golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(phase-08): evolve PROJECT.md after phase completion

Browse Source
This commit is contained in:
Jakub Zych
2026-09-24 01:14:16 +02:00
parent 23f295824c
commit 95e8ccde3d
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
.planning/PROJECT.md
View File

@@ -50,6 +50,11 @@ Validated in Phase 7: User plugin and authentication
- [x] Locale resolves per request from preferred_locale then Accept-Language then app.locale, including while the lock is active
- [x] `surf.ServeCommand` and `app.Handler` publish the uploads `*blob.Bucket` so assembled avatar POST is 200
Validated in Phase 8: OAuth2.1 authorization server
- [x] Direct standard-library OAuth 2.1-style authorization server (`wristband`): RFC 8414 metadata, RFC 7591 dynamic registration, authorize with S256 PKCE and JWT-guarded consent, authorization_code and rotating refresh_token grants with replay lineage-kill, RFC 8707 resource handling, connected-app list/revoke, `fonoteka:oauth-client` operator command, and the `/me` bootstrap the unchanged fonoteka-mcp process uses
- [x] Byte parity with recorded PHP across all nine OAuth routes and a 17-step MCP lifecycle; the real unmodified fonoteka-mcp completes discovery, DCR, PKCE, consent, token, tool call, refresh, replay rejection and revoke against the Go binary; `scripts/check-phase8.sh` is the sign-off gate (its Playwright UI matrix stage is a named carried-forward follow-up)
### Active
Framework kernel
@@ -64,7 +69,7 @@ Data layer
HTTP and auth
- (user plugin / JWT / orgs / personal tokens / password lock — moved to Validated in Phase 7)
- [ ] OAuth2/OIDC provider (zitadel/oidc) that the MCP server and the ChatGPT connector use with the same flows as today (auth code + PKCE, refresh tokens, client management, `IssueOAuthClient` command)
- (OAuth authorization server — moved to Validated in Phase 8; shipped as the direct standard-library `wristband` package rather than zitadel/oidc)
- [ ] All 154 Płytarium API routes ported with byte-compatible request and response shapes (collections, albums, artists, genres, styles, ratings, reservations, wishlist, sharing and invitations, notifications, realtime channel auth, CSV import/export, locale, user context, credentials)
Background and integrations
@@ -174,4 +179,4 @@ This document evolves at phase transitions and milestone boundaries.
4. Update Context with current state
---
*Last updated: 2026-09-23 after Phase 7 completion*
*Last updated: 2026-09-24 after Phase 8 completion*