From 5978998ea638213a91008294eb53feceaa18ab8b Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Tue, 20 Oct 2026 00:53:34 +0200 Subject: [PATCH] docs(19.4): complete phase, OIDC provider on wristband --- .planning/PROJECT.md | 8 +++++++- .planning/ROADMAP.md | 6 +++--- .planning/STATE.md | 36 +++++++++++++++++++----------------- 3 files changed, 29 insertions(+), 21 deletions(-) diff --git a/.planning/PROJECT.md b/.planning/PROJECT.md index f7560130..1a179f71 100644 --- a/.planning/PROJECT.md +++ b/.planning/PROJECT.md @@ -59,6 +59,10 @@ Validated in Phase 19.1: Chat satellites - [x] Shared plugins sm-chatbots-plugin, sm-chatvideo-plugin (LiveKit), sm-forum-plugin (breakwater-sanitized markdown), sm-herald-plugin (web push, SSRF-guarded) and sm-userfriends-plugin run on SummerCMS behind JWT APIs, with GDPR cascades on `user.Deleting`; `scripts/check-phase19.1.sh` is the fail-closed gate (UAT and security 2026-10-18) +Validated in Phase 19.4: OIDC provider on wristband + +- [x] `wristband` has an OpenID Connect flavour (discovery, JWKS with RS256/ES256 and key rotation, id_token with nonce and at_hash, userinfo, resumable authorize with consent and account switching, pairwise subjects, opt-in refresh), and the new sm-oauthserver-plugin hosts it with PHP-path routes, branded consent and error pages, Clients and Branding admin screens and a Winter import that keeps kids, tokens and secrets; `scripts/check-phase19.4.sh` is the fail-closed gate (UAT and security 2026-10-20). PHP parity recording deferred to the WavePath cutover (D-14 amended) + ### Active Framework kernel @@ -177,6 +181,8 @@ Validated in Phase 18.1: Payment Gateway Subscriptions | The opt-in request log (`http.access_log`) records method, matched pattern, status and duration, never the URL path | Share and invitation tokens travel in paths (review WR-01); an unported route shows as a 404 with an empty pattern | ✓ Good (Phase 14.2) | | Subscription state comes from Stripe, not the event snapshot (Phase 18.1, D-21 amended) | Out-of-order webhooks regressed rows; the job re-retrieves the subscription under a per-subscription advisory lock, and a portal `cancel_at` counts as cancel at period end | ✓ Good (Phase 18.1 UAT, 2026-10-16) | | A soft (optional) plugin dependency still requires the provider module in `go.mod`; only `Requires()` omits it | A typed `Lookup` needs the package that declares the interface; optional means "skipped at Boot when absent", not "not compiled in" (`docs/plugins/extending.md`) | ✓ Good (Phase 19.1 UAT override, 2026-10-18) | +| OIDC on wristband with golang-jwt v5, not zitadel/oidc (Phase 19.4, `notes/2026-10-19-oidc-on-wristband-golang-jwt.md`) | wristband already owned the OAuth flows and PHP-compatible encoding; zitadel's own storage and routing would fight both. go-oidc and x/oauth2 are test-only, for relying-party interop | ✓ Good (Phase 19.4 UAT, 2026-10-20) | +| PHP OIDC parity is recorded at the WavePath cutover, not in Phase 19.4 (D-14 amended) | The harness ships and replays Go-side; recording needs the live PHP site, and WavePath's provider must not move until the replay is green | — Pending (todo `2026-10-19-record-php-oidc-parity-against-wavepath`) | ## Evolution @@ -196,4 +202,4 @@ This document evolves at phase transitions and milestone boundaries. 4. Update Context with current state --- -*Last updated: 2026-10-18 after Phase 19.1 completion* +*Last updated: 2026-10-20 after Phase 19.4 completion* diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index d811d955..112a7f86 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -37,7 +37,7 @@ Decimal phases appear between their surrounding integers in numeric order. - [x] **Phase 19: Chat and ChatChannels** - Port Golem15.Chat and Golem15.ChatChannels on lighthouse (completed 2026-10-17) - [x] **Phase 19.1: Chat satellites** - Port chatbots, chatvideo, forum, herald and userfriends (completed 2026-10-18) - [ ] **Phase 19.3: Framework transport and infrastructure for WavePath** - Cookie refresh, credentialed CORS, cache and Redis rate limits, S3 option, OpenAPI page, Turnstile -- [ ] **Phase 19.4: OIDC provider on wristband** - Discovery, JWKS with key rotation, id_token, userinfo, consent and pairwise subjects +- [x] **Phase 19.4: OIDC provider on wristband** - Discovery, JWKS with key rotation, id_token, userinfo, consent and pairwise subjects (completed 2026-10-20) - [ ] **Phase 19.5: Social login in sm-user-plugin** - Google and Facebook login with the SPA one-time-code handoff - [ ] **Phase 19.6: Two-factor auth and device flow in sm-user-plugin** - TOTP, WebAuthn, email and recovery codes, trusted devices, device authorization - [ ] **Phase 19.7: Generic MCP module** - Opt-in MCP endpoint, plugin-declared tools filtered by permissions, one connector per person via OAuth and a verified account link @@ -1299,7 +1299,7 @@ Plans: 4. An existing issuer, its signing keys and client secrets can be imported so that relying parties keep working. The phase gets a security review. 