golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: fill G3 in the external-escalation reply

Browse Source
This commit is contained in:
Jakub Zych
2026-10-22 21:46:10 +02:00
parent 3ebd78373c
commit b70abe48e6
3 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.planning/notes/2026-10-22-external-user-plugin-escalations.md
View File

@@ -20,7 +20,7 @@ Reviewed 2026-10-22. The list is `golem15.user` (sm-user-plugin), not cabana adm
| # | Their label | Verdict | Quick / todo | g15office | Status | Shipped |
|---|---|---|---|---|---|---|
| 1 | G2 login ignores `is_activated` | Fix | [261022-tb4](../quick/261022-tb4-password-login-must-refuse-is-activated-/) · [todo](../todos/pending/2026-10-22-user-login-ignores-is-activated.md) | 3r4or1ex | done (unreleased) | `15ff979` → v0.5.0 |
| 2 | G3 cookie-only 401 | Fix remaining four; logout already done | [2026-10-22-user-session-routes-ignore-cookie.md](../todos/pending/2026-10-22-user-session-routes-ignore-cookie.md) | kkknstxl | open | |
| 2 | G3 cookie-only 401 | Fix remaining four; logout already done | [261022-tto](../quick/261022-tto-fetch-refresh-update-change-password-mus/) · [todo](../todos/pending/2026-10-22-user-session-routes-ignore-cookie.md) | kkknstxl | done (unreleased) | `8e4b863` → v0.5.0 |
| 3 | G4 logout blacklist under `serve` | Fix | [2026-10-22-user-logout-blacklist-missing-under-serve.md](../todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md) | ud0gficu | open | |
| 4 | G6 `/update` email without proof | Decline | — | — | declined | n/a |
| 5 | G7 Users form has no role field | Decline | — | — | declined | n/a |
@@ -76,7 +76,7 @@ Ships in SummerCMS v0.5.0 (sm-user-plugin 15ff979, tagged with that wave): with
G3 — some routes ignore the cookie
Partly already fixed, rest agreed. POST /logout already accepts the token/auth_token cookies (and blacklists every JWT the request carries). GET /fetch, POST /refresh, POST /update and POST /change-password still required the Authorization header.
TODO: ships in SummerCMS v0.5.0 — those four accept the same cookies as jwt.auth.
Ships in SummerCMS v0.5.0 (sm-user-plugin 8e4b863, tagged with that wave): GET /fetch, POST /refresh, POST /update and POST /change-password (and the other signed-in routes: /activate, /marketing-consent, /avatar, /avatar/remove) read the session token like jwt.auth: the Authorization header first, then the token and auth_token cookies. A cookie-carried /refresh returns the rotated token in the body and does not rewrite the cookie; the previous token is revoked, so store the new one in your cookie.
G4 — logout does not blacklist under serve
Agreed. Plugin Boot runs before serve publishes the database, so the in-process blacklist store was never wired in production (the jwt_blacklist table exists; nothing wrote to it). Tests hid this because they publish the DB before Boot.