golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(phase-19.6): lock post-research decisions D-18 to D-20

Browse Source
This commit is contained in:
Jakub Zych
2026-10-21 15:54:53 +02:00
parent c8cbcd5cc7
commit 5c474b4a4f
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
.planning/phases/19.6-two-factor-auth-and-device-flow-in-sm-user-plugin/19.6-CONTEXT.md
View File

@@ -102,6 +102,15 @@ Repos: `sm-mfa-plugin` (new), `sm-user-plugin`, `sm-sociallogin-plugin` (it call
### Adoption
- **D-17:** **sm-demo-app and sm-bm-app** mount mfa in this phase, and both get the device flow through the user plugin pin bump. fonoteka.go does not mount mfa. Its guard test `fonoteka/phase07_coverage_test.go:79` (`TestNoDeferredRoutesResolve`) fails once `/devices` routes resolve, so it is updated in the fonoteka pointer-bump commit. Commit order: sm-user-plugin → sm-mfa-plugin and sociallogin pushed → app pointer bumps as separate commits. Push, tag and repo creation need the user's go-ahead.
### Decided after research (2026-10-21)
- **D-18:** **Security hardening beyond PHP, all four adopted** (RESEARCH A6, A8, A9, A10):
- A6: a per-user second-factor failure cap: 10 failed verifications in 15 minutes refuse new challenges and verifies with the generic 401 until the window passes. It is counted from challenge rows in the DB, so it holds across instances. Failed challenge rows are kept for the window.
- A8: `email/send` and `verify method=email` work only when the user's email method is enabled; otherwise they get the same 401 `{"error":"Invalid or expired challenge."}`. At most 3 sends per challenge.
- A9: the mail's `expiry_minutes` is `min(email code TTL, remaining challenge time)`.
- A10: restoring a soft-deleted account moves after the 2FA gate, so the password alone cannot reactivate an account. This refines D-02's gate placement: the password step runs first, then the gate, then the undelete and the reactivate mail.
- **D-19:** **The first recovery-code set is returned.** When an enable or confirm call creates a new set, its response carries an additive `recovery_codes` key. Responses that create no set are unchanged from PHP.
- **D-20:** **The demo gets a 2FA UI** in `vue-demo-app` (`../vue-demo-app`, served by sm-demo-app): TOTP setup with the QR code and confirm, the recovery codes shown once, disable, and the login challenge step (TOTP or recovery code). sm-bm-app stays API-only. WebAuthn, email codes and trusted devices in the demo UI are optional.
### Claude's Discretion
- Go identifiers for the gate interface, registry and payloads.
- The QR library (research, D-04).