From 365342257273448bc9ac8ad6818294e2e659bade Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Thu, 22 Oct 2026 15:36:25 +0200 Subject: [PATCH] docs(phase-19.6.1): mark phase complete after UAT and security --- .planning/PROJECT.md | 9 +++++++-- .planning/ROADMAP.md | 6 +++--- .planning/STATE.md | 36 +++++++++++++++++++----------------- 3 files changed, 29 insertions(+), 22 deletions(-) diff --git a/.planning/PROJECT.md b/.planning/PROJECT.md index 295fa42f..d32b5751 100644 --- a/.planning/PROJECT.md +++ b/.planning/PROJECT.md @@ -67,6 +67,10 @@ Validated in Phase 19.5: Social login - [x] The new sm-sociallogin-plugin signs users in with Google, GitHub, Microsoft and Facebook through PHP's `/oauth/{provider}` paths, with a provider registry other plugins extend, the SPA one-time-code handoff, the pending-registration branch and linking through a one-time link ticket; a verified email auto-links only onto an account that proved its address (`users.email_verified_at` in sm-user-plugin, a deliberate divergence from PHP); `scripts/check-phase19.5.sh` is the fail-closed gate (UAT and security 2026-10-21). The email-proof fix (sm-user-plugin v0.1.5, sm-sociallogin-plugin v0.1.2) is released with the 19.8 release +Validated in Phase 19.6.1: Backend Administrators screen + +- [x] Backend admin users and roles are managed in the admin SPA (Settings → System), WinterCMS-style, with `backend.manage_users` / `backend.manage_roles`, server-side privilege rules (superuser-only flag, ceilings, self-edit, outranking, last-superuser lock) and a generic record-action seam; `scripts/check-phase19.6.1.sh` is the fail-closed gate (UAT 26/26 and security 33/33 closed, 2026-10-22) + ### Active Framework kernel @@ -95,7 +99,7 @@ Background and integrations Admin -- [ ] Backend admin users with roles, separate from frontend users, as in WinterCMS +- (backend admin users and roles — moved to Validated in Phase 19.6.1) - [ ] `fields.yaml` and `columns.yaml` parsed (goccy/go-yaml) into a JSON form and list schema served per controller, with the field types Płytarium actually uses (text, textarea, checkbox, switch, dropdown with model-method options, relation with nameFrom/emptyOption) plus layout hints (span, tabs, context, attributes), and a first-class relation-manager schema replacing the one `partial` field - [ ] A minimal Vue 3 + TypeScript admin SPA that renders those schemas as lists and forms for the five Płytarium controllers (Albums, Artists, Collections, Genres, Styles), with types generated from the API's OpenAPI document @@ -187,6 +191,7 @@ Validated in Phase 18.1: Payment Gateway Subscriptions | A soft (optional) plugin dependency still requires the provider module in `go.mod`; only `Requires()` omits it | A typed `Lookup` needs the package that declares the interface; optional means "skipped at Boot when absent", not "not compiled in" (`docs/plugins/extending.md`) | ✓ Good (Phase 19.1 UAT override, 2026-10-18) | | OIDC on wristband with golang-jwt v5, not zitadel/oidc (Phase 19.4, `notes/2026-10-19-oidc-on-wristband-golang-jwt.md`) | wristband already owned the OAuth flows and PHP-compatible encoding; zitadel's own storage and routing would fight both. go-oidc and x/oauth2 are test-only, for relying-party interop | ✓ Good (Phase 19.4 UAT, 2026-10-20) | | PHP OIDC parity is recorded at the WavePath cutover, not in Phase 19.4 (D-14 amended) | The harness ships and replays Go-side; recording needs the live PHP site, and WavePath's provider must not move until the replay is green | — Pending (todo `2026-10-19-record-php-oidc-parity-against-wavepath`) | +| Administrators and Roles live in cabana as an internal pseudo-plugin; privilege rules run in the save transaction; contributed Administrators Runs are wrapped with `guardOutranked` | WinterCMS screens were missing and 19.7 needs the record-action seam; a delegated editor must not outrank the target or capture a code-declared role | ✓ Good (Phase 19.6.1 UAT 26/26, 2026-10-22) | ## Evolution @@ -206,4 +211,4 @@ This document evolves at phase transitions and milestone boundaries. 4. Update Context with current state --- -*Last updated: 2026-10-21 after Phase 19.5 completion* +*Last updated: 2026-10-22 after Phase 19.6.1 completion* diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index bb8be606..f603ae01 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -41,7 +41,7 @@ Decimal phases appear between their surrounding integers in numeric order. - [ ] **Phase 19.4.1: Early public demo on demo.summercms.io** - sm-demo-app with today's shared plugins on rome: open registration, guided tour, journal, bm's presentation system, quizzes, payments; backend by request - [x] **Phase 19.5: Social login in sm-user-plugin** - Google and Facebook login with the SPA one-time-code handoff (completed 2026-10-21) - [ ] **Phase 19.6: Two-factor auth and device flow in sm-user-plugin** - TOTP, WebAuthn, email and recovery codes, trusted devices, device authorization -- [ ] **Phase 19.6.1: Backend Administrators screen** - Admins and roles CRUD in cabana, WinterCMS-style, with server-side privilege rules +- [x] **Phase 19.6.1: Backend Administrators screen** - Admins and roles CRUD in cabana, WinterCMS-style, with server-side privilege rules (completed 2026-10-22) - [ ] **Phase 19.7: Generic MCP module** - Opt-in MCP endpoint, plugin-declared tools filtered by permissions, one connector per person via OAuth and a verified account link - [ ] **Phase 19.8: Console commands overhaul** - `diary` logging module, Artisan-grade global flags, help and `list` in `bonfire`, sweep of every command - [ ] **Phase 20: Demo instance with every shared plugin** - Add the chat family (chat, channels, video calls, chatbots, forum, herald, friends) to the live demo from Phase 19.4.1 @@ -1423,7 +1423,7 @@ Plans: 2. Privilege rules hold on the server: only a superuser can create, edit or grant superuser; an admin cannot raise their own role or permissions; the last active superuser cannot be deactivated, demoted or deleted. 