5. The `wristband` README and `docs/` pages are updated. The new code has unit tests, delivered in the phase's last plan. -**Plans:** 4/4 plans executed +**Plans:** 4/4 plans complete Plans: **Wave 1** @@ -1468,7 +1468,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 → | 19. Chat and ChatChannels | 7/7 | Complete | 2026-10-17 | | 19.1. Chat satellites | 6/6 | Complete | 2026-10-18 | | 19.3. Framework transport and infrastructure for WavePath | 6/6 | In Progress| | -| 19.4. OIDC provider on wristband | 4/4 | In Progress| | +| 19.4. OIDC provider on wristband | 4/4 | Complete | 2026-10-20 | | 19.5. Social login in sm-user-plugin | 0/TBD | Not started | - | | 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - | | 19.7. Generic MCP module | 0/TBD | Not started | - | diff --git a/.planning/STATE.md b/.planning/STATE.md index a70086d8..fb2c17c4 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -1,18 +1,18 @@ --- msd_state_version: "1.0" milestone: v1.0 -current_phase: "19.4" -current_phase_name: OIDC provider on wristband (INSERTED) -status: verifying -stopped_at: Completed 19.4-04-PLAN.md -last_updated: "2026-10-19T19:51:21.637Z" -last_activity: 2026-10-19 -last_activity_desc: Phase 19.4 execution started -state_head: 0f74b3b343787de80badb1f300875694b36cf55f +current_phase: "19.3" +current_phase_name: Framework transport and infrastructure for WavePath +status: Ready for verification — 6/6 plans executed, UAT in progress (19.3-UAT.md) +stopped_at: Phase 19.4 complete, ready to plan Phase 19.3 +last_updated: "2026-10-19T22:53:29.668Z" +last_activity: 2026-10-20 +last_activity_desc: Phase 19.4 complete, transitioned to Phase 19.3 +state_head: 76c43432995fb33f3a173ab25e57dda4d7be4907 progress: total_phases: 42 - completed_phases: 34 - total_plans: 208 + completed_phases: 35 + total_plans: 211 completed_plans: 208 gsd_state_version: "1.0" milestone_name: milestone @@ -25,14 +25,14 @@ milestone_name: milestone See: .planning/PROJECT.md (updated 2026-10-12) **Core value:** An existing WinterCMS-shaped app can be ported plugin by plugin to a single Go binary without its frontend noticing: the PHP version's API contract is the acceptance test. -**Current focus:** Phase 19.4 — OIDC provider on wristband (INSERTED) +**Current focus:** Phase 19.3 — Framework transport and infrastructure for WavePath (UAT in progress) ## Current Position -Phase: 19.4 (OIDC provider on wristband (INSERTED)) — EXECUTING -Plan: 4 of 4 -Status: Phase complete — ready for verification -Last activity: 2026-10-19 — Phase 19.4 execution started +Phase: 19.3 — Framework transport and infrastructure for WavePath +Plan: 6 of 6 +Status: Ready for verification — 6/6 plans executed, UAT in progress (19.3-UAT.md) +Last activity: 2026-10-20 — Phase 19.4 complete, transitioned to Phase 19.3 Progress: [████████░░] 83% @@ -40,7 +40,7 @@ Progress: [████████░░] 83% **Velocity:** -- Total plans completed: 101 +- Total plans completed: 105 - Average duration: 21 min - Total execution time: 104 min @@ -65,6 +65,7 @@ Progress: [████████░░] 83% | 18.1 | 9 | - | - | | 19 | 7 | - | - | | 19.1 | 6 | - | - | +| 19.4 | 4 | - | - | **Recent Trend:** @@ -926,6 +927,7 @@ Recent decisions affecting current work: - Phase 8 UI gate: scripts/check-phase8-ui.mjs --final-gate's real Playwright browser matrix (32 UI-SPEC scenarios) is unimplemented (deliberate fatal() at check-phase8-ui.mjs:458, never authored by 08-05); stage_ui_harness must keep failing closed until a Playwright spec is authored. User approved Phase 8 closure on 2026-09-24 with this gap carried forward -- see 08-10-SUMMARY.md and .planning/phases/08-oauth2-1-authorization-server/deferred-items.md. - pending: push sm-user-plugin — 12.1-05 Task 3 condition (c) failed (`git ls-remote --tags origin v0.1.3` empty). Push summercms.go master and annotated tag v0.1.3 (local on df5cace) first, then the plugin, then fonoteka.go. Recorded in 12.1-05-SUMMARY.md. - 16.2-05 open UAT items: re-save HTML post 1 untouched (D-03 evidence vacuous), D-19 category edit check, root vhost install (frame-src), unpublish/delete test post 105 +- Phase 19.4: review warnings WR-01..06 are open (19.4-REVIEW-DISPOSITION.md); WR-01 (a replayed code does not revoke rotated refresh tokens) must be fixed before any client enables refresh. Release still pending: tag summercms, bump sm-oauthserver-plugin go.mod to sm-user-plugin v0.1.1 / summercms v0.2.4. ### Quick Tasks Completed @@ -986,5 +988,5 @@ Items acknowledged and carried forward from previous milestone close: ## Session Continuity Last session: 2026-10-19T19:51:20.872Z -Stopped at: Completed 19.4-04-PLAN.md +Stopped at: Phase 19.4 complete, ready to plan Phase 19.3 Resume file: None