golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(quick-batch-261105-oc4): security hardening batch, 5 items, 12 todos closed

Browse Source
This commit is contained in:
Jakub Zych
2026-11-05 18:46:35 +01:00
parent 27c98bf22a
commit 895248eef2
23 changed files with 2470 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

189
.planning/quick-batches/261105-oc4/BATCH.json Normal file
View File

@@ -0,0 +1,189 @@
{
"schema_version": 1,
"batch_id": "261105-oc4",
"created_at": "2026-11-05T16:31:21.798Z",
"options": {},
"base_revision": "5aa846c5e85368b534e03a1d19f441bb34de193c",
"items": [
{
"quick_id": "261105-oc5",
"client_id": null,
"description": "2FA hardening (todos 2026-10-26-activate-by-code-second-factor.md and 2026-10-26-mfa-factor-changes-need-reauth.md): sm-user-plugin ActivateByCode runs CheckLoginGates after VerifyActivationCode (finding F-1); sm-mfa-plugin requires password confirmation on factor-changing routes (WR-05) and vue-demo-app security.vue asks for the password",
"status": "complete",
"depends_on": [],
"planned_files": [
"../sm-user-plugin/controllers/api_controller.go",
"../sm-user-plugin/controllers/login_gates.go",
"../sm-user-plugin/classes/login_gate.go",
"../sm-user-plugin/login_gate_test.go",
"../sm-user-plugin/README.md",
"../sm-mfa-plugin/go.work",
"../sm-mfa-plugin/go.work.sum",
"../sm-mfa-plugin/classes/config.go",
"../sm-mfa-plugin/config/config.yaml",
"../sm-mfa-plugin/controllers/management.go",
"../sm-mfa-plugin/controllers/webauthn.go",
"../sm-mfa-plugin/factor_password_test.go",
"../sm-mfa-plugin/login_paths_test.go",
"../sm-mfa-plugin/settings_test.go",
"../sm-mfa-plugin/tracer_smoke_test.go",
"../sm-mfa-plugin/webauthn_smoke_test.go",
"../sm-mfa-plugin/webauthn_test.go",
"../sm-mfa-plugin/php_bodies_test.go",
"../sm-mfa-plugin/challenge_smoke_test.go",
"../sm-mfa-plugin/recovery_test.go",
"../sm-mfa-plugin/email_test.go",
"../sm-mfa-plugin/gate_test.go",
"../sm-mfa-plugin/trusted_test.go",
"../sm-mfa-plugin/passwordless_smoke_test.go",
"../sm-mfa-plugin/README.md",
"../sm-demo-app/vue-demo-app/app/lib/twoFactor.ts",
"../sm-demo-app/vue-demo-app/app/lib/twoFactor.test.ts",
"../sm-demo-app/vue-demo-app/app/composables/useTwoFactor.ts",
"../sm-demo-app/vue-demo-app/app/pages/account/security.vue",
"../sm-demo-app/vue-demo-app/i18n/locales/en.json",
"../sm-demo-app/vue-demo-app/i18n/locales/pl.json",
"../sm-demo-app/vue-demo-app"
],
"directory": null,
"worktree": null,
"dispatched_worktree": null,
"dispatched_branch": null,
"dispatched_base": null,
"wave": 0,
"commit": "b179e6b",
"failure_reason": null
},
{
"quick_id": "261105-oc6",
"client_id": null,
"description": "Chatchannels pin policy (todo chatchannels-pin-policy.md): sm-chatchannels-plugin PinMessage/UnpinMessage require CanManageContext or an optional contracts.PinPolicy, and verify the message belongs to the channel conversation; sm-demo-app answers the policy from its moderator group",
"status": "complete",
"depends_on": [],
"planned_files": [
"../sm-chatchannels-plugin/contracts/pin_policy.go",
"../sm-chatchannels-plugin/contracts/access_resolver.go",
"../sm-chatchannels-plugin/classes/channel_service.go",
"../sm-chatchannels-plugin/api/pins.go",
"../sm-chatchannels-plugin/pins_test.go",
"../sm-chatchannels-plugin/testdata/PHP_METHOD_MAP.md",
"../sm-chatchannels-plugin/README.md",
"../sm-demo-app/plugins/demo/classes/chat_context.go",
"../sm-demo-app/plugins/demo/classes/chat_context_test.go",
"../sm-demo-app/plugins/demo/chat.go",
"../sm-demo-app/reset_test.go",
"../sm-demo-app/README.md",
"../sm-demo-app/plugins/golem15/chatchannels",
"../sm-demo-app/chat_test.go"
],
"directory": null,
"worktree": null,
"dispatched_worktree": null,
"dispatched_branch": null,