3. The record-action seam on the Administrators list is usable by plugins (19.7's link action), and unit tests cover the privilege rules. -**Plans:** 5/5 plans executed +**Plans:** 5/5 plans complete Plans: - [x] 19.6.1-05-PLAN.md @@ -1597,7 +1597,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 → | 19.4.1. Early public demo on demo.summercms.io | 5/5 | In Progress| | | 19.5. Social login in sm-user-plugin | 5/5 | Complete | 2026-10-21 | | 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - | -| 19.6.1. Backend Administrators screen (INSERTED) | 5/5 | In Progress| | +| 19.6.1. Backend Administrators screen (INSERTED) | 5/5 | Complete | 2026-10-22 | | 19.7. Generic MCP module | 0/TBD | Not started | - | | 19.8. Console commands overhaul (INSERTED) | 6/6 | In Progress| | | 20. Demo instance with every shared plugin | 0/TBD | Not started | - | diff --git a/.planning/STATE.md b/.planning/STATE.md index 37dc519d..e627419e 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -1,17 +1,17 @@ --- msd_state_version: "1.0" milestone: v1.0 -current_phase: 19.6.1 -current_phase_name: Backend Administrators screen (INSERTED) -status: verifying -stopped_at: Completed 19.6.1-05-PLAN.md -last_updated: "2026-10-22T12:44:09.094Z" +current_phase: "19.3" +current_phase_name: Framework transport and infrastructure for WavePath +status: planning +stopped_at: Phase 19.6.1 complete, ready to plan Phase 19.3 +last_updated: "2026-10-22T13:36:21.249Z" last_activity: 2026-10-22 -last_activity_desc: Phase 19.6.1 execution started -state_head: 1e3b006c5dface4668023bc3359c3b35e4f8de5d +last_activity_desc: Phase 19.6.1 complete, transitioned to Phase 19.3 +state_head: b28800ad3931954e1b80b6b6af5bb9a5d64b559a progress: total_phases: 45 - completed_phases: 36 + completed_phases: 37 total_plans: 238 completed_plans: 229 gsd_state_version: "1.0" @@ -22,17 +22,17 @@ milestone_name: milestone ## Project Reference -See: .planning/PROJECT.md (updated 2026-10-12) +See: .planning/PROJECT.md (updated 2026-10-22) **Core value:** An existing WinterCMS-shaped app can be ported plugin by plugin to a single Go binary without its frontend noticing: the PHP version's API contract is the acceptance test. -**Current focus:** Phase 19.6.1 — Backend Administrators screen (INSERTED) +**Current focus:** Phase 19.3 — Framework transport and infrastructure for WavePath ## Current Position -Phase: 19.6.1 (Backend Administrators screen (INSERTED)) — EXECUTING -Plan: 5 of 5 -Status: Phase complete — ready for verification -Last activity: 2026-10-22 — Phase 19.6.1 execution started +Phase: 19.3 — Framework transport and infrastructure for WavePath +Plan: Not started +Status: Ready to plan +Last activity: 2026-10-22 — Phase 19.6.1 complete, transitioned to Phase 19.3 Progress: [████████░░] 82% @@ -40,7 +40,7 @@ Progress: [████████░░] 82% **Velocity:** -- Total plans completed: 110 +- Total plans completed: 115 - Average duration: 21 min - Total execution time: 104 min @@ -67,6 +67,7 @@ Progress: [████████░░] 82% | 19.1 | 6 | - | - | | 19.4 | 4 | - | - | | 19.5 | 5 | - | - | +| 19.6.1 | 5 | - | - | **Recent Trend:** @@ -940,6 +941,7 @@ Recent decisions affecting current work: - [Phase 19.6.1]: Roles create and update refuse any new code that rolePermissions attaches grants to, including when the editor is a superuser — D-16 stricter reading from the gap contract: a role never becomes a code-declared system role through the Roles screen - [Phase 19.6.1]: cabana wraps contributed Administrators Runs; guardOutranked stays unexported and contributors do not own the check — D-19 gap contract: wrap in cabana so a contribution to summercms.cabana.users cannot skip outranking - [Phase 19.6.1]: Persist picked relation labels on the form via FORM_REMEMBER_LABEL; keep the one-panel FormGrid (do not v-show inactive tabs) — UAT G-19.6.1-T2 is labeling only; v-show of inactive tabs would change trigger hide-tab, ML locale reset, and field mount cost +- [Phase 19.6.1]: Administrators and Roles are cabana screens behind backend.manage_users / backend.manage_roles with no default role grant; privilege rules run in the save tx; last-superuser uses pg_advisory_xact_lock; contributed Administrators Runs are wrapped with guardOutranked. ### Pending Todos @@ -1039,6 +1041,6 @@ Items acknowledged and carried forward from previous milestone close: ## Session Continuity -Last session: 2026-10-22T12:44:00.423Z -Stopped at: Completed 19.6.1-05-PLAN.md +Last session: 2026-10-22T13:36:16.546Z +Stopped at: Phase 19.6.1 complete, ready to plan Phase 19.3 Resume file: None