golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(phase-7): complete phase execution

Browse Source 
Avatar bucket publish closed the last UAT blocker. Phase 7 is 8/8
verified. Next is discuss Phase 8; do not auto-advance.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Jakub Zych
2026-09-23 10:53:42 +02:00
parent e537b67a37
commit b435304570
4 changed files with 29 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.planning/PROJECT.md
View File

@@ -44,6 +44,12 @@ Validated in Phase 5: Data layer full fidelity
- [x] All 25 Płytarium models ported with matching tables, relations, casts, lifecycle hooks, and fillable/hidden/encrypted mass-assignment discipline; squashed gormigrate sets run up and down; schema-diff vs a committed PHP snapshot; `migrate:rollback --plugin=fonoteka` isolates that plugin
- [x] `lagoon.Fill` allow-list copy, `lagoon.Validate` Laravel rule strings, `lagoon.Paginate` `{data, meta}` envelope, AES-256-GCM `lagoon.Encrypted`, Jsonable TEXT casts, MoneyString 4-decimal numeric, and `system_files` attach (blob + Winter Thumb names). HTTP public URL serving of uploads remains Phase 6.
Validated in Phase 7: User plugin and authentication
- [x] User plugin port: registration, login, logout, password reset, email verification, JWT issue/refresh with Nuxt claims, organizations via fire-and-collect, personal API tokens with a read|write|ai ceiling, and the must-change-password 423 lock with locale exemption
- [x] Locale resolves per request from preferred_locale then Accept-Language then app.locale, including while the lock is active
- [x] `surf.ServeCommand` and `app.Handler` publish the uploads `*blob.Bucket` so assembled avatar POST is 200
### Active
Framework kernel
@@ -57,7 +63,7 @@ Data layer
HTTP and auth
- [ ] User plugin port beyond the throwaway HS256 verifier: accounts, registration, login, password reset, JWT issuing for the SPA, organizations and org-scoped permissions
- (user plugin / JWT / orgs / personal tokens / password lock — moved to Validated in Phase 7)
- [ ] OAuth2/OIDC provider (zitadel/oidc) that the MCP server and the ChatGPT connector use with the same flows as today (auth code + PKCE, refresh tokens, client management, `IssueOAuthClient` command)
- [ ] All 154 Płytarium API routes ported with byte-compatible request and response shapes (collections, albums, artists, genres, styles, ratings, reservations, wishlist, sharing and invitations, notifications, realtime channel auth, CSV import/export, locale, user context, credentials)
@@ -168,4 +174,4 @@ This document evolves at phase transitions and milestone boundaries.
4. Update Context with current state
---
*Last updated: 2026-09-18 after Phase 5 completion*
*Last updated: 2026-09-23 after Phase 7 completion*