golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(todos): link two 19.6 todos to their g15office tasks

Browse Source
This commit is contained in:
Jakub Zych
2026-10-26 15:36:59 +01:00
parent ac0599e78d
commit a70dbb6ff0
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.planning/todos/pending/2026-10-26-activate-by-code-second-factor.md
View File

@@ -3,6 +3,7 @@ title: activate-by-code mints a session without the second factor when require_a
date: 2026-10-26
priority: low
area: sm-user-plugin
g15office: yfadd1mb
---
sm-user-plugin's `POST /_user/api/v1/activate-by-code` signs the account in (`mintFor`) without asking the login gates. Phase 19.6 plan 01 accepted that path because "a new or not-yet-activated account cannot have 2FA yet". That reason holds only with the default `golem15.user.activation.require_activation: true`. With `require_activation: false` and `activate_mode: user`, a not-activated account signs in with its password, can enable TOTP (sm-mfa-plugin), and a later activate-by-code with the mailed activation code answers `{"message":"Account activated","token":…}` with no challenge. The mailbox alone then stands in for the second factor, which a password reset does not allow (a reset mints no token).

1
.planning/todos/pending/2026-10-26-sm-demo-app-journal-oauthserver-pointers.md
View File

@@ -3,6 +3,7 @@ title: Commit sm-demo-app's leftover journal and oauthserver submodule moves
date: 2026-10-26
priority: medium
area: sm-demo-app
g15office: ssuyq2os
---
sm-demo-app: uncommitted journal (4ab94da→b129902) and oauthserver (8bbec72→b6a9586) submodule moves left over from Phase 19.7 plan 05 (2026-10-23); confirm the commits are on origin/tagged and commit the pointers (with go.mod bumps) as a 19.7 follow-up.