docs(32.1-04): complete vue-oauth-layer /connect plan
This commit is contained in:
@@ -1621,7 +1621,7 @@ Plans:
|
||||
**Goal:** As an application whose plugins declare their own member token scopes, I want an agent connected to `/mcp` over OAuth to get the same tools, attribution and revocation as one using a personal token, so that OAuth sign-in can be switched on in production. A consuming app's agent-access work found three gaps (its D-36, D-37 and D-38); all three are additive and ship as patch releases of the framework (0.5.x) and `sm-oauthserver-plugin`.
|
||||
**Requirements**: TBD
|
||||
**Depends on:** Phase 19.4 (OIDC provider on wristband), Phase 19.7 (generic MCP module)
|
||||
**Plans:** 3/5 plans executed
|
||||
**Plans:** 4/5 plans executed
|
||||
|
||||
**Success Criteria** (what must be TRUE):
|
||||
1. Scopes a plugin declares through `pact.HasFrontendTokenScopes` can be requested, consented to and granted over MCP OAuth: the wristband metadata and authorize allow-list and pier's protected-resource scopes include them, so a tool route behind `user.scope:<declared>` lists and runs for an OAuth agent granted that scope. Today the list is fixed to `read`, `write`, `ai`, `offline_access` (and `backend`).
|
||||
@@ -1640,7 +1640,7 @@ Plans:
|
||||
- [x] 32.1-03-PLAN.md — sm-oauthserver-plugin: consent replace, revoke, backfill
|
||||
|
||||
**Wave 4** *(blocked on Wave 3 completion)*
|
||||
- [ ] 32.1-04-PLAN.md — vue-oauth-layer /connect checkboxes
|
||||
- [x] 32.1-04-PLAN.md — vue-oauth-layer /connect checkboxes
|
||||
|
||||
**Wave 5** *(blocked on Wave 4 completion)*
|
||||
- [ ] 32.1-05-PLAN.md — Unit tests, then the release checkpoint
|
||||
|
||||
@@ -0,0 +1,185 @@
|
||||
---
|
||||
phase: 32.1-mcp-oauth-for-plugin-apps-declared-scopes-mcp-subject-on-con
|
||||
plan: 04
|
||||
subsystem: auth
|
||||
tags: [nuxt, oauth, mcp, consent, vue-oauth-layer]
|
||||
|
||||
requires:
|
||||
- phase: 32.1-03
|
||||
provides: MCP consent show JSON with scope_details, logo_url, consent_required, and 409 backend_link_changed
|
||||
provides:
|
||||
- "Public Nuxt layer vue-oauth-layer with /connect for MCP redirect consent"
|
||||
- "allowBody keeps locked read, omits scopes when consent_required is false, and sends backend_admin.login only with the admin line"
|
||||
- "A 409 backend_link_changed refetches the show; the layer is not tagged or pushed"
|
||||
affects: [32.1-05]
|
||||
|
||||
actuals:
|
||||
tokens: 65479
|
||||
tasks: 2
|
||||
commits: 0
|
||||
plan_head_before: 23238ccd47b615529948d4f094713928272a308a
|
||||
plan_head_after: 23238ccd47b615529948d4f094713928272a308a
|
||||
|
||||
tech-stack:
|
||||
added: []
|
||||
patterns:
|
||||
- "vue-oauth-layer copies the vue-menu-layer skeleton: fileURLToPath paths, nuxt 4.4.8 peer, node --test, no extra runtime dependency"
|
||||
- "The page and the tests import app/utils/connectConsent.ts; labels are text interpolations"
|
||||
|
||||
key-files:
|
||||
created:
|
||||
- ../vue-oauth-layer/package.json
|
||||
- ../vue-oauth-layer/nuxt.config.ts
|
||||
- ../vue-oauth-layer/app/pages/connect.vue
|
||||
- ../vue-oauth-layer/app/utils/connectConsent.ts
|
||||
- ../vue-oauth-layer/tests/connect.test.ts
|
||||
- ../vue-oauth-layer/README.md
|
||||
- ../vue-oauth-layer/.playground/nuxt.config.ts
|
||||
modified: []
|
||||
|
||||
key-decisions:
|
||||
- "The new repo's branch is main, matching the other Nuxt layers. It has no remote and no tag."
