golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(19.4-02): record plan state and roadmap progress

Browse Source
This commit is contained in:
Jakub Zych
2026-10-19 19:28:09 +02:00
parent 8171eb25ef
commit 1e37926ee9
2 changed files with 15 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.planning/ROADMAP.md
View File

@@ -1299,14 +1299,14 @@ Plans:
4. An existing issuer, its signing keys and client secrets can be imported so that relying parties keep working. The phase gets a security review.
5. The `wristband` README and `docs/` pages are updated. The new code has unit tests, delivered in the phase's last plan.
**Plans:** 1/4 plans executed
**Plans:** 2/4 plans executed
Plans:
**Wave 1**
- [x] 19.4-01-PLAN.md — Decision note (golang-jwt v5, zitadel rejected), then the wristband OIDC flavour: discovery, JWKS, resumable authorize with consent and switch account, token with id_token, userinfo, pairwise subjects, kinds, opt-in refresh; neutral Resource default; README and docs (wave 1)
**Wave 2** *(blocked on Wave 1 completion)*
- [ ] 19.4-02-PLAN.md — New repo sm-oauthserver-plugin: migrations, GORM stores for OIDC and MCP, DB key ring, PHP-path routes and throttles, branded consent and error pages, authorizations JSON, user cascade, additive sm-user-plugin exports, go-oidc interop test (wave 2)
- [x] 19.4-02-PLAN.md — New repo sm-oauthserver-plugin: migrations, GORM stores for OIDC and MCP, DB key ring, PHP-path routes and throttles, branded consent and error pages, authorizations JSON, user cascade, additive sm-user-plugin exports, go-oidc interop test (wave 2)
**Wave 3** *(blocked on Wave 2 completion)*
- [ ] 19.4-03-PLAN.md — Winter import with original kids, cabana Clients and Branding screens, rotate-keys, prune and schedule, tide parity against the PHP plugin, security review (wave 3)
@@ -1468,7 +1468,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
| 19. Chat and ChatChannels | 7/7 | Complete | 2026-10-17 |
| 19.1. Chat satellites | 6/6 | Complete | 2026-10-18 |
| 19.3. Framework transport and infrastructure for WavePath | 6/6 | In Progress| |
| 19.4. OIDC provider on wristband | 1/4 | In Progress| |
| 19.4. OIDC provider on wristband | 2/4 | In Progress| |
| 19.5. Social login in sm-user-plugin | 0/TBD | Not started | - |
| 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - |
| 19.7. Generic MCP module | 0/TBD | Not started | - |

19
.planning/STATE.md
View File

@@ -4,16 +4,16 @@ milestone: v1.0
current_phase: "19.4"
current_phase_name: OIDC provider on wristband (INSERTED)
status: executing
stopped_at: Completed 19.4-01-PLAN.md
last_updated: "2026-10-19T16:36:07.503Z"
stopped_at: Completed 19.4-02-PLAN.md
last_updated: "2026-10-19T17:27:50.200Z"
last_activity: 2026-10-19
last_activity_desc: Phase 19.4 execution started
state_head: 49e772afb8503401ecdd05731e92be52fb233dd1
state_head: 8171eb25efc1ab4ad298338bbffd8598a7dc2c69
progress:
total_phases: 42
completed_phases: 34
total_plans: 208
completed_plans: 205
completed_plans: 206
gsd_state_version: "1.0"
milestone_name: milestone
---
@@ -30,7 +30,7 @@ See: .planning/PROJECT.md (updated 2026-10-12)
## Current Position
Phase: 19.4 (OIDC provider on wristband (INSERTED)) — EXECUTING
Plan: 2 of 4
Plan: 3 of 4
Status: Ready to execute
Last activity: 2026-10-19 — Phase 19.4 execution started
@@ -259,6 +259,7 @@ Progress: [████████░░] 83%
| Phase 19.1 P19.1-02 | 9 min | 4 tasks | 36 files |
| Phase 19.1 P19.1-06 | 16 | 3 tasks | 46 files |
| Phase 19.4 P01 | 28 min | 4 tasks | 34 files |
| Phase 19.4 P02 | 50min | 5 tasks | 54 files |
## Accumulated Context
@@ -877,6 +878,10 @@ Recent decisions affecting current work:
- [Phase 19.4]: D-16: extend the hand-written wristband with an OIDC flavour; golang-jwt/jwt/v5 v5.3.1 signs id_tokens via MapClaims; stdlib JWKs; zitadel/oidc v3 rejected; go-oidc and x/oauth2 test-only in sm-oauthserver-plugin
- [Phase 19.4]: 19.4-01: OIDC redirects send Cache-Control no-store, private (plan) while PHP sends no-cache, private; plan 03 tide replay settles it
- [Phase 19.4]: 19.4-01: wristband DefaultOptions().Resource is empty; host applications set their MCP resource explicitly (fonoteka 687e25a)
- [Phase 19.4]: 19.4-02: go-oidc v3.21.0 and x/oauth2 v0.37.0 approved as test-only requirements of sm-oauthserver-plugin (TestRelyingPartyInterop, RS256 and ES256)
- [Phase 19.4]: 19.4-02: first signing key via INSERT ... ON CONFLICT (active) WHERE active DO NOTHING with a silent GORM logger so key ciphertext never reaches the log
- [Phase 19.4]: 19.4-02: plugin-owned oauthserver.body.limit middleware on the token routes because surf ignores body.limit on GroupRaw routes
- [Phase 19.4]: 19.4-02: SanitizeCustomCSS repeats tag-opener removal until stable (PHP single pass is bypassable)
### Pending Todos
@@ -964,6 +969,6 @@ Items acknowledged and carried forward from previous milestone close:
## Session Continuity
Last session: 2026-10-19T16:36:06.663Z
Stopped at: Completed 19.4-01-PLAN.md
Last session: 2026-10-19T17:27:49.408Z
Stopped at: Completed 19.4-02-PLAN.md
Resume file: None