golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(quick-261022-x7a): user-plugin golem15.user.password.public_routes switch, login/forgot/reset 404 when false

Browse Source
This commit is contained in:
Jakub Zych
2026-10-23 00:15:49 +02:00
parent e5dd4579a8
commit a26ee2b72d
4 changed files with 504 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
.planning/STATE.md
View File

@@ -5,10 +5,10 @@ current_phase: "19.7"
current_phase_name: Generic MCP module (INSERTED)
status: executing
stopped_at: Completed 19.7-01-PLAN.md
last_updated: "2026-10-22T22:08:03.180Z"
last_activity: 2026-10-22
last_activity_desc: "Completed quick task 261022-wah: user-plugin opt-in token_cookie session cookie and cookie-carried /refresh rotation"
state_head: d1a15a6f5fada08bbd94ccf9224affce115f41c7
last_updated: "2026-10-22T22:15:45.219Z"
last_activity: 2026-10-23
last_activity_desc: "Completed quick task 261022-x7a: user-plugin golem15.user.password.public_routes switch (login/forgot/reset 404 when false)"
state_head: e5dd4579a8a1503b9711fa27bc140e5b594baa88
progress:
total_phases: 45
completed_phases: 37
@@ -32,7 +32,7 @@ See: .planning/PROJECT.md (updated 2026-10-22)
Phase: 19.7 (Generic MCP module (INSERTED)) — EXECUTING
Plan: 2 of 5
Status: Ready to execute
Last activity: 2026-10-22 — Completed quick task 261022-wah: user-plugin opt-in token_cookie session cookie and cookie-carried /refresh rotation
Last activity: 2026-10-23 — Completed quick task 261022-x7a: user-plugin golem15.user.password.public_routes switch (login/forgot/reset 404 when false)
Progress: [████████░░] 82%
@@ -1051,6 +1051,7 @@ Recent decisions affecting current work:
| 261022-usi | User plugin jwt blacklist and GORM hooks wired via lagoon.OnDatabase so logout revokes under serve; jwt guard uses SessionCookieNames (sm-user-plugin 4bf44fc, ships v0.5.0) | 2026-10-22 | 4bf44fc (sm-user-plugin) | [261022-usi-user-plugin-jwt-blacklist-and-hooks-wire](./quick/261022-usi-user-plugin-jwt-blacklist-and-hooks-wire/) |
| 261022-vfz | User plugin /login throttle keyed on surf.ClientIP (trusted proxies); reset-password and admin password set stamp tokens_valid_after in whole seconds (sm-user-plugin b6f8055, a484d0e, ships v0.5.0; verified) | 2026-10-22 | b6f8055, a484d0e (sm-user-plugin) | [261022-vfz-user-plugin-login-throttle-via-surf-clie](./quick/261022-vfz-user-plugin-login-throttle-via-surf-clie/) |
| 261022-wah | User plugin opt-in golem15.user.jwt.token_cookie (default off) sets the HttpOnly auth.cookie session cookie on /login, /register and /activate-by-code instead of the body token; a /refresh carried by the auth.cookie cookie rewrites it (sm-user-plugin 846087d, 8bdf2c7, ships v0.5.0; verified) | 2026-10-22 | 846087d, 8bdf2c7 (sm-user-plugin) | [261022-wah-opt-in-httponly-session-cookie-on-user-p](./quick/261022-wah-opt-in-httponly-session-cookie-on-user-p/) |
| 261022-x7a | User plugin golem15.user.password.public_routes (default true): false leaves POST /login, /forgot-password and /reset-password unregistered so they 404 like unknown paths; /register and the rest unchanged (sm-user-plugin 3828a65, ships v0.5.0; verified) | 2026-10-22 | e5dd457 | [261022-x7a-user-plugin-golem15-user-password-public](./quick/261022-x7a-user-plugin-golem15-user-password-public/) |
## Deferred Items