From 575a110378efe96686bda258e56eb22453319052 Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Thu, 22 Oct 2026 22:36:19 +0200 Subject: [PATCH] docs: fill G4 in the external-escalation reply --- .../notes/2026-10-22-external-user-plugin-escalations.md | 4 ++-- .../2026-10-22-user-logout-blacklist-missing-under-serve.md | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.planning/notes/2026-10-22-external-user-plugin-escalations.md b/.planning/notes/2026-10-22-external-user-plugin-escalations.md index d4dffce8..1bd80b02 100644 --- a/.planning/notes/2026-10-22-external-user-plugin-escalations.md +++ b/.planning/notes/2026-10-22-external-user-plugin-escalations.md @@ -21,7 +21,7 @@ Reviewed 2026-10-22. The list is `golem15.user` (sm-user-plugin), not cabana adm |---|---|---|---|---|---|---| | 1 | G2 login ignores `is_activated` | Fix | [261022-tb4](../quick/261022-tb4-password-login-must-refuse-is-activated-/) · [todo](../todos/pending/2026-10-22-user-login-ignores-is-activated.md) | 3r4or1ex | done (unreleased) | `15ff979` → v0.5.0 | | 2 | G3 cookie-only 401 | Fix remaining four; logout already done | [261022-tto](../quick/261022-tto-fetch-refresh-update-change-password-mus/) · [todo](../todos/pending/2026-10-22-user-session-routes-ignore-cookie.md) | kkknstxl | done (unreleased) | `8e4b863` → v0.5.0 | -| 3 | G4 logout blacklist under `serve` | Fix | [2026-10-22-user-logout-blacklist-missing-under-serve.md](../todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md) | ud0gficu | open | | +| 3 | G4 logout blacklist under `serve` | Fix | [261022-usi](../quick/261022-usi-user-plugin-jwt-blacklist-and-hooks-wire/) · [todo](../todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md) | ud0gficu | done (unreleased) | `4bf44fc` → v0.5.0 | | 4 | G6 `/update` email without proof | Decline | — | — | declined | n/a | | 5 | G7 Users form has no role field | Decline | — | — | declined | n/a | | 6 | G8 API token guard ignores `tokens_valid_after` | Decline | — | — | declined | n/a | @@ -80,7 +80,7 @@ Ships in SummerCMS v0.5.0 (sm-user-plugin 8e4b863, tagged with that wave): GET / G4 — logout does not blacklist under serve Agreed. Plugin Boot runs before serve publishes the database, so the in-process blacklist store was never wired in production (the jwt_blacklist table exists; nothing wrote to it). Tests hid this because they publish the DB before Boot. -TODO: ships in SummerCMS v0.5.0 — logout under serve blacklists the jti; the next jwt.auth request with that token is 401. +Ships in SummerCMS v0.5.0 (sm-user-plugin 4bf44fc, tagged with that wave): the plugin installs its jwt_blacklist store, the blacklist sweep and its GORM hooks when serve publishes the database, and the jwt guard reads that store on every request. Logout under serve now writes the jti to jwt_blacklist, and the next request with that token (jwt.auth routes, /fetch, /refresh) answers 401. A regression test boots in serve order (plugins first, database second). The jwt guard also takes its cookie names from the same list as the session routes (token, auth_token). G6 — /update changes email without proof As designed, not a bug. A new address clears email_verified_at and stays unproven until the owner completes an activation code or a reset-password. We are not adding a “confirm the new inbox before the change sticks” flow in this round. Say if you need that as a later feature. diff --git a/.planning/todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md b/.planning/todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md index 82e4fc57..9581cb8b 100644 --- a/.planning/todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md +++ b/.planning/todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md @@ -30,6 +30,10 @@ Base is sm-user-plugin `8e4b863` (G3). Hold push/tag for SummerCMS v0.5.0. After the commit, fill G4 in `.planning/notes/2026-10-22-external-user-plugin-escalations.md` the same way as G2/G3 (`done (unreleased)`, ships in v0.5.0). Leave the todo in pending with an Outcome. +## Outcome (2026-10-22) + +Quick `261022-usi`. Fix commit `4bf44fc` on sm-user-plugin master (base `8e4b863`). `Boot` makes one `lagoon.OnDatabase` call that runs `classes.RegisterHooks`, publishes `bouncer.NewPostgresBlacklist(sqlDB, "jwt_blacklist")` and starts the sweep. The jwt guard is registered once with an unexported `appBlacklist` that looks up the published store on each call: no store means not blacklisted, and store errors pass through. It no longer hardcodes the cookie names; it uses `classes.SessionCookieNames()...` (G3 leftover). `TestBootBeforeDatabase` (Docker) boots Activate → Publish → routes → login → logout → 401 plus a `jwt_blacklist` row. It fails at `8e4b863` and passes at `4bf44fc`. `TestAppBlacklist` runs under `-short`. Reply note G4 filled. Not tagged, not pushed: ships with the v0.5.0 wave. + ## Invoke ```