golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(08-03): complete authorize plan

Browse Source
This commit is contained in:
Jakub Zych
2026-09-23 20:11:54 +02:00
parent 90752beb87
commit 33ab188a2e
4 changed files with 193 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
.planning/STATE.md
View File

@@ -3,14 +3,14 @@ gsd_state_version: 1.0
milestone: v1.0
milestone_name: milestone
status: executing
stopped_at: Completed 08-02-PLAN.md
last_updated: "2026-09-23T17:54:25.008Z"
stopped_at: Completed 08-03-PLAN.md
last_updated: "2026-09-23T18:11:44.182Z"
last_activity: 2026-09-23
progress:
total_phases: 15
completed_phases: 7
total_plans: 55
completed_plans: 47
completed_plans: 48
percent: 47
---
@@ -26,11 +26,11 @@ See: .planning/PROJECT.md (updated 2026-09-16)
## Current Position
Phase: 08 (oauth2-1-authorization-server) — EXECUTING
Plan: 3 of 10
Plan: 4 of 10
Status: Ready to execute
Last activity: 2026-09-23
Progress: [█████████░] 85%
Progress: [█████████░] 87%
## Performance Metrics
@@ -93,6 +93,7 @@ Progress: [█████████░] 85%
| Phase 07-user-plugin-and-authentication P08 | 25min | 3 tasks | 6 files |
| Phase 08 P01 | 25min | 2 tasks | 6 files |
| Phase 08 P02 | 30min | 3 tasks | 14 files |
| Phase 08 P03 | 20min | 2 tasks | 6 files |
## Accumulated Context
@@ -218,6 +219,10 @@ Recent decisions affecting current work:
- [Phase ?]: [Phase 08 P02]: Register strips C0/DEL control characters from client_name at DCR capture time (PHP only strips at ConnectedApp/Consent display time) per 08-CONTEXT.md discretion
- [Phase ?]: [Phase 08 P02]: OAuth config keys live under golem15.fonoteka.oauth.* (bare plugin ID, matching compass.MergePlugin), not plugins.golem15.fonoteka.oauth.*
- [Phase ?]: [Phase 08 P02]: AUTH-05/AUTH-06/AUTH-07 remain Pending in REQUIREMENTS.md: this plan ships DCR only, not the full authorize/token/consent surface
- [Phase 08]: [Phase 08 P03]: Options gained Resource and PendingRequestTTL (not in the plan's file list for server.go) following the 08-02 precedent of extending Options for deployment-configurable values
- [Phase 08]: [Phase 08 P03]: authorize's allowed-scope set is a package-level authorizeAllowedScopes constant, not Options.ScopesSupported (RFC 8414 metadata field) -- conceptually distinct config surfaces matching PHP's own separation
- [Phase 08]: [Phase 08 P03]: Client lookup and pending-row creation each open their own WithinTx call, matching PHP's lack of a wrapping transaction around authorize; only DCR and later code-exchange/refresh-rotation need single-transaction atomicity
- [Phase 08]: [Phase 08 P03]: AUTH-05/AUTH-06/AUTH-07 remain Pending in REQUIREMENTS.md, continuing 08-01/08-02's decision: this plan ships authorize only, not the full RFC surface
### Pending Todos
@@ -239,6 +244,6 @@ Items acknowledged and carried forward from previous milestone close:
## Session Continuity
Last session: 2026-09-23T17:54:24.991Z
Stopped at: Completed 08-02-PLAN.md
Last session: 2026-09-23T18:11:30.777Z
Stopped at: Completed 08-03-PLAN.md
Resume file: None