golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(12-05): sign off the Phase 12 security review, validation and API-01/API-02

Browse Source 
- 12-SECURITY-REVIEW.md maps T-12-01..T-12-34 and T-12-SC to a named test
  and 25 removal checks, all seen failing with the protection removed
- 12-VALIDATION.md validated with the final per-task map, nyquist_compliant
- REQUIREMENTS.md: API-01 and API-02 complete
This commit is contained in:
Jakub Zych
2026-10-02 16:55:29 +02:00
parent f4ec94531f
commit 1f4e1e01c4
3 changed files with 143 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.planning/REQUIREMENTS.md
View File

@@ -73,8 +73,8 @@ Requirements for v1 (the Płytarium port). Each maps to roadmap phases. "User" b
### Płytarium API (API)
- [ ] **API-01**: Collections: CRUD, active-context switch (me/context flags plus the opaque channel name from realtime/channels), editor invitations and acceptance, owner-only share link show/update/regenerate
- [ ] **API-02**: Albums: CRUD, ratings, photo upload and manual cover URL, Discogs cover import (cover_urls), artists/genres/styles lookups, search that treats Typesense as a pre-filter with both the items and the total re-gated in SQL
- [x] **API-01**: Collections: CRUD, active-context switch (me/context flags plus the opaque channel name from realtime/channels), editor invitations and acceptance, owner-only share link show/update/regenerate
- [x] **API-02**: Albums: CRUD, ratings, photo upload and manual cover URL, Discogs cover import (cover_urls), artists/genres/styles lookups, search that treats Typesense as a pre-filter with both the items and the total re-gated in SQL
- [ ] **API-03**: Wishlist: items, subscriptions, public-wishlist/{token} views, album reservations (reserve/reveal), purchase and digest triggers
- [ ] **API-04**: Notifications: list, mark read, prune; realtime token endpoint owned by the websockets plugin
- [ ] **API-05**: CSV import as a multi-step session (store, show/poll, mapping patch, per-row edit, commit, cancel) and CSV export on both authenticated groups
@@ -212,8 +212,8 @@ Which phases cover which requirements. Updated during roadmap creation.
| AUTH-06 | Phase 8 | Complete |
| AUTH-07 | Phase 8 | Complete |
| AUTH-08 | Phase 9 | Complete |
| API-01 | Phase 12 | Pending |
| API-02 | Phase 12 | Pending |
| API-01 | Phase 12 | Complete |
| API-02 | Phase 12 | Complete |
| API-03 | Phase 13 | Pending |
| API-04 | Phase 13 | Pending |
| API-05 | Phase 13 | Pending |