147.
Co-authored-by: Cursor <cursoragent@cursor.com>
Match PHP payloads, already-activated Winter 500 HTML, and direct-DB
seeding so the corpus can flip those routes to ported without onboarding.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register through logout is one in-process flow, and token mint accepts read, write, ai, and the two-scope combination.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reset and activation codes expire on a TTL, and a missing issued-at still accepts a cutover code. Forgot-password always returns the same 200 body.
Co-authored-by: Cursor <cursoragent@cursor.com>
Registration follows activate_mode and hides a disabled or throttled cause in production. Fonoteka adds organisation fields through GetApiArrayEvent.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire the user API session loop to the JWT blacklist and a pre-password throttle gate so a logged-out token cannot be fetched again.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Verify inv_ tokens against ApiToken hash, expiry, revocation, last-used
- InvScope writes PHP TokenScope 401/403 bodies and gates on HasScope
- Register jwt and inv_token on the shared bouncer.Registry at plugin Boot
- Move models, classes, controllers, middleware, and updates into subpackages
- Add self-registering models/updates/classes registries so later plans add files
- Keep the genres route and shipped migration SQL unchanged
golem15.user registers jwt.auth, golem15.fonoteka mounts GET /_fonoteka/api/v1/genres
through that guard, and a smoke test reads the 15 migrated rows with a test-only token.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add compiled golem15.user and golem15.fonoteka plugins, squash schema
to the genre slice tables, and seed the 15 canonical genres on ICU pl-PL.
Co-authored-by: Cursor <cursoragent@cursor.com>
