golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(08-07): complete oauth-client-command plan

Browse Source
This commit is contained in:
Jakub Zych
2026-09-23 22:05:44 +02:00
parent 398353b135
commit 27845490e8
3 changed files with 184 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
.planning/STATE.md
View File

@@ -3,14 +3,14 @@ gsd_state_version: 1.0
milestone: v1.0
milestone_name: milestone
status: executing
stopped_at: Completed 08-06-PLAN.md
last_updated: "2026-09-23T19:42:20.033Z"
stopped_at: Completed 08-07-PLAN.md
last_updated: "2026-09-23T20:05:28.781Z"
last_activity: 2026-09-23
progress:
total_phases: 15
completed_phases: 7
total_plans: 55
completed_plans: 51
completed_plans: 52
percent: 47
---
@@ -26,11 +26,11 @@ See: .planning/PROJECT.md (updated 2026-09-16)
## Current Position
Phase: 08 (oauth2-1-authorization-server) — EXECUTING
Plan: 7 of 10
Plan: 8 of 10
Status: Ready to execute
Last activity: 2026-09-23
Progress: [█████████░] 93%
Progress: [██████████] 95%
## Performance Metrics
@@ -97,6 +97,7 @@ Progress: [█████████░] 93%
| Phase 08 P04 | 15min | 2 tasks | 5 files |
| Phase 08 P05 | 55min | 3 tasks | 12 files |
| Phase 08 P06 | 50min | 3 tasks | 10 files |
| Phase 08 P07 | 35min | 2 tasks | 9 files |
## Accumulated Context
@@ -238,6 +239,11 @@ Recent decisions affecting current work:
- [Phase 08 P06]: RevokeLineage walks forward only through RotatedToID; sufficient for both replay-kill and connected-app-revoke because every normal rotation already revokes its own predecessor's access token and connected-app revoke always starts from the terminal row
- [Phase 08 P06]: Fixed RevokeLineage (GORM adapter and in-memory test double) to also revoke each visited row's linked access token -- the 08-02-era method only stamped the refresh row itself, leaving a replayed lineage's live access token usable
- [Phase 08 P06]: AUTH-05/06/07 remain Pending in REQUIREMENTS.md: refresh-rotation and connected-apps pieces are done, but AUTH-05/07's unchanged-fonoteka-mcp clause needs 08-08/08-09, and AUTH-06's CSRF/rate-limit/cache-header claims are reconciled by 08-10's security review
- [Phase ?]: [Phase 08 P07]: bonfire.Flag.Repeatable / Input.Flags(name) is the new shape for PHP-parity =* console options (Cobra StringSlice), with no change to existing scalar/bare Flag callers
- [Phase ?]: [Phase 08 P07]: fonoteka:oauth-client create reuses wristband.Tx.CreateWithCap(ctx, rec, math.MaxInt32) instead of adding an uncapped Create method -- operator-issued clients are never subject to DCR's 200-client cap
- [Phase ?]: [Phase 08 P07]: list/update operate directly on models.OAuthClient via *gorm.DB rather than extending wristband.ClientStore -- only client issuance needs the shared wristband hash/validation path (T-08-SECRET-TIMING)
- [Phase ?]: [Phase 08 P07]: Fixed clientRecordToModel to persist ScopeCeiling, a mapping gap silent since 08-02 because DCR never sets a ceiling
- [Phase ?]: [Phase 08 P07]: AUTH-05/AUTH-07 remain Pending in REQUIREMENTS.md -- both requirements' full text still needs 08-08/08-09's unchanged fonoteka-mcp install/auth flow proof
### Pending Todos
@@ -259,6 +265,6 @@ Items acknowledged and carried forward from previous milestone close:
## Session Continuity
Last session: 2026-09-23T19:42:20.015Z
Stopped at: Completed 08-06-PLAN.md
Last session: 2026-09-23T20:05:28.751Z
Stopped at: Completed 08-07-PLAN.md
Resume file: None