golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(08-05): complete consent plan

Browse Source
This commit is contained in:
Jakub Zych
2026-09-23 21:11:45 +02:00
parent fac9648ac9
commit 7f37311120
3 changed files with 192 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
.planning/STATE.md
View File

@@ -3,14 +3,14 @@ gsd_state_version: 1.0
milestone: v1.0
milestone_name: milestone
status: executing
stopped_at: Completed 08-04-PLAN.md
last_updated: "2026-09-23T18:35:28.069Z"
stopped_at: Completed 08-05-PLAN.md
last_updated: "2026-09-23T19:11:27.527Z"
last_activity: 2026-09-23
progress:
total_phases: 15
completed_phases: 7
total_plans: 55
completed_plans: 49
completed_plans: 50
percent: 47
---
@@ -26,11 +26,11 @@ See: .planning/PROJECT.md (updated 2026-09-16)
## Current Position
Phase: 08 (oauth2-1-authorization-server) — EXECUTING
Plan: 5 of 10
Plan: 6 of 10
Status: Ready to execute
Last activity: 2026-09-23
Progress: [█████████░] 89%
Progress: [█████████░] 91%
## Performance Metrics
@@ -95,6 +95,7 @@ Progress: [█████████░] 89%
| Phase 08 P02 | 30min | 3 tasks | 14 files |
| Phase 08 P03 | 20min | 2 tasks | 6 files |
| Phase 08 P04 | 15min | 2 tasks | 5 files |
| Phase 08 P05 | 55min | 3 tasks | 12 files |
## Accumulated Context
@@ -227,6 +228,11 @@ Recent decisions affecting current work:
- [Phase 08]: [Phase 08 P04]: Token dispatch accepts grant_type=refresh_token per PHP's exact validity check but rotateRefreshToken always returns invalid_grant in this plan's scope; full rotation/lineage-kill (T-08-REFRESH-REPLAY) is 08-06's job per ROADMAP.md Wave 6
- [Phase 08]: [Phase 08 P04]: No routes.go/plugin.go changes -- POST /oauth/mcp/token is not mounted on the assembled app this plan; mounting happens once 08-05 wires consent and produces a real issued code
- [Phase 08]: [Phase 08 P04]: MintablePrefix changed from const to var (D-11 groundwork) with no config wiring added yet; default stays byte-identical inv_
- [Phase 08]: [Phase 08 P05] AuthCodeStore.MarkIssued gained scopes/collectionIDs/expiresAt params; ClientStore gained MarkConsented — PHP issueCode overwrites six columns in one UPDATE, not just code_hash/user_id; the narrower 08-02 signature could not persist consent's granted scopes or server-resolved collection pin
- [Phase 08]: [Phase 08 P05] wristband.Options gained CodeTTL (600s default), wired from the previously-unconsumed code_ttl_seconds config key — PHP OAuthCodeManager::CODE_TTL_SECONDS is a distinct constant from PENDING_TTL_SECONDS; IssueCode needs a fresh expiry from consent time
- [Phase 08]: [Phase 08 P05] Consent scope ordering follows auth.MintableScopes's declared read/write/ai order, not PHP array_intersect's incidental first-array order — 08-UI-SPEC.md explicitly documents canonical read -> write -> ai order as the fixed contract
- [Phase 08]: [Phase 08 P05] POST /oauth/mcp/token mounted in this plan, closing 08-04's deliberate D-09 deferral — Only once consent produces a real issued code does an end-to-end /token call through the real route have anything to exchange
- [Phase 08]: [Phase 08 P05] AUTH-05/06/07 remain Pending in REQUIREMENTS.md — Refresh rotation (08-06) and connected-apps list/revoke are still outstanding pieces of those requirements; this plan ships consent plus the token mount only
### Pending Todos
@@ -248,6 +254,6 @@ Items acknowledged and carried forward from previous milestone close:
## Session Continuity
Last session: 2026-09-23T18:35:28.050Z
Stopped at: Completed 08-04-PLAN.md
Last session: 2026-09-23T19:11:27.509Z
Stopped at: Completed 08-05-PLAN.md
Resume file: None