diff --git a/.planning/todos/pending/email-proof-release.md b/.planning/todos/pending/email-proof-release.md new file mode 100644 index 00000000..93f290c1 --- /dev/null +++ b/.planning/todos/pending/email-proof-release.md @@ -0,0 +1,66 @@ +--- +created: 2026-10-21T15:00:00.000Z +title: Release the email-proof fix (sm-user-plugin v0.1.5, sm-sociallogin-plugin v0.1.2) and move the app pins +priority: high +area: sm-user-plugin, sm-sociallogin-plugin +severity: major +g15office: not created (no g15office tool in the executing session; create it and write the ID here) +files: + - ../fonoteka.go/plugins/golem15/user + - ../sm-sociallogin-plugin/go.mod + - ../sm-sociallogin-plugin/go.sum + - ../sm-demo-app/plugins/golem15/user + - ../sm-demo-app/plugins/golem15/sociallogin + - ../sm-demo-app/go.mod + - ../sm-demo-app/go.sum + - ../sm-bm-app/plugins/golem15/user + - ../sm-bm-app/plugins/golem15/sociallogin + - ../sm-bm-app/go.mod + - ../sm-bm-app/go.sum +--- + +## Hand-off + +For the 19.8 session (console commands overhaul): review this release and decide on it together with the framework v0.4.0 release. On 2026-10-21 the user answered the 19.5-05 Task 6 checkpoint with **hold**: nothing was pushed or tagged and no pointer moved. Every step below needs the user's go-ahead; never force-push, never deploy. + +The plugin tags live in the plugins' own repositories (`sm-user-plugin`, `sm-sociallogin-plugin`). They are separate from the framework `v0.4.0` tag on summercms.go and need no framework release; the framework tag does not carry them. + +## Problem + +Phase 19.5 plan 05 (gap closure) made a verified social sign-in link only onto an account whose owner proved the address: `users.email_verified_at` (migration `202610210001_add_users_email_verified_at`, stamped by the mailed activation code and the reset-code password reset, cleared on an email change), and sociallogin's `ownerVerifiedEmail` reads it (D-26). Details: `.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-05-SUMMARY.md`. + +The fix sits in local commits only. Until it is released, sm-demo-app and sm-bm-app keep the pre-account-takeover path (19.5 VERIFICATION item 1): an auto-mode `/register` account with someone else's address is linked when that address's owner signs in with Google, handing the sign-in to the squatter. + +Unreleased commits (`git log --oneline origin/master..master`, fetched 2026-10-21 about 12:25Z): + +| Repository | Unpushed commits | This plan's? | +|------------|------------------|--------------| +| sm-user-plugin (`../fonoteka.go/plugins/golem15/user`) | `35cf166`, `a99cb46`, `add1f7a` | all 19.5-05 | +| sm-sociallogin-plugin | `c4ebf05`, `962190b`, `3bb5650` | all 19.5-05 | +| sm-bm-app | `5fd0cc3` (bm OAuth callback view test) | 19.5-05 Task 4 | +| sm-demo-app | `b325460` feat(demo): roadmap deck describes the new console | **foreign**: another session (19.8), touches only `plugins/demo/content/ROADMAP.md` and `plugins/demo/roadmap/` | +| fonoteka.go | 31 commits (`f4d5728` … `ca746fc`) | all foreign; fonoteka.go is never pushed by this release | +| summercms.go | this plan's `7170c5b`, `30e0cd9`, `c2c8c6a`, `7e43873`, `8c7794e` among others | never pushed by this release | + +Proposed tags (free on the remotes at the time of the check; no tag points at either plugin's master): + +| Repository | Tag | Points at | +|------------|-----|-----------| +| sm-user-plugin | `v0.1.5` | `35cf166` | +| sm-sociallogin-plugin | `v0.1.2` | the new commit `chore: require sm-user-plugin v0.1.5` on top of `c4ebf05` | + +Current pins: sm-demo-app and sm-bm-app `plugins/golem15/user` c43ba87 (v0.1.4) and `plugins/golem15/sociallogin` d7ee28d (v0.1.1); sm-demo-app go.mod requires sm-user-plugin v0.1.4 and sm-sociallogin-plugin v0.1.1; sm-bm-app go.mod requires sm-user-plugin v0.1.4 and sm-sociallogin-plugin v0.0.0 (replace to the submodule; only the user line names a version); fonoteka.go gitlink c43ba87, with the worktree already at `35cf166` and left unstaged. + +## Solution + +D-21 order: user plugin first, then sociallogin, then the apps (user bump, then sociallogin bump). Before every push: `git fetch origin`, no uncommitted change to the release paths, and `git log --oneline origin/master..master` lists only the expected commits; otherwise stop and report. Stage by path. + +0. Docker gate runs: the NordLayer VPN's nftables table drops loopback traffic to published container ports, so testcontainers Postgres times out. Restore it with `sudo nft insert rule inet nordlayer input iifname "lo" accept` and `sudo nft insert rule inet nordlayer output oifname "lo" accept` (lost when the VPN reconnects). Probe in fonoteka.go: `TESTCONTAINERS_HOST_OVERRIDE=127.0.0.1 go test -short -count=1 -timeout 120s -run '^TestPermissionSetScan$' ./plugins/golem15/user/classes` finishes in about 15 s when it works. Full gate: `PHASE195_REQUIRE_DOCKER=1 TESTCONTAINERS_HOST_OVERRIDE=127.0.0.1 bash scripts/check-phase19.5.sh --all` (summercms.go). +1. sm-user-plugin (`../fonoteka.go/plugins/golem15/user`): vet and the short suite green through the fonoteka.go workspace; push master; annotated tag `v0.1.5` at `35cf166` (message: users.email_verified_at records a proved address (mail activation, reset code); an email change clears it; no backfill; routes, payloads and config unchanged); push the tag. +2. sm-sociallogin-plugin: go.mod require `git.golem15.com/golem15/sm-user-plugin v0.1.5`, keep the summercms replace; `GOWORK=off GOPRIVATE='git.golem15.com/*' go mod tidy`; vet, short suite and `GOWORK=off go build ./...` green; commit `chore: require sm-user-plugin v0.1.5`; push master; annotated tag `v0.1.2` (message: a verified sign-in links only onto an account whose owner proved the address; accounts registered with a password in auto mode, created by an administrator or created before golem15.user v0.1.5 go to the pending screen; requires sm-user-plugin v0.1.5); push the tag. +3. sm-demo-app, two commits: `plugins/golem15/user` to v0.1.5 with go.mod/go.sum, `bash scripts/check-phase19.5.sh --demo` and `scripts/check-pins.sh` green, commit `chore: bump sm-user-plugin to v0.1.5`; then `plugins/golem15/sociallogin` to v0.1.2 the same way, commit `chore: bump sm-sociallogin-plugin to v0.1.2`; gate green after each; push. **The push carries the foreign `b325460` (19.8 roadmap deck) unless that session has pushed it first; include it only with the user's or the 19.8 session's say-so.** +4. sm-bm-app: the same two commits in the same order (only the versioned require line changes, keep the replace lines, add the go.sum change to the commit it belongs to); `bash scripts/check-phase19.5.sh --bm` green after each; push, including `5fd0cc3`. +5. fonoteka.go: `git -C plugins/golem15/user describe --exact-match` names v0.1.5; `bash scripts/check-phase19.5.sh --fonoteka`; stage only `plugins/golem15/user`, commit `chore: bump sm-user-plugin to v0.1.5`, local only (its unpushed range is other work). Other sessions' gitlink changes (feedback, golem) stay untouched. +6. g15office: comment on the Phase 19.5 milestone task `onunbz3l` (released, awaiting re-verification), set it to Testing, and close this todo's task to Live. + +When done: record the tags, pushed ranges and final pins in 19.5-05-SUMMARY.md (or a follow-up note), move this todo to `todos/done/`, and re-run `/msd-verify-work 19.5`.