golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(16.2): complete the validation map

Browse Source
This commit is contained in:
Jakub Zych
2026-10-10 16:13:21 +02:00
parent 3da2fd65b0
commit 7e113013a3
1 changed files with 44 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

81
.planning/phases/16.2-plugin-provided-field-types-and-the-blog-editor-formwidget/16.2-VALIDATION.md
View File

@@ -4,8 +4,8 @@ slug: "plugin-provided-field-types-and-the-blog-editor-formwidget"
# status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
# audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
status: draft
nyquist_compliant: false
wave_0_complete: false
nyquist_compliant: true
wave_0_complete: true
created: "2026-10-09"
revised: "2026-10-10"
---
@@ -41,39 +41,46 @@ revised: "2026-10-10"
| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
| TBD | — | — | D-11 | — | Alias collision fails boot | unit | `go test -short ./modules/cabana -run TestFieldTypeRegistry` | ❌ W0 | ⬜ pending |
| TBD | — | — | D-12.1 | — | Unknown plugin key fails boot | unit | `go test -short ./modules/cabana -run TestFieldTypeOptions` | ❌ W0 | ⬜ pending |
| TBD | — | — | D-12.2 / D-10 | XSS | Decode value stored per locale; FormFieldError → 422 with no write; markup never answers 422 | unit | `go test -short ./modules/cabana -run TestFieldTypeDecode` | ❌ W0 | ⬜ pending |
| TBD | — | — | D-10 | — | Decode notices → meta.notices (field, locale, localized, capped); no notices key when nothing was reported | unit | `go test -short ./modules/cabana -run TestFieldTypeNotices` | ❌ W0 | ⬜ pending |
| TBD | — | — | D-10 / D-02 | XSS | Journal Decode strips per locale and reports what it removed; clean HTML byte-identical with no notice; report empty exactly when nothing changed | unit | `go -C ../sm-journal-plugin test -short ./classes -run 'TestBlogEditorDecode\|TestBlogEditorNotices\|TestSanitizeHTMLReport'` | ❌ W0 | ⬜ pending |
| TBD | — | — | D-05 | XSS | Editor-output corpus passes SanitizeHTML byte for byte; the four editor rules admit nothing else; iframe still stripped | unit | `go -C ../sm-journal-plugin test -short ./classes -run TestEditorOutputPassesPolicy` | ❌ W0 | ⬜ pending |
| TBD | — | — | D-10 | XSS | Save notices render as text under the field and in the toast; stored value reloaded into the element | vitest | `npm --prefix admin test -- FormField formState PluginField` | ❌ W0 | ⬜ pending |
| TBD | — | — | D-03 | — | Untouched value writes nothing and reports nothing | unit | `go test -short ./modules/cabana -run TestFieldTypeUntouched` | ❌ W0 | ⬜ pending |
| TBD | — | — | D-12.4 | — | List column uses plugin formatter | unit | `go test -short ./modules/cabana -run TestFieldTypeListValue` | ❌ W0 | ⬜ pending |
| TBD | — | — | D-13 / D-15 | — | Schema/OpenAPI/TS in sync | unit + script | `bash scripts/check-admin-openapi.sh --check` | ✅ | ⬜ pending |
| TBD | — | — | D-13 | — | PluginField binds value, emits on summer-change | vitest | `npm --prefix admin test -- PluginField` | ❌ W0 | ⬜ pending |
| TBD | — | — | D-18 | upload | Auth, CSRF, permission, scope, size cap, type allowlist | unit | `go test -short ./modules/cabana -run TestFieldUpload` | ❌ W0 | ⬜ pending |
| TBD | — | — | D-07 | — | Markdown post served as content_html | unit | `go -C ../sm-journal-plugin test -short ./classes -run TestBlogEditorLoad` | ❌ W0 | ⬜ pending |
