docs(19.4): complete phase, OIDC provider on wristband
This commit is contained in:
@@ -59,6 +59,10 @@ Validated in Phase 19.1: Chat satellites
|
||||
|
||||
- [x] Shared plugins sm-chatbots-plugin, sm-chatvideo-plugin (LiveKit), sm-forum-plugin (breakwater-sanitized markdown), sm-herald-plugin (web push, SSRF-guarded) and sm-userfriends-plugin run on SummerCMS behind JWT APIs, with GDPR cascades on `user.Deleting`; `scripts/check-phase19.1.sh` is the fail-closed gate (UAT and security 2026-10-18)
|
||||
|
||||
Validated in Phase 19.4: OIDC provider on wristband
|
||||
|
||||
- [x] `wristband` has an OpenID Connect flavour (discovery, JWKS with RS256/ES256 and key rotation, id_token with nonce and at_hash, userinfo, resumable authorize with consent and account switching, pairwise subjects, opt-in refresh), and the new sm-oauthserver-plugin hosts it with PHP-path routes, branded consent and error pages, Clients and Branding admin screens and a Winter import that keeps kids, tokens and secrets; `scripts/check-phase19.4.sh` is the fail-closed gate (UAT and security 2026-10-20). PHP parity recording deferred to the WavePath cutover (D-14 amended)
|
||||
|
||||
### Active
|
||||
|
||||
Framework kernel
|
||||
@@ -177,6 +181,8 @@ Validated in Phase 18.1: Payment Gateway Subscriptions
|
||||
| The opt-in request log (`http.access_log`) records method, matched pattern, status and duration, never the URL path | Share and invitation tokens travel in paths (review WR-01); an unported route shows as a 404 with an empty pattern | ✓ Good (Phase 14.2) |
|
||||
| Subscription state comes from Stripe, not the event snapshot (Phase 18.1, D-21 amended) | Out-of-order webhooks regressed rows; the job re-retrieves the subscription under a per-subscription advisory lock, and a portal `cancel_at` counts as cancel at period end | ✓ Good (Phase 18.1 UAT, 2026-10-16) |
|
||||
| A soft (optional) plugin dependency still requires the provider module in `go.mod`; only `Requires()` omits it | A typed `Lookup` needs the package that declares the interface; optional means "skipped at Boot when absent", not "not compiled in" (`docs/plugins/extending.md`) | ✓ Good (Phase 19.1 UAT override, 2026-10-18) |
|
||||
| OIDC on wristband with golang-jwt v5, not zitadel/oidc (Phase 19.4, `notes/2026-10-19-oidc-on-wristband-golang-jwt.md`) | wristband already owned the OAuth flows and PHP-compatible encoding; zitadel's own storage and routing would fight both. go-oidc and x/oauth2 are test-only, for relying-party interop | ✓ Good (Phase 19.4 UAT, 2026-10-20) |
|
||||
| PHP OIDC parity is recorded at the WavePath cutover, not in Phase 19.4 (D-14 amended) | The harness ships and replays Go-side; recording needs the live PHP site, and WavePath's provider must not move until the replay is green | — Pending (todo `2026-10-19-record-php-oidc-parity-against-wavepath`) |
|
||||
|
||||
## Evolution
|
||||
|
||||
@@ -196,4 +202,4 @@ This document evolves at phase transitions and milestone boundaries.
|
||||
4. Update Context with current state
|
||||
|
||||
---
|
||||
*Last updated: 2026-10-18 after Phase 19.1 completion*
|
||||
*Last updated: 2026-10-20 after Phase 19.4 completion*
|
||||
|
||||
@@ -37,7 +37,7 @@ Decimal phases appear between their surrounding integers in numeric order.
