From 8a1d413b7d7fa70a5b3ac17a10a8080c6d24dc0c Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Mon, 19 Oct 2026 20:25:27 +0200 Subject: [PATCH] docs: capture todo - Record PHP OIDC parity against WavePath before the OIDC cutover --- .planning/STATE.md | 17 +++++--- ...record-php-oidc-parity-against-wavepath.md | 41 +++++++++++++++++++ 2 files changed, 53 insertions(+), 5 deletions(-) create mode 100644 .planning/todos/pending/2026-10-19-record-php-oidc-parity-against-wavepath.md diff --git a/.planning/STATE.md b/.planning/STATE.md index adcb8011..003bd94b 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -887,20 +887,27 @@ Recent decisions affecting current work: - [2026-10-01] [docs] Benchmark Płytarium on WinterCMS vs SummerCMS and publish a measured table — [todo file](.planning/todos/pending/2026-10-01-benchmark-the-application-on-wintercms-vs-summercms.md) - [2026-10-07] [sm-translate-plugin] Translate Messages as a Nuxt i18n JSON editor — [todo file](.planning/todos/pending/2026-10-07-translate-messages-as-nuxt-i18n-json-editor.md) -- [unknown] [summercms.go admin auth] Backend admin personal API tokens (deferred Apparatus PersonalApiToken) — [todo file](.planning/todos/pending/backend-admin-api-tokens.md) +- [2026-10-10] [framework] Prompt open admin and site tabs to reload when a new version is deployed — [todo file](.planning/todos/pending/2026-10-11-reload-open-apps-when-a-new-version-is-deployed.md) — Needs TBD. Ideas:. +- [2026-10-11] [lagoon/attach, fonoteka.go uploads] Uploads keep the client file extension, so a valid image can be served as HTML (stored XSS) — [todo file](.planning/todos/pending/2026-10-11-uploads-keep-client-extension-stored-xss.md) +- [unknown] [sm-user-plugin / cabana] Verified link between a frontend user and a backend user — [todo file](.planning/todos/pending/2026-10-17-frontend-backend-account-link.md) +- [unknown] [sm-user-plugin / pact] Plugins register their frontend permission codes in Go — [todo file](.planning/todos/pending/2026-10-17-plugin-registered-frontend-permissions.md) +- [2026-10-19] [sm-oauthserver-plugin] Record PHP OIDC parity against WavePath before the OIDC cutover — [todo file](.planning/todos/pending/2026-10-19-record-php-oidc-parity-against-wavepath.md) +- [unknown] [cabana / admin] Audit-log admin action runs with the admin id (toolbar actions) — [todo file](.planning/todos/pending/admin-action-audit-log.md) - [unknown] [summercms.go bonfire] Reject duplicate console command names in bonfire.NewRoot — [todo file](.planning/todos/pending/bonfire-duplicate-command-names.md) +- [unknown] [sm-faq-plugin] Port the FAQ plugin as sm-faq-plugin so FAQs become editable — [todo file](.planning/todos/pending/faq-plugin-port.md) +- [2026-10-09] [plugins] Expose author subtitle, description and avatar on the Journal author API — [todo file](.planning/todos/pending/journal-author-profile-fields.md) - [unknown] [summercms.go lagoon] lagoon README registers an after-commit GORM callback that can sort after the flush — [todo file](.planning/todos/pending/lagoon-readme-after-commit-callback-order.md) - [unknown] [sm-user-plugin mail] Port MailBlocker and the block-mail checkbox with the mailing work — [todo file](.planning/todos/pending/mailblocker-with-mailing.md) -- [unknown] [summercms.go] Nest framework packages under modules/ — same beach names — [todo file](.planning/todos/pending/nest-framework-packages-under-modules.md) -- [unknown] [summercms.go/modules] Short README.md per modules/* after the nest — [todo file](.planning/todos/pending/per-module-readmes-after-nest.md) +- [unknown] [sm-menu-plugin] Port the menu plugin as sm-menu-plugin so blog menus become editable — [todo file](.planning/todos/pending/menu-plugin-port.md) - [unknown] [summercms.go/modules/*/README.md, internal/docsite] Convert module README Go code blocks to compiled src= references — [todo file](.planning/todos/pending/readme-go-fences-src.md) - [unknown] [../fonoteka.go/README.md] Refresh fonoteka.go README — short status plus migrate/serve/login — [todo file](.planning/todos/pending/refresh-fonoteka-readme.md) -- [unknown] [summercms.go/README.md] Rewrite summercms.go README — onboard, recreate login, honest cutover — [todo file](.planning/todos/pending/rewrite-summercms-readme.md) - [unknown] [summercms.go internal/build] make:admin-controller output does not boot and names the model after the controller — [todo