|
||||
- "A 409 backend_link_changed renders the show again and does not post immediately, so a stored consent cannot loop."
|
||||
- "backend_admin.login is sent when the admin line applies and backend stays in the grant, including when scopes are omitted because consent_required is false."
|
||||
|
||||
patterns-established:
|
||||
- "Pattern: scopeBoxes starts every scope_details entry checked and copies locked. allowBody drops cleared names except locked ones."
|
||||
- "Pattern: loginPath defaults to /login and is only the 401 handoff. The layer does not sign the user in."
|
||||
|
||||
requirements-completed: []
|
||||
|
||||
coverage:
|
||||
- id: D1
|
||||
description: "/connect maps the MCP consent show JSON to checkboxes, keeps locked read in the allow POST, and renders client name, labels, descriptions, and the admin name as text."
|
||||
verification:
|
||||
- kind: unit
|
||||
ref: vue-oauth-layer/tests/connect.test.ts
|
||||
status: pass
|
||||
human_judgment: false
|
||||
- id: D2
|
||||
description: "The admin line, logo alt text, 409 refetch, and an immediate allow when consent_required is false are implemented and covered. The README shows the git pin shape and says the tag does not exist yet."
|
||||
verification:
|
||||
- kind: unit
|
||||
ref: vue-oauth-layer/tests/connect.test.ts
|
||||
status: pass
|
||||
- kind: other
|
||||
ref: README.md install line and empty git tag list
|
||||
status: pass
|
||||
human_judgment: false
|
||||
|
||||
duration: 14min
|
||||
completed: 2026-10-28
|
||||
status: complete
|
||||
---
|
||||
|
||||
# Phase 32.1 Plan 04: vue-oauth-layer /connect Summary
|
||||
|
||||
**A new Nuxt layer renders MCP redirect consent at /connect, locks read in the UI, and refetches when the administrator link changes**
|
||||
|
||||
## Performance
|
||||
|
||||
- **Duration:** 14 min
|
||||
- **Started:** 2026-10-28T14:45:32Z
|
||||
- **Completed:** 2026-10-28T14:59:10Z
|
||||
- **Tasks:** 2
|
||||
- **Files modified:** 13
|
||||
|
||||
`actuals.tokens` is chars/4 of `git log -p` in vue-oauth-layer (261918 / 4). The pnpm lockfile is most of that diff. summercms.go has no production commits in the measured range.
|
||||
|
||||
## Accomplishments
|
||||
|
||||
- Created `/media/nvme/dev/golem15/summercms.io/summercms/vue-oauth-layer` with `git init -b main`. No remote, no tag, no push. Peer dependency is nuxt 4.4.8. Dev dependencies are nuxt 4.4.8, typescript 5.9.3, and vue 3.5.35. There is no other runtime dependency.
|
||||
- `app/utils/connectConsent.ts` maps show JSON to checkboxes and the POST body. Locked `read` stays in `scopes` when it was requested. `consent_required: false` omits `scopes`. `shouldRefetch` is true only for HTTP 409 and `backend_link_changed`.
|
||||
- `app/pages/connect.vue` imports that module, reads `?request=`, and calls `GET` and `POST /oauth/mcp/requests/{request}` on the same origin with credentials included. It does not add a Nitro proxy. Client name, scope label, scope description, logo alt, and the administrator name are text. The page source does not contain `v-html`. A 401 navigates to the `loginPath` prop, default `/login`.
