golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(06): revision pass 1 - resolve Limiter naming collision and add plugin-facing house-middleware capability

Browse Source
This commit is contained in:
Jakub Zych
2026-09-19 17:13:02 +02:00
parent c4f406bb64
commit ad3d6f7f84
5 changed files with 163 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-VALIDATION.md
View File

@@ -41,10 +41,10 @@ created: 2026-09-19
| 06-01-T1 | 06-01 | 1 | HTTP-05 | T-06-01 | Router verbs + parameterized middleware factories; guard registry primitives unit-tested in isolation | unit | `go test ./surf/... ./bouncer/... ./pact/... -short` (summercms.go) | ✅ created by plan | ⬜ pending |
| 06-01-T2 | 06-01 | 1 | HTTP-05 | T-06-04, T-06-05 | Real inv_token guard + inv.scope exact 401/403 bodies; jwt guard behaviorally unchanged | unit + testcontainers | `go test ./plugins/golem15/fonoteka/... ./plugins/golem15/user/... -short` (fonoteka.go) | ✅ created by plan | ⬜ pending |
| 06-01-T3 | 06-01 | 1 | HTTP-03 | T-06-02 | Same handler serves JWT and personal-token genres; parity-green on both | integration + parity | `go test ./plugins/golem15/fonoteka/... -run TestGenresSharedHandler -short && go test ./parity/... -run TestParityCorpus` (fonoteka.go) | ✅ created by plan | ⬜ pending |
| 06-02-T1 | 06-02 | 2 | HTTP-04 | T-06-06 | Fixed-window Store/Limiter matching Laravel wire contract; trusted-proxy ClientIP | unit | `go test ./surf/... -run 'TestLimiter\|TestClientIP' -short` (summercms.go) | ✅ created by plan | ⬜ pending |
| 06-02-T1 | 06-02 | 2 | HTTP-04 | T-06-06 | Fixed-window Store/FixedWindowLimiter (distinct from the pre-existing surf.Limiter interface seam) matching Laravel wire contract; trusted-proxy ClientIP | unit | `go test ./surf/... -run 'TestFixedWindowLimiter\|TestClientIP' -short` (summercms.go) | ✅ created by plan | ⬜ pending |
| 06-02-T2 | 06-02 | 2 | HTTP-04 | T-06-07 | Five named buckets registered; token group throttled; PublicShareHeaders 429 rewrite | unit + integration | `go test ./plugins/golem15/fonoteka/... -run TestPublicShareHeaders -short` (fonoteka.go) | ✅ created by plan | ⬜ pending |
| 06-02-T3 | 06-02 | 2 | HTTP-04 | T-06-09 | All six declared route groups boot cleanly; APP_DEBUG=false pinned for future fixture recordings | integration | `go test ./plugins/golem15/fonoteka/... -run TestAllRouteGroupsBoot -short` (fonoteka.go) | ✅ created by plan | ⬜ pending |
| 06-03-T1 | 06-03 | 3 | HTTP-06 | T-06-10, T-06-11 | Raw group refuses house-envelope middleware at registration; bare 500 on raw panic; route table + route:list | unit | `go test ./surf/... -run 'TestRawGroup\|TestRouteTable' -short` (summercms.go) | ✅ created by plan | ⬜ pending |
| 06-03-T1 | 06-03 | 3 | HTTP-06 | T-06-10, T-06-11 | Raw group refuses house-envelope middleware (declared only via the pact.HasHouseMiddleware plugin capability) at registration; bare 500 on raw panic; route table + route:list | unit | `go test ./surf/... -run 'TestRawGroup\|TestRouteTable\|TestHouseMiddleware' -short` (summercms.go) | ✅ created by plan | ⬜ pending |
| 06-03-T2 | 06-03 | 3 | HTTP-06, HTTP-08 | — | wire response helpers (JSON writer, +00:00 time, tri-state bool, never-nil slice); swag→openapi-typescript pipeline | unit + build-gate | `go test ./wire/... -short && bash scripts/check-openapi.sh` (fonoteka.go) | ✅ created by plan | ⬜ pending |
| 06-03-T3 | 06-03 | 3 | HTTP-09 | T-06-12, T-06-13 | Path-scoped CORS matches config/cors.php; body limits enforced with operator-confirmed production numbers; oauth group raw | integration + human-verify | `go test ./surf/... -run 'TestCORS\|TestBodyLimit' -short` (summercms.go); blocking checkpoint for production body-size numbers | ✅ created by plan | ⬜ pending |
| 06-04-T1 | 06-04 | 1 | HTTP-07 | T-06-14 | Private/reserved/CGNAT/metadata IP table matches ManualCoverUrlFetcher.php exactly | unit | `go test ./fetchguard/... -run TestIsReservedOrPrivate -v` (summercms.go) | ✅ created by plan | ⬜ pending |