file](.planning/todos/pending/scaffold-admin-controller-incomplete.md) - [unknown] [summercms.go internal/build] Scaffolded files carry a DO NOT EDIT header, and make:command cannot reach the application — [todo file](.planning/todos/pending/scaffold-generated-header-and-command-deps.md) - [unknown] [summercms.go internal/build] make:model and make:migration in the same second produce migrations that run out of order — [todo file](.planning/todos/pending/scaffold-same-second-migration-order.md) +- [2026-10-12] [framework] Purge the Nuxt site cache on menu and FAQ admin saves (framework-level purge service) — [todo file](.planning/todos/pending/site-cache-purge-for-menu-and-faq.md) - [unknown] [sm-sitemap-plugin] Port the sitemap plugin 1:1 as sm-sitemap-plugin for the next blog project — [todo file](.planning/todos/pending/sitemap-plugin-port.md) -- [unknown] [summercms.go wristband] Neutral default resource URL in wristband.DefaultOptions — [todo file](.planning/todos/pending/wristband-neutral-resource-default.md) +- [unknown] [sm-sitemap-plugin] Sitemap - replace the browser XSLT view before Chromium drops XSLT — [todo file](.planning/todos/pending/sitemap-xslt-browser-deprecation.md) +- [unknown] [sm-user-plugin] Let the sm-user-plugin console commands open their own database — [todo file](.planning/todos/pending/user-plugin-commands-open-database.md) ### Blockers/Concerns diff --git a/.planning/todos/pending/2026-10-19-record-php-oidc-parity-against-wavepath.md b/.planning/todos/pending/2026-10-19-record-php-oidc-parity-against-wavepath.md new file mode 100644 index 00000000..b4d0bed1 --- /dev/null +++ b/.planning/todos/pending/2026-10-19-record-php-oidc-parity-against-wavepath.md @@ -0,0 +1,41 @@ +--- +created: 2026-10-19T18:07:20.071Z +title: Record PHP OIDC parity against WavePath before the OIDC cutover +area: sm-oauthserver-plugin +severity: major +files: + - ../sm-oauthserver-plugin/testdata/parity/README.md + - ../sm-oauthserver-plugin/testdata/parity/flows/ + - ../sm-oauthserver-plugin/testdata/parity/deviations.yaml + - ../sm-oauthserver-plugin/parity_test.go + - ../sm-oauthserver-plugin/scripts/winter-export.sql +g15office: govfaqir +--- + +## Problem + +Phase 19.4 shipped the tide record/replay harness for the OIDC provider in sm-oauthserver-plugin, but the PHP side was never recorded: at the 19.4-03 Task 5 checkpoint the user chose `skip-parity` (2026-10-19). So D-14 ("relying parties notice no difference from the PHP Golem15.OAuthServer plugin") is proven only for the Go side. `TestPHPParityReplay` and `TestIDTokenShapeParity` skip with "no PHP recordings", and they fail when `PHASE194_REQUIRE_PARITY=1` is set. + +The user decided that Phase 19.4 passes without the recording. Recording becomes a **preliminary task of the future WavePath cutover phase** (the WavePath work in the Phase 31+ series, not yet planned). WavePath's OIDC provider must not move to the Go plugin until this replay is green. + +## Solution + +Follow the runbook in `../sm-oauthserver-plugin/testdata/parity/README.md`: + +1. Start WavePath locally (`/media/nvme/dev/jz/wavepath.org`, MariaDB, Golem15.OAuthServer enabled) so that `{base_url}/.well-known/openid-configuration` answers 200. +2. In its backend, create a dedicated parity user and an OIDC client "Parity RP": + - redirect URI `https://rp.example.test/callback` + - scopes openid, profile and email + - active, not a development client, not yet authorized by the parity user +3. Log in as the parity user in a browser and copy the `token` cookie. +4. Export with `scripts/winter-export.sql` to `~/.config/summercms/parity-oauthserver.jsonl`. +5. Write `~/.config/summercms/parity-oauthserver.vars` (mode 0600) with: + - base_url, issuer, client_id, client_secret, session_token + - the runbook's PKCE pair +6. Run `summer parity:record` for all ten spec flows. Do not pass `--rules`. +7. Delete PHP's Set-Cookie headers from the fixtures. `TestParityFixturesHoldNoSecrets` fails while any remain. +8. Write `seed.json`, `winter-export.jsonl` (hashes only) and `id_token_shape.json`. +9. Settle every replay difference with a fix, or with a `deviations.yaml` entry whose reason cites a D-number. Known open items: + - Cache-Control on OIDC redirects: Go sends `no-store, private`, PHP sends `no-cache, private`. + - id_token header member order is not compared. +10. The test is done when `PHASE194_REQUIRE_PARITY=1 go test -run '^(TestPHPParityReplay|TestIDTokenShapeParity)$' ./...` passes in sm-oauthserver-plugin.