From a70dbb6ff02ec8e91649a236ce75c6b44043c11f Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Mon, 26 Oct 2026 15:36:59 +0100 Subject: [PATCH] docs(todos): link two 19.6 todos to their g15office tasks --- .../todos/pending/2026-10-26-activate-by-code-second-factor.md | 1 + .../2026-10-26-sm-demo-app-journal-oauthserver-pointers.md | 1 + 2 files changed, 2 insertions(+) diff --git a/.planning/todos/pending/2026-10-26-activate-by-code-second-factor.md b/.planning/todos/pending/2026-10-26-activate-by-code-second-factor.md index 0eb3bacb..d2069265 100644 --- a/.planning/todos/pending/2026-10-26-activate-by-code-second-factor.md +++ b/.planning/todos/pending/2026-10-26-activate-by-code-second-factor.md @@ -3,6 +3,7 @@ title: activate-by-code mints a session without the second factor when require_a date: 2026-10-26 priority: low area: sm-user-plugin +g15office: yfadd1mb --- sm-user-plugin's `POST /_user/api/v1/activate-by-code` signs the account in (`mintFor`) without asking the login gates. Phase 19.6 plan 01 accepted that path because "a new or not-yet-activated account cannot have 2FA yet". That reason holds only with the default `golem15.user.activation.require_activation: true`. With `require_activation: false` and `activate_mode: user`, a not-activated account signs in with its password, can enable TOTP (sm-mfa-plugin), and a later activate-by-code with the mailed activation code answers `{"message":"Account activated","token":…}` with no challenge. The mailbox alone then stands in for the second factor, which a password reset does not allow (a reset mints no token). diff --git a/.planning/todos/pending/2026-10-26-sm-demo-app-journal-oauthserver-pointers.md b/.planning/todos/pending/2026-10-26-sm-demo-app-journal-oauthserver-pointers.md index 33bb6921..f4298579 100644 --- a/.planning/todos/pending/2026-10-26-sm-demo-app-journal-oauthserver-pointers.md +++ b/.planning/todos/pending/2026-10-26-sm-demo-app-journal-oauthserver-pointers.md @@ -3,6 +3,7 @@ title: Commit sm-demo-app's leftover journal and oauthserver submodule moves date: 2026-10-26 priority: medium area: sm-demo-app +g15office: ssuyq2os --- sm-demo-app: uncommitted journal (4ab94da→b129902) and oauthserver (8bbec72→b6a9586) submodule moves left over from Phase 19.7 plan 05 (2026-10-23); confirm the commits are on origin/tagged and commit the pointers (with go.mod bumps) as a 19.7 follow-up.