| TBD | — | — | D-03 / D-04 | XSS | Element round-trips; rawHtml card shows escaped text; links limited to http, https, mailto, relative | vitest | `npm --prefix ../sm-journal-plugin test` | ❌ W0 | ⬜ pending |
| TBD | — | — | D-05 | — | Committed editor corpus equals the editor's current output | vitest | `npm --prefix ../sm-journal-plugin test -- corpus` | ❌ W0 | ⬜ pending |
| TBD | — | — | todo resave | — | Untouched re-save byte-identical, no notices | integration (Postgres) | `go -C ../sm-journal-plugin test -run TestPostsAdminResaveKeepsHTML ./...` | ✅ (tighten) | ⬜ pending |
| TBD | — | — | D-10 / D-02 | XSS | Admin post save strips unsafe markup in both columns per locale and reports it (no 422) | integration (Postgres) | `go -C ../sm-journal-plugin test -run TestPostsAdminSaveSanitizesHTML ./...` | ✅ (rewrite) | ⬜ pending |
| TBD | — | — | D-19 / D-10 | XSS | Category content stripped with a notice, blank to NULL, no 422 | integration (Postgres) | `go -C ../sm-journal-plugin test -run 'TestCategoriesAdminContent\|TestCategoriesAdminBlogEditor' ./...` | ✅ (rewrite) | ⬜ pending |
| TBD | — | — | D-17 / D-05 | iframe | Embed allowlist and id regex; sanitize first, expand last at each sink; stored iframe stripped; corpus safe under the mirror; corpus copies identical | node:test + cmp | `npm --prefix ../vue-journal-layer test && cmp ../vue-journal-layer/tests/fixtures/editor-corpus.json ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` | ❌ W0 | ⬜ pending |
| TBD | — | — | docs | — | README/docs identifiers exist | unit | `go test ./cmd/summer -run TestDocsTree` | ✅ | ⬜ pending |
| 16.2-01-T2, 16.2-06-T2 | 01, 06 | 1, 4 | D-11 | T-16.2 boot | Alias pattern, core and cross-plugin clash (both IDs named), element prefix and reserved tag, missing Decode, missing AdminFS, asset path and extension fail boot | unit | `go test -count=1 -run '^TestFieldTypeRegistry$' ./modules/cabana` | ✅ | ✅ green |
| 16.2-01-T2, 16.2-06-T2 | 01, 06 | 1, 4 | D-12.1 | — | Option key pattern, field-key clash and repeats fail boot; an undeclared fields.yaml key fails naming field and key | unit | `go test -count=1 -run '^TestFieldTypeOptions$' ./modules/cabana` | ✅ | ✅ green |
| 16.2-01-T2, 16.2-06-T2 | 01, 06 | 1, 4 | D-12 | — | General keys accepted, core type keys refused, option values of every YAML kind decoded, CheckOptions error surfaced; CompileForm core-only; settings and relation forms refuse plugin types | unit | `go test -count=1 -run '^TestFieldTypeCompile$' ./modules/cabana` | ✅ | ✅ green |
| 16.2-01-T2, 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-12.2 / D-10 | XSS | FormFieldError on the default or a non-default locale → 422 on the field, no write, no notices; other errors and a non-string translatable value → opaque 500 | unit | `go test -count=1 -run '^TestFieldTypeDecode$' ./modules/cabana` | ✅ | ✅ green |
| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-10 | — | Notices → meta.notices with field and locale, localized through phrasebook (Count plural, Params), ≤ 10 per field and locale, ≤ 500 runes; no notices key when none | unit | `go test -count=1 -run '^TestFieldTypeNotices$' ./modules/cabana` | ✅ | ✅ green |
| 16.2-03-T1, 16.2-06-T2 | 03, 06 | 2, 4 | D-10 / D-02 | XSS | Journal Decode strips per locale and reports; clean HTML byte-identical with no notice; report empty exactly when nothing changed; notices only when stripped | unit | `go -C ../sm-journal-plugin test -count=1 -run '^(TestBlogEditorDecode\|TestBlogEditorNotices\|TestSanitizeHTMLReport)$' ./classes/` | ✅ | ✅ green |