|
||||
- [x] **Phase 19: Chat and ChatChannels** - Port Golem15.Chat and Golem15.ChatChannels on lighthouse (completed 2026-10-17)
|
||||
- [x] **Phase 19.1: Chat satellites** - Port chatbots, chatvideo, forum, herald and userfriends (completed 2026-10-18)
|
||||
- [ ] **Phase 19.3: Framework transport and infrastructure for WavePath** - Cookie refresh, credentialed CORS, cache and Redis rate limits, S3 option, OpenAPI page, Turnstile
|
||||
- [ ] **Phase 19.4: OIDC provider on wristband** - Discovery, JWKS with key rotation, id_token, userinfo, consent and pairwise subjects
|
||||
- [x] **Phase 19.4: OIDC provider on wristband** - Discovery, JWKS with key rotation, id_token, userinfo, consent and pairwise subjects (completed 2026-10-20)
|
||||
- [ ] **Phase 19.5: Social login in sm-user-plugin** - Google and Facebook login with the SPA one-time-code handoff
|
||||
- [ ] **Phase 19.6: Two-factor auth and device flow in sm-user-plugin** - TOTP, WebAuthn, email and recovery codes, trusted devices, device authorization
|
||||
- [ ] **Phase 19.7: Generic MCP module** - Opt-in MCP endpoint, plugin-declared tools filtered by permissions, one connector per person via OAuth and a verified account link
|
||||
@@ -1299,7 +1299,7 @@ Plans:
|
||||
4. An existing issuer, its signing keys and client secrets can be imported so that relying parties keep working. The phase gets a security review.
|
||||
5. The `wristband` README and `docs/` pages are updated. The new code has unit tests, delivered in the phase's last plan.
|
||||
|
||||
**Plans:** 4/4 plans executed
|
||||
**Plans:** 4/4 plans complete
|
||||
|
||||
Plans:
|
||||
**Wave 1**
|
||||
@@ -1468,7 +1468,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
|
||||
| 19. Chat and ChatChannels | 7/7 | Complete | 2026-10-17 |
|
||||
| 19.1. Chat satellites | 6/6 | Complete | 2026-10-18 |
|
||||
| 19.3. Framework transport and infrastructure for WavePath | 6/6 | In Progress| |
|
||||
| 19.4. OIDC provider on wristband | 4/4 | In Progress| |
|
||||
| 19.4. OIDC provider on wristband | 4/4 | Complete | 2026-10-20 |
|
||||
| 19.5. Social login in sm-user-plugin | 0/TBD | Not started | - |
|
||||
| 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - |
|
||||
| 19.7. Generic MCP module | 0/TBD | Not started | - |
|
||||
|
||||
@@ -1,18 +1,18 @@
|
||||
---
|
||||
msd_state_version: "1.0"
|
||||
milestone: v1.0
|
||||
current_phase: "19.4"
|
||||
current_phase_name: OIDC provider on wristband (INSERTED)
|
||||
status: verifying
|
||||
stopped_at: Completed 19.4-04-PLAN.md
|
||||
last_updated: "2026-10-19T19:51:21.637Z"
|
||||
last_activity: 2026-10-19
|
||||
last_activity_desc: Phase 19.4 execution started
|
||||
state_head: 0f74b3b343787de80badb1f300875694b36cf55f
|
||||
current_phase: "19.3"
|
||||
current_phase_name: Framework transport and infrastructure for WavePath
|
||||
status: Ready for verification — 6/6 plans executed, UAT in progress (19.3-UAT.md)
|
||||
stopped_at: Phase 19.4 complete, ready to plan Phase 19.3
|
||||
last_updated: "2026-10-19T22:53:29.668Z"
|
||||
last_activity: 2026-10-20
|
||||
last_activity_desc: Phase 19.4 complete, transitioned to Phase 19.3
|
||||
state_head: 76c43432995fb33f3a173ab25e57dda4d7be4907
|
||||
progress:
|
||||
total_phases: 42
|
||||
completed_phases: 34
|
||||
total_plans: 208
|
||||
completed_phases: 35
|
||||
total_plans: 211
|
||||
completed_plans: 208
|
||||
gsd_state_version: "1.0"
|
||||
milestone_name: milestone
|
||||
@@ -25,14 +25,14 @@ milestone_name: milestone
|
||||
See: .planning/PROJECT.md (updated 2026-10-12)
|
||||
|
||||
**Core value:** An existing WinterCMS-shaped app can be ported plugin by plugin to a single Go binary without its frontend noticing: the PHP version's API contract is the acceptance test.
