golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: fold G3 leftovers into G4 and login-cookie quicks

Browse Source
This commit is contained in:
Jakub Zych
2026-10-22 22:00:09 +02:00
parent 98a95c9c92
commit b8bf71c5dd
3 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.planning/notes/2026-10-22-external-user-plugin-escalations.md
View File

@@ -39,11 +39,11 @@ Status values: `open` · `done` · `declined`. Shipped: local commit now; replac
/msd-quick --validate /fetch /refresh /update /change-password must accept the token/auth_token cookies the same way jwt.auth and EndSession already do. Logout is already fixed. See .planning/todos/pending/2026-10-22-user-session-routes-ignore-cookie.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
/msd-quick --discuss --validate Under serve, user-plugin Boot runs before lagoon.Publish so the jwt blacklist is never wired and logout does not revoke. Wire BlacklistStore and RegisterHooks through lagoon.OnDatabase; test Activate-then-Publish. See .planning/todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
/msd-quick --discuss --validate Under serve, user-plugin Boot runs before lagoon.Publish so the jwt blacklist is never wired and logout does not revoke. Wire BlacklistStore and RegisterHooks through lagoon.OnDatabase; test Activate-then-Publish. When re-registering the jwt guard, pass classes.SessionCookieNames() instead of the hardcoded token/auth_token names (G3 leftover). See .planning/todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
/msd-quick --validate User-plugin /login throttle must use surf.ClientIP (trusted proxies), not RemoteAddr. Remaining tokens_valid_after writers (reset-password, admin password set) must Truncate(time.Second) like RevokeUserAccess so a same-second JWT iat is not refused. See .planning/todos/pending/2026-10-22-user-login-lockout-and-same-second-cutoff.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
/msd-quick --discuss --validate Opt-in HttpOnly session cookie on user-plugin POST /login, following sociallogin token_cookie / bouncer.LoadCookieConfig. Default off so existing body-token clients stay unchanged. See .planning/todos/pending/2026-10-22-user-login-opt-in-session-cookie.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
/msd-quick --discuss --validate Opt-in HttpOnly session cookie on user-plugin POST /login, following sociallogin token_cookie / bouncer.LoadCookieConfig. Default off. Discuss: a cookie-carried /refresh must rotate that cookie (G3 left body-only); keep SameSite=Lax, no new CSRF token. See .planning/todos/pending/2026-10-22-user-login-opt-in-session-cookie.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
/msd-quick --validate User-plugin config switch that does not register POST /login /forgot-password /reset-password so they 404. Default keeps today’s routes. No framework route-wrap seam. See .planning/todos/pending/2026-10-22-user-password-routes-404-switch.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
```
@@ -53,12 +53,12 @@ Suggested order if you care about risk: G4 (serve blacklist), then G3, G2, 9+10,
## Verdicts (kept for the sessions)
- **G2.** `require_activation` is documented and `/register` honors it; `/login` does not. Deactivation (`deleted_at`) stays reversible.
- **G3.** Logout already reads cookies (`358ee5d`). `/fetch`, `/refresh`, `/update`, `/change-password` still use `bearerToken()` / a cookie-less guard.
- **G4.** `Boot` before `lagoon.Publish`. Tests publish first and hide it. Seam is `lagoon.OnDatabase`. `RegisterHooks` has the same hole.
- **G3.** Done locally (`8e4b863`). Cookie extractors are `classes.SessionToken` / `SessionCookieNames`. `/refresh` does not rewrite a cookie. CSRF was not added (SameSite=Lax + current-password on change-password).
- **G4.** `Boot` before `lagoon.Publish`. Tests publish first and hide it. Seam is `lagoon.OnDatabase`. `RegisterHooks` has the same hole. When re-registering the jwt guard, pass `classes.SessionCookieNames()`.
- **G6.** D-27: email change clears `email_verified_at` and does not write a new proof. A confirm-the-new-inbox flow would be a later feature.
- **G7.** Stock form omission was a 12.1 decision. Stale `organisation_role` is already cleared (`ClearOnChange`, v0.1.8). Apps extend the form.
- **G8.** Personal tokens die via `revoked_at`. `RevokeUserAccess` already sets that on deactivate/ban. Do not teach the API-token guard a JWT cutoff. Password reset killing API tokens would be a separate, explicit revoke.
- **7.** Sociallogin already has `token_cookie` for OAuth. Password `/login` does not set a cookie.
- **7.** Sociallogin already has `token_cookie` for OAuth. Password `/login` does not set a cookie. `--discuss` must decide cookie rotation on `/refresh` (G3 left the body-only rotate) and keep SameSite=Lax (no new CSRF token).
- **8.** Plugin config; no framework wrap.
- **9.** `/login` uses `RemoteAddr`; `/register` already uses `surf.ClientIP`.
- **10.** `RevokeUserAccess` already truncates. Reset-password and the admin password set still stamp `time.Now()`.