golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: fill G3 in the external-escalation reply

Browse Source
This commit is contained in:
Jakub Zych
2026-10-22 21:46:10 +02:00
parent 3ebd78373c
commit b70abe48e6
3 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.planning/notes/2026-10-22-external-user-plugin-escalations.md
View File

@@ -20,7 +20,7 @@ Reviewed 2026-10-22. The list is `golem15.user` (sm-user-plugin), not cabana adm
| # | Their label | Verdict | Quick / todo | g15office | Status | Shipped |
|---|---|---|---|---|---|---|
| 1 | G2 login ignores `is_activated` | Fix | [261022-tb4](../quick/261022-tb4-password-login-must-refuse-is-activated-/) · [todo](../todos/pending/2026-10-22-user-login-ignores-is-activated.md) | 3r4or1ex | done (unreleased) | `15ff979` → v0.5.0 |
| 2 | G3 cookie-only 401 | Fix remaining four; logout already done | [2026-10-22-user-session-routes-ignore-cookie.md](../todos/pending/2026-10-22-user-session-routes-ignore-cookie.md) | kkknstxl | open | |
| 2 | G3 cookie-only 401 | Fix remaining four; logout already done | [261022-tto](../quick/261022-tto-fetch-refresh-update-change-password-mus/) · [todo](../todos/pending/2026-10-22-user-session-routes-ignore-cookie.md) | kkknstxl | done (unreleased) | `8e4b863` → v0.5.0 |
| 3 | G4 logout blacklist under `serve` | Fix | [2026-10-22-user-logout-blacklist-missing-under-serve.md](../todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md) | ud0gficu | open | |
| 4 | G6 `/update` email without proof | Decline | — | — | declined | n/a |
| 5 | G7 Users form has no role field | Decline | — | — | declined | n/a |
@@ -76,7 +76,7 @@ Ships in SummerCMS v0.5.0 (sm-user-plugin 15ff979, tagged with that wave): with
G3 — some routes ignore the cookie
Partly already fixed, rest agreed. POST /logout already accepts the token/auth_token cookies (and blacklists every JWT the request carries). GET /fetch, POST /refresh, POST /update and POST /change-password still required the Authorization header.
TODO: ships in SummerCMS v0.5.0 — those four accept the same cookies as jwt.auth.
Ships in SummerCMS v0.5.0 (sm-user-plugin 8e4b863, tagged with that wave): GET /fetch, POST /refresh, POST /update and POST /change-password (and the other signed-in routes: /activate, /marketing-consent, /avatar, /avatar/remove) read the session token like jwt.auth: the Authorization header first, then the token and auth_token cookies. A cookie-carried /refresh returns the rotated token in the body and does not rewrite the cookie; the previous token is revoked, so store the new one in your cookie.
G4 — logout does not blacklist under serve
Agreed. Plugin Boot runs before serve publishes the database, so the in-process blacklist store was never wired in production (the jwt_blacklist table exists; nothing wrote to it). Tests hid this because they publish the DB before Boot.

4
.planning/todos/pending/2026-10-22-user-login-opt-in-session-cookie.md
View File

@@ -28,6 +28,10 @@ Opt-in config on the user plugin (decide the key in `--discuss`: reuse a shared
After the commit, fill item 7 in `.planning/notes/2026-10-22-external-user-plugin-escalations.md`.
## Note from G3 (2026-10-22)
Since sm-user-plugin `8e4b863`, `POST /refresh` accepts the `token` and `auth_token` cookies, answers the rotated token in the body only and writes no cookie. When `/login` can set the HttpOnly cookie, decide in `--discuss` whether a cookie-carried `/refresh` rotates that cookie, as `bouncer.CookieRefreshHandler` does. Otherwise the blacklisted old token stays in an HttpOnly cookie the browser cannot rewrite.
## Invoke
```

4
.planning/todos/pending/2026-10-22-user-session-routes-ignore-cookie.md
View File

@@ -26,6 +26,10 @@ Partly stale. `Logout` / `EndSession` already read bearer then `token` / `auth_t
After the commit, fill G3 in `.planning/notes/2026-10-22-external-user-plugin-escalations.md`.
## Outcome (2026-10-22)
Quick `261022-tto`. Fix commit `8e4b863` on sm-user-plugin master (base `15ff979`). `/fetch`, `/refresh`, `/update` and `/change-password`, and the other signed-in routes through `authenticate` (`/activate`, `/marketing-consent`, `/avatar`, `/avatar/remove`), read the bearer header, then the `token` and `auth_token` cookies, through `classes.SessionToken` and one cookie-aware guard; a cookie-carried `/refresh` answers the token in the body and writes no cookie. Reply note G3 filled. Not tagged, not pushed: the v0.5.0 wave (these six quicks + admin keyboard shortcuts + MCP) is the first release.
## Invoke
```