golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: fill G2 in the external-escalation reply

Browse Source
This commit is contained in:
Jakub Zych
2026-10-22 21:36:43 +02:00
parent 3026cf61fb
commit 76694c7cb9
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.planning/notes/2026-10-22-external-user-plugin-escalations.md
View File

@@ -17,7 +17,7 @@ Reviewed 2026-10-22. The list is `golem15.user` (sm-user-plugin), not cabana adm
| # | Their label | Verdict | Quick / todo | g15office | Status | Shipped |
|---|---|---|---|---|---|---|
| 1 | G2 login ignores `is_activated` | Fix | [2026-10-22-user-login-ignores-is-activated.md](../todos/pending/2026-10-22-user-login-ignores-is-activated.md) | 3r4or1ex | open | |
| 1 | G2 login ignores `is_activated` | Fix | [261022-tb4](../quick/261022-tb4-password-login-must-refuse-is-activated-/) · [todo](../todos/pending/2026-10-22-user-login-ignores-is-activated.md) | 3r4or1ex | done (unreleased) | `15ff979` (next tag v0.1.9) |
| 2 | G3 cookie-only 401 | Fix remaining four; logout already done | [2026-10-22-user-session-routes-ignore-cookie.md](../todos/pending/2026-10-22-user-session-routes-ignore-cookie.md) | kkknstxl | open | |
| 3 | G4 logout blacklist under `serve` | Fix | [2026-10-22-user-logout-blacklist-missing-under-serve.md](../todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md) | ud0gficu | open | |
| 4 | G6 `/update` email without proof | Decline | — | — | declined | n/a |
@@ -70,7 +70,7 @@ Thanks for the escalation list. We reviewed the current golem15.user plugin (and
G2 — login ignores is_activated
Agreed. require_activation defaults to true and /register already withholds a token in admin mode; /login did not check is_activated. That is not the same as deactivation (deleted_at), which stays self-service: a later password login still restores the account.
TODO: shipped in sm-user-plugin vX.Y.Z — inactive accounts get the same opaque invalid-login response as a bad password when require_activation is true.
Shipped as sm-user-plugin 15ff979 (unreleased; next tag v0.1.9 unless this batch is tagged together): with require_activation on (the default), /login answers an account that is not activated with the same opaque invalid-login response as a bad password (counted as a failed attempt); deactivation stays self-service. /activate still serves a not-activated session so the mailed-code flow works.
G3 — some routes ignore the cookie
Partly already fixed, rest agreed. POST /logout already accepts the token/auth_token cookies (and blacklists every JWT the request carries). GET /fetch, POST /refresh, POST /update and POST /change-password still required the Authorization header.