| 16.2-03-T3, 16.2-06-T2 | 03, 06 | 2, 4 | D-05 | XSS | Editor corpus passes SanitizeHTML byte for byte; the four editor rules admit nothing else (other providers, malformed ids, data attributes elsewhere, iframe stripped) | unit | `go -C ../sm-journal-plugin test -count=1 -run '^TestEditorOutputPassesPolicy$' ./classes/` | ✅ | ✅ green |
| 16.2-01-T4, 16.2-06-T3 | 01, 06 | 1, 4 | D-10 | XSS | Save notices render as literal text under the field (aria-describedby) and in the toast; stored value reloaded into the element | vitest | `npm --prefix admin test -- tests/form/FormField.test.ts tests/form/formState.test.ts tests/form/PluginField.test.ts` | ✅ | ✅ green |
| 16.2-01-T3, 16.2-06-T1 | 01, 06 | 1, 4 | D-03 | — | Untouched value writes and reports nothing; one changed locale writes only that locale; canonical JSON comparison; create never skips | unit | `go test -count=1 -run '^TestFieldTypeUntouched$' ./modules/cabana` | ✅ | ✅ green |
| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-12.3 | — | Load per locale; nil Load keeps the stored value; Load errors (FormFieldError included) are opaque 500 | unit | `go test -count=1 -run '^TestFieldTypeLoad$' ./modules/cabana` | ✅ | ✅ green |
| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-12.4 | — | List column uses ListValue with the request ctx; nil ListValue keeps the raw value | unit | `go test -count=1 -run '^TestFieldTypeListValue$' ./modules/cabana` | ✅ | ✅ green |
| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-14 | — | FieldWritesFromContext copies; false outside a save; Before and After hooks of create and update see the same writes | unit | `go test -count=1 -run '^TestFieldTypeWrites$' ./modules/cabana` | ✅ | ✅ green |
| 16.2-01-T2, 16.2-06-T2 | 01, 06 | 1, 4 | D-13 | — | GET /field-types sorted, versioned asset URLs under the admin prefix, [] lists, 401 without a backend session | unit | `go test -count=1 -run '^TestFieldTypesRoute$' ./modules/cabana` | ✅ | ✅ green |
| 16.2-01-T2, 16.2-01-T4 | 01 | 1 | D-13 / D-15 | — | Schema/OpenAPI/TS in sync; admin dist current | unit + script | `bash scripts/check-admin-openapi.sh --check && bash scripts/check-admin-dist.sh` | ✅ | ✅ green |
| 16.2-01-T2, 16.2-01-T4, 16.2-06-T1, 16.2-06-T3 | 01, 06 | 1, 4 | D-13 / D-03 | — | PluginField binds value, takes summer-change, never re-sets an echoed value; fieldTypes loads each script once, global styles stay on, nothing rejects; registry renders PluginField / MLPluginField | vitest | `npm --prefix admin test -- tests/form/PluginField.test.ts tests/app/fieldTypes.test.ts tests/form/registry.test.ts tests/list/ListView.test.ts` | ✅ | ✅ green |
| 16.2-01-T3, 16.2-03-T2, 16.2-06-T2 | 01, 03, 06 | 1, 2, 4 | D-18 | upload | Upload 201, 403, 401, 404 (core field, no Upload, unknown field, context refusal, unknown controller), 413, 422 (FormFieldError, missing/misnamed/extra part, not multipart), opaque 500; Journal sniffing refuses disguised files and svg; safe names; StoreMedia never overwrites | unit | `go test -count=1 -run '^TestFieldUpload$' ./modules/cabana && go -C ../sm-journal-plugin test -count=1 -run '^(TestBlogEditorUpload\|TestStoreMedia)$' ./classes/` | ✅ | ✅ green |