"dispatched_base": null,
"wave": 0,
"commit": "a042536",
"failure_reason": null
},
{
"quick_id": "261105-oc7",
"client_id": null,
"description": "Chatvideo hardening (todos chatvideo-live-membership.md, chatvideo-dm-only-host-hook.md, chatvideo-incoming-handle-leak.md): sm-chatvideo-plugin honours LiveMembership and removes banned participants from the LiveKit room, adds an optional CanStartCall host hook for a DM-only rule; vue-chatvideo-layer useIncomingCalls closes stale session handles",
"status": "complete",
"depends_on": [],
"planned_files": [
"../sm-chatvideo-plugin/classes/video_service.go",
"../sm-chatvideo-plugin/classes/authorizer.go",
"../sm-chatvideo-plugin/classes/livekit.go",
"../sm-chatvideo-plugin/classes/revoked_access.go",
"../sm-chatvideo-plugin/boot.go",
"../sm-chatvideo-plugin/live_membership_test.go",
"../sm-chatvideo-plugin/contracts/call_policy.go",
"../sm-chatvideo-plugin/contracts/call_policy_test.go",
"../sm-chatvideo-plugin/api/errors.go",
"../sm-chatvideo-plugin/lang/en/lang.yaml",
"../sm-chatvideo-plugin/lang/pl/lang.yaml",
"../sm-chatvideo-plugin/call_policy_test.go",
"../sm-chatvideo-plugin/README.md",
"../sm-chatvideo-plugin/plugin.yaml",
"../sm-demo-app/plugins/golem15/chatvideo",
"../sm-demo-app/plugins/demo/video.go",
"../sm-demo-app/plugins/demo/plugin.go",
"../sm-demo-app/video_test.go",
"../sm-demo-app/config/golem15.chatvideo.yaml",
"../sm-demo-app/README.md",
"../vue-chatvideo-layer/app/composables/useIncomingCalls.ts",
"../vue-chatvideo-layer/vitest.config.ts",
"../vue-chatvideo-layer/tests/useIncomingCalls.test.ts",
"../vue-chatvideo-layer/README.md"
],
"directory": null,
"worktree": null,
"dispatched_worktree": null,
"dispatched_branch": null,
"dispatched_base": null,
"wave": 1,
"commit": "f996156",
"failure_reason": null
},
{
"quick_id": "261105-oc8",
"client_id": null,
"description": "lagoon/attach StaticHandler and StaticHandlerPublic send the stored Content-Disposition and X-Content-Type-Options nosniff (todo 2026-10-28-attach-static-handler-disposition.md)",
"status": "complete",
"depends_on": [],
"planned_files": [
"modules/lagoon/attach/static.go",
"modules/lagoon/attach/static_test.go",
"modules/lagoon/attach/lifecycle_test.go",
"modules/lagoon/README.md",
"docs/services/storage.md",
"docs/database/attachments.md",
"modules/surf/uploads.go"
],
"directory": null,
"worktree": null,
"dispatched_worktree": null,
"dispatched_branch": null,
"dispatched_base": null,
"wave": 0,
"commit": "27c98bf",
"failure_reason": null
},
{
"quick_id": "261105-oc9",
"client_id": null,
"description": "sm-demo-app hardening (todos check-local-jwt-out-of-argv.md, demo-chat-members-read-only.md, demo-nginx-livekit-rtc-only.md, demo-seed-moderation-lists-once.md, demo-vapid-runbook-pipefail.md)",
"status": "complete",
"depends_on": [],
"planned_files": [
"../sm-demo-app/plugins/demo/chat_api.go",
"../sm-demo-app/plugins/demo/classes/members.go",
"../sm-demo-app/plugins/demo/console/seed.go",
"../sm-demo-app/plugins/demo/console/seed_chat.go",
"../sm-demo-app/plugins/demo/console/seed_friends.go",
"../sm-demo-app/plugins/demo/plugin.go",
"../sm-demo-app/plugins/demo/updates/updates.go",
"../sm-demo-app/go.mod",
"../sm-demo-app/chat_test.go",
"../sm-demo-app/chat_smoke_test.go",
"../sm-demo-app/seed_chat_test.go",
"../sm-demo-app/README.md",
"../sm-demo-app/scripts/check-moderation.sh",
"../sm-demo-app/scripts/check-local.sh",
"../sm-demo-app/deploy/nginx/demo.summercms.io.conf",
"../sm-demo-app/scripts/check-deploy.sh",
"../sm-demo-app/scripts/check-live.sh",
"../sm-demo-app/DEPLOY.md"
],
"directory": null,
"worktree": null,
"dispatched_worktree": null,
"dispatched_branch": null,
"dispatched_base": null,
"wave": 2,
"commit": "9595606",
"failure_reason": null
}
]
}