|
||||
- When `backend_admin` is set and `backend` was requested, the page shows "also act as admin" and the administrator name, and the allow body sends `backend_admin.login` unless `backend` was cleared. A non-empty `logo_url` is an image. When `consent_required` is false the page posts allow immediately and does not render checkboxes. A 409 `backend_link_changed` loads the show again and renders it instead of posting again.
|
||||
- `pnpm test` passes: 8 tests, 0 failed.
|
||||
|
||||
## Task Commits
|
||||
|
||||
Layer repo `vue-oauth-layer` on `main`. summercms.go had no commits in the measured range `23238ccd47b615529948d4f094713928272a308a..HEAD` at summary time (`commits: 0`).
|
||||
|
||||
1. **Task 1: Tracer: show JSON maps to a locked-read allow body** - `02c466e` (feat)
|
||||
2. **Task 2: Finish /connect and the layer README** - `37c1e12` (feat)
|
||||
3. **Rule 1 follow-up: empty redirect leaves the page ready** - `7f805b3` (fix)
|
||||
|
||||
**Plan metadata:** this summary and the roadmap progress update, committed in summercms.go after this file was written.
|
||||
|
||||
## Files Created/Modified
|
||||
|
||||
- `../vue-oauth-layer/package.json` - layer package, test script, pinned Nuxt peer
|
||||
- `../vue-oauth-layer/nuxt.config.ts` - absolute css path via fileURLToPath, no modules
|
||||
- `../vue-oauth-layer/app/utils/connectConsent.ts` - scopeBoxes, allowBody, denyBody, backendAdminLogin, shouldRefetch
|
||||
- `../vue-oauth-layer/app/pages/connect.vue` - /connect page
|
||||
- `../vue-oauth-layer/app/assets/css/connect.css` - neutral tokens for the page
|
||||
- `../vue-oauth-layer/tests/connect.test.ts` - node:test mapping and a source check against raw HTML
|
||||
- `../vue-oauth-layer/README.md` - install shape, extends, loginPath, and the unpushed tag
|
||||
- `../vue-oauth-layer/.playground/nuxt.config.ts` - playground extends the layer by an absolute path
|
||||
- `../vue-oauth-layer/tsconfig.json`, `.gitignore`, `.nvmrc`, `pnpm-workspace.yaml`, `pnpm-lock.yaml` - menu-layer skeleton so install and Vite resolve inside the layer
|
||||
|
||||
## Decisions Made
|
||||
|
||||
- The repository branch is `main`, the same branch the sibling layers use. `git init` alone would have created `master` because `init.defaultBranch` is master. The default-branch guard reports `main` as protected: this repo has no `.planning/config.json`, so `git.allow_default_branch_commits` is not set. The commits are on `main` anyway. This is a new repository whose only branch is the one the plan publishes. It is not a commit on summercms.go's default branch. No planning config was added to the layer to silence the guard.
|
||||
- After `409 backend_link_changed` the page fetches the show and renders it. It does not post that show immediately. An immediate allow would send the same decision again and loop while `consent_required` stays false.
|
||||
- `backend_admin` is omitted when the user clears `backend`, because the server only checks that field when `backend` is in the grant. When `consent_required` is false, scopes are omitted and `backend_admin.login` is still sent if the admin line applies, so the full stored grant does not 409 on the linked administrator.
|
||||
- A decision response with an empty `redirect_uri` sets the page back to ready instead of leaving it on Loading.
|
||||
|
||||
## Deviations from Plan
|
||||
|
||||
### Auto-fixed Issues
|
||||
|
||||
**1. [Rule 2 - Missing critical] Menu-layer skeleton files the plan list did not name**
|
||||
- **Found during:** Task 1
|
||||
- **Issue:** `pnpm install` creates `node_modules`, Vite reads `tsconfig.json` from the layer, and `nuxt.config.ts` was required to build every path with `fileURLToPath`. A config with no path would not satisfy that rule.