| 16.2-03-T1, 16.2-06-T1 | 03, 06 | 2, 4 | D-07 | — | HTML served verbatim (leading white space, comment); markdown served as content_html, empty falls back to FormatHTML; nil and empty pointers give "" | unit | `go -C ../sm-journal-plugin test -count=1 -run '^TestBlogEditorLoad$' ./classes/` | ✅ | ✅ green |
| 16.2-03-T1, 16.2-06-T2 | 03, 06 | 2, 4 | D-02 / D-14 | — | Posts hooks: default write copied to content_html, non-default writes through the TranslationWriter, nothing for untouched content or without a writer | unit | `go -C ../sm-journal-plugin test -count=1 -run '^TestPostsEditorHooks$' ./controllers/` | ✅ | ✅ green |
| 16.2-02-T2, 16.2-02-T3, 16.2-06-T1, 16.2-06-T3 | 02, 06 | 1, 4 | D-03 / D-04 | XSS | Element returns an untouched value byte for byte through Source, tabs, preview and reattach; raw HTML cards are escaped text; every raw tag rule; figures; links limited to http, https, mailto, relative; block reuse after edit, deletion and insertion | vitest | `npm --prefix ../sm-journal-plugin test` | ✅ | ✅ green |
| 16.2-02-T3 | 02 | 1 | D-05 | — | Committed editor corpus equals the editor's current output | vitest | `npm --prefix ../sm-journal-plugin test -- tests/blogeditor/corpus.test.ts` | ✅ | ✅ green |
| 16.2-03-T1, 16.2-06-T1 | 03, 06 | 2, 4 | todo resave / D-03 | — | Untouched GET-then-PUT of an HTML and a markdown post byte-identical with no notices and no translated content added; a clean edited save stores equal content and content_html per locale | integration (Postgres) | `go -C ../sm-journal-plugin test -count=1 -run TestPostsAdminResaveKeepsHTML .` | ✅ | ⚠️ Docker host (manual) |
| 16.2-03-T1 | 03 | 2 | D-10 / D-02 | XSS | Admin post save strips unsafe markup in both columns per locale and reports it (no 422) | integration (Postgres) | `go -C ../sm-journal-plugin test -count=1 -run TestPostsAdminSaveSanitizesHTML .` | ✅ | ⚠️ Docker host (manual) |
| 16.2-03-T2, 16.2-06-T2 | 03, 06 | 2, 4 | D-19 / D-10 | XSS | Category content: untouched saves keep imported markup and NULL, clean edit as sent, unsafe edit stripped with notices (no 422), blank to NULL, editor upload under journal/categories | integration (Postgres) | `go -C ../sm-journal-plugin test -count=1 -run '^(TestCategoriesAdminContent\|TestCategoriesAdminBlogEditor)$' .` | ✅ | ⚠️ Docker host (manual) |
| 16.2-01-T3, 16.2-06-T2 | 01, 06 | 1, 4 | D-12 / D-18 | upload | Real-database create, show, untouched and changed update, refused update rolls back, upload in and out of the FormExtendQuery scope | integration (Postgres) | `go test -count=1 -run '^TestFieldTypeSavePostgres$' ./modules/cabana` | ✅ | ⚠️ Docker host (manual) |
| 16.2-04-T1, 16.2-06-T3 | 04, 06 | 2, 4 | D-17 / D-05 | iframe | Embed allowlist and id regex; sanitize first, expand last at each sink, never in payload transforms; stored iframe stripped; corpus safe under the mirror; Go negatives stripped the same way; corpus copies identical | node:test + cmp | `npm --prefix ../vue-journal-layer test && cmp ../vue-journal-layer/tests/fixtures/editor-corpus.json ../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` | ✅ | ✅ green |
| 16.2-01-T2, 16.2-06-T3 | 01, 06 | 1, 4 | docs | — | README/docs identifiers exist; plugin dist current | unit + script | `go test -count=1 ./cmd/summer -run TestDocsTree && bash ../sm-journal-plugin/scripts/check-dist.sh` | ✅ | ✅ green |
| 16.2-06-T3 | 06 | 4 | all | T-16.2-29 | Phase gate: every runnable stage fail-closed, detectors self-tested | script | `bash scripts/check-phase16.2.sh --self-test && bash scripts/check-phase16.2.sh --all` | ✅ | ✅ green |