|
||||
**Current focus:** Phase 19.4 — OIDC provider on wristband (INSERTED)
|
||||
**Current focus:** Phase 19.3 — Framework transport and infrastructure for WavePath (UAT in progress)
|
||||
|
||||
## Current Position
|
||||
|
||||
Phase: 19.4 (OIDC provider on wristband (INSERTED)) — EXECUTING
|
||||
Plan: 4 of 4
|
||||
Status: Phase complete — ready for verification
|
||||
Last activity: 2026-10-19 — Phase 19.4 execution started
|
||||
Phase: 19.3 — Framework transport and infrastructure for WavePath
|
||||
Plan: 6 of 6
|
||||
Status: Ready for verification — 6/6 plans executed, UAT in progress (19.3-UAT.md)
|
||||
Last activity: 2026-10-20 — Phase 19.4 complete, transitioned to Phase 19.3
|
||||
|
||||
Progress: [████████░░] 83%
|
||||
|
||||
@@ -40,7 +40,7 @@ Progress: [████████░░] 83%
|
||||
|
||||
**Velocity:**
|
||||
|
||||
- Total plans completed: 101
|
||||
- Total plans completed: 105
|
||||
- Average duration: 21 min
|
||||
- Total execution time: 104 min
|
||||
|
||||
@@ -65,6 +65,7 @@ Progress: [████████░░] 83%
|
||||
| 18.1 | 9 | - | - |
|
||||
| 19 | 7 | - | - |
|
||||
| 19.1 | 6 | - | - |
|
||||
| 19.4 | 4 | - | - |
|
||||
|
||||
**Recent Trend:**
|
||||
|
||||
@@ -926,6 +927,7 @@ Recent decisions affecting current work:
|
||||
- Phase 8 UI gate: scripts/check-phase8-ui.mjs --final-gate's real Playwright browser matrix (32 UI-SPEC scenarios) is unimplemented (deliberate fatal() at check-phase8-ui.mjs:458, never authored by 08-05); stage_ui_harness must keep failing closed until a Playwright spec is authored. User approved Phase 8 closure on 2026-09-24 with this gap carried forward -- see 08-10-SUMMARY.md and .planning/phases/08-oauth2-1-authorization-server/deferred-items.md.
|
||||
- pending: push sm-user-plugin — 12.1-05 Task 3 condition (c) failed (`git ls-remote --tags origin v0.1.3` empty). Push summercms.go master and annotated tag v0.1.3 (local on df5cace) first, then the plugin, then fonoteka.go. Recorded in 12.1-05-SUMMARY.md.
|
||||
- 16.2-05 open UAT items: re-save HTML post 1 untouched (D-03 evidence vacuous), D-19 category edit check, root vhost install (frame-src), unpublish/delete test post 105
|
||||
- Phase 19.4: review warnings WR-01..06 are open (19.4-REVIEW-DISPOSITION.md); WR-01 (a replayed code does not revoke rotated refresh tokens) must be fixed before any client enables refresh. Release still pending: tag summercms, bump sm-oauthserver-plugin go.mod to sm-user-plugin v0.1.1 / summercms v0.2.4.
|
||||
|
||||
### Quick Tasks Completed
|
||||
|
||||
@@ -986,5 +988,5 @@ Items acknowledged and carried forward from previous milestone close:
|
||||
## Session Continuity
|
||||
|
||||
Last session: 2026-10-19T19:51:20.872Z
|
||||
Stopped at: Completed 19.4-04-PLAN.md
|
||||
Stopped at: Phase 19.4 complete, ready to plan Phase 19.3
|
||||
Resume file: None
|
||||
|
||||
Reference in New Issue
Block a user