|
||||
- **Fix:** Added `.gitignore`, `tsconfig.json`, `.nvmrc`, `pnpm-workspace.yaml` (the menu layer's `allowBuilds`), `pnpm-lock.yaml`, and `app/assets/css/connect.css` wired from the absolute layer directory. `dev` and `dev:prepare` scripts match the menu layer so the playground can start. No package beyond the pinned Nuxt, Vue, and TypeScript set was added.
|
||||
- **Files modified:** those skeleton files in vue-oauth-layer
|
||||
- **Commit:** `02c466e`
|
||||
|
||||
**2. [Rule 1 - Bug] Empty redirect_uri left the page on Loading**
|
||||
- **Found during:** Task 2, after the page commit
|
||||
- **Issue:** A 200 decision body with an empty `redirect_uri` never left `submitting`, so the template stayed on Loading.
|
||||
- **Fix:** Set state back to ready when the body has no redirect.
|
||||
- **Files modified:** `app/pages/connect.vue`
|
||||
- **Commit:** `7f805b3`
|
||||
|
||||
**3. [Rule 3 - Blocking] `git init -b main` instead of the global default `master`**
|
||||
- **Found during:** Task 1
|
||||
- **Issue:** `init.defaultBranch` is `master`. vue-menu-layer, vue-journal-layer, vue-faq-layer, and vue-paymentgateway-layer are all on `main`.
|
||||
- **Fix:** Initialized the repo with `-b main`.
|
||||
- **Files modified:** none (branch name only)
|
||||
- **Commit:** `02c466e` (root commit on `main`)
|
||||
|
||||
## Issues Encountered
|
||||
|
||||
`state.advance-plan` was not run. It has no phase argument and advances whatever Current Position names. That position is phase 33, from another session. Advancing it would move the wrong plan counter. Roadmap progress for 32.1 was updated with `roadmap.update-plan-progress`. A phase-scoped decision and metric may be recorded in STATE.md. STATE.md and state.json are not committed.
|
||||
|
||||
The default-branch guard returned protected for `main` inside the new repo. See Decisions Made. Nothing was pushed or tagged.
|
||||
|
||||
## User Setup Required
|
||||
|
||||
None - no external service configuration required.
|
||||
|
||||
The install line in the README does not resolve until someone accepts a later release and the tag exists. Plan 05 owns that checkpoint. This plan did not create the git remote `git.golem15.com/golem15/vue-oauth-layer.git`.
|
||||
|
||||
## Next Phase Readiness
|
||||
|
||||
Plan 05 can run `pnpm test` in vue-oauth-layer. The first tag, if the release checkpoint says so, is v0.1.0 on this repo. An application that already has `app/pages/connect.vue` keeps that page. This plan did not edit one.
|
||||
|
||||
## Self-Check: PASSED
|
||||
|
||||
- FOUND: ../vue-oauth-layer/package.json
|
||||
- FOUND: ../vue-oauth-layer/nuxt.config.ts
|
||||
- FOUND: ../vue-oauth-layer/app/pages/connect.vue
|
||||
- FOUND: ../vue-oauth-layer/app/utils/connectConsent.ts
|
||||
- FOUND: ../vue-oauth-layer/tests/connect.test.ts
|
||||
- FOUND: ../vue-oauth-layer/README.md
|
||||
- FOUND: ../vue-oauth-layer/.playground/nuxt.config.ts
|
||||
- FOUND: 02c466e
|
||||
- FOUND: 37c1e12
|
||||
- FOUND: 7f805b3
|
||||
- `pnpm test`: 8 passed, 0 failed, no `not ok`
|
||||
- `git remote` empty, `git tag` empty
|
||||
- `app/pages/connect.vue` does not contain `v-html`
|
||||
|
||||
---
|
||||
*Phase: 32.1-mcp-oauth-for-plugin-apps-declared-scopes-mcp-subject-on-con*
|
||||
*Completed: 2026-10-28*
|
||||
Reference in New Issue
Block a user