*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky or manual (Docker host)*
---
## Wave 0 Requirements
- [ ] `../sm-journal-plugin/package.json`, `package-lock.json`, `vite.config.ts`, vitest + happy-dom setup, `scripts/check-dist.sh`
- [ ] `../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` (plan 02) and its layer copy `../vue-journal-layer/tests/fixtures/editor-corpus.json` (plan 04)
- [ ] `../sm-journal-plugin/classes/editor_policy_test.go` (plan 03)
- [ ] `modules/cabana/field_type_test.go` — registry, options, decode/skip, list, upload
- [ ] `admin/tests/form/PluginField.test.ts` — stub custom element
- [ ] `../vue-journal-layer/tests/embeds.test.ts`
- [x] `../sm-journal-plugin/package.json`, `package-lock.json`, `vite.config.ts`, vitest + happy-dom setup, `scripts/check-dist.sh` (plan 02)
- [x] `../sm-journal-plugin/tests/blogeditor/fixtures/editor-corpus.json` (plan 02) and its layer copy `../vue-journal-layer/tests/fixtures/editor-corpus.json` (plan 04)
- [x] `../sm-journal-plugin/classes/editor_policy_test.go` (plan 03, extended in plan 06)
- [x] `modules/cabana/field_type_test.go` — registry, options, compile, decode, notices, skip, load, list, writes, routes, upload (plan 06)
- [x] `admin/tests/form/PluginField.test.ts` — stub custom element (plan 01, extended in plan 06)
- [x] `../vue-journal-layer/tests/embeds.test.ts` (plan 04, extended in plan 06)
---
@@ -81,7 +88,7 @@ revised: "2026-10-10"
| Behavior | Requirement | Why Manual | Test Instructions |
|----------|-------------|------------|-------------------|
| Testcontainers Postgres suites | todo resave | No Docker on the dev machine | Run on a Docker host, as in 16.1 |
| Testcontainers Postgres suites | todo resave, D-03, D-10, D-12, D-18, D-19 | No Docker on the dev machine | On a Docker host: `bash scripts/check-phase16.2.sh postgres` (cabana `./modules/cabana` incl. TestFieldTypeSavePostgres and TestListRelationSearchPostgres; sm-journal-plugin `./...` incl. TestPostsFormCompiles, TestPostsAdminCreateSmoke, TestPostsAdminResaveKeepsHTML, TestPostsAdminSaveSanitizesHTML, TestCategoriesAdminContent, TestCategoriesAdminBlogEditor, TestJournalSVGEmbed) |
| Editing imported posts on UAT | Phase goal | Real browser editing of live posts | Open an imported post, save untouched (no notice, md5 unchanged), then edit and save; compare columns |
| Strip and report on UAT | D-10 (amended) | Needs the admin session and a real save | Add a harmless style block and onclick in the source tab of an unpublished test post, save: it succeeds, the notice names both, the stored columns are equal and contain neither (plan 05 Task 3) |
@@ -89,11 +96,11 @@ revised: "2026-10-10"
## Validation Sign-Off
- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
- [ ] Wave 0 covers all MISSING references
- [ ] No watch-mode flags
- [ ] Feedback latency < 120s
- [ ] `nyquist_compliant: true` set in frontmatter
- [x] All tasks have `<automated>` verify or Wave 0 dependencies
- [x] Sampling continuity: no 3 consecutive tasks without automated verify
- [x] Wave 0 covers all MISSING references
- [x] No watch-mode flags
- [x] Feedback latency < 120s (the gate's runnable stages; the Docker suites are the manual row)
- [x] nyquist_compliant set to true in the frontmatter
**Approval:** pending
**Approval:** automated map complete (plan 06, 2026-10-10); the Docker-host suites and the UAT rows above stay manual