docs: tune items 9-10 quick after G4
This commit is contained in:
Jakub Zych
@@ -41,7 +41,7 @@ Status values: `open` · `done` · `declined`. Shipped: local commit now; replac
|
||||
|
||||
/msd-quick --discuss --validate Under serve, user-plugin Boot runs before lagoon.Publish so the jwt blacklist is never wired and logout does not revoke. Wire BlacklistStore and RegisterHooks through lagoon.OnDatabase; test Activate-then-Publish. When re-registering the jwt guard, pass classes.SessionCookieNames() instead of the hardcoded token/auth_token names (G3 leftover). See .planning/todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
|
||||
|
||||
/msd-quick --validate User-plugin /login throttle must use surf.ClientIP (trusted proxies), not RemoteAddr. Remaining tokens_valid_after writers (reset-password, admin password set) must Truncate(time.Second) like RevokeUserAccess so a same-second JWT iat is not refused. See .planning/todos/pending/2026-10-22-user-login-lockout-and-same-second-cutoff.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
|
||||
/msd-quick --validate User-plugin /login throttle must use surf.ClientIP (trusted proxies), not RemoteAddr. Leave exported RemoteIP as the RemoteAddr helper. Remaining tokens_valid_after writers (reset-password, admin password set) must Truncate(time.Second) like RevokeUserAccess; leave change-password and bouncer's comparison alone. See .planning/todos/pending/2026-10-22-user-login-lockout-and-same-second-cutoff.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
|
||||
|
||||
/msd-quick --discuss --validate Opt-in HttpOnly session cookie on user-plugin POST /login, following sociallogin token_cookie / bouncer.LoadCookieConfig. Default off. Discuss: a cookie-carried /refresh must rotate that cookie (G3 left body-only); keep SameSite=Lax, no new CSRF token. See .planning/todos/pending/2026-10-22-user-login-opt-in-session-cookie.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
|
||||
|
||||
@@ -54,7 +54,7 @@ Suggested order if you care about risk: G4 (serve blacklist), then G3, G2, 9+10,
|
||||
|
||||
- **G2.** `require_activation` is documented and `/register` honors it; `/login` does not. Deactivation (`deleted_at`) stays reversible.
|
||||
- **G3.** Done locally (`8e4b863`). Cookie extractors are `classes.SessionToken` / `SessionCookieNames`. `/refresh` does not rewrite a cookie. CSRF was not added (SameSite=Lax + current-password on change-password).
|
||||
- **G4.** `Boot` before `lagoon.Publish`. Tests publish first and hide it. Seam is `lagoon.OnDatabase`. `RegisterHooks` has the same hole. When re-registering the jwt guard, pass `classes.SessionCookieNames()`.
|
||||
- **G4.** Done locally (`4bf44fc`). Lazy `appBlacklist` + `lagoon.OnDatabase` for hooks, Postgres store and sweep. Guard uses `SessionCookieNames()`.
|
||||
- **G6.** D-27: email change clears `email_verified_at` and does not write a new proof. A confirm-the-new-inbox flow would be a later feature.
|
||||
- **G7.** Stock form omission was a 12.1 decision. Stale `organisation_role` is already cleared (`ClearOnChange`, v0.1.8). Apps extend the form.
|
||||
- **G8.** Personal tokens die via `revoked_at`. `RevokeUserAccess` already sets that on deactivate/ban. Do not teach the API-token guard a JWT cutoff. Password reset killing API tokens would be a separate, explicit revoke.
|
||||
|
||||
@@ -25,12 +25,16 @@ Two convention holes, one quick (external items 9 and 10).
|
||||
|
||||
## Solution
|
||||
|
||||
`/login` throttle IP = `surf.ClientIP(r, surf.TrustedProxies(app.Config))`, same as `/register`. Every `tokens_valid_after` writer uses whole seconds (truncate down, matching `RevokeUserAccess`; do not switch the comparison to a new rule in bouncer unless a writer cannot be found). Tests: X-Forwarded-For behind a trusted proxy is the throttle key; a reset then an immediate login in the same second succeeds.
|
||||
`/login` throttle IP = `surf.ClientIP(r, surf.TrustedProxies(app.Config))`, same as `/register`. That `ip` is also what G2's `refuseLogin` records as a failed attempt — one assignment covers both. Leave exported `RemoteIP` as the `RemoteAddr` host helper (sociallogin / `social_hooks_test` use it; it has no config). Update its doc comment so it no longer says `/login` uses it.
|
||||
|
||||
After the commit, fill items 9 and 10 in `.planning/notes/2026-10-22-external-user-plugin-escalations.md`.
|
||||
Every remaining `tokens_valid_after` writer uses whole seconds (truncate down, matching `RevokeUserAccess`). Do not change `bouncer.issuedBeforeCutoff`. Writers to fix: `/reset-password` (`now`) and the admin Users password set (`time.Now()`). `/change-password` is already `iat.Add(-time.Second)` — leave it. `RevokeUserAccess` already truncates.
|
||||
|
||||
Tests: X-Forwarded-For behind a trusted proxy is the `/login` throttle key; a reset (or admin password set) then an immediate login in the same second succeeds.
|
||||
|
||||
Base is sm-user-plugin `4bf44fc` (G4). Hold push/tag for SummerCMS v0.5.0. After the commit, fill items 9 and 10 in `.planning/notes/2026-10-22-external-user-plugin-escalations.md` like G2–G4 (`done (unreleased)`, ships in v0.5.0). Leave the todo in pending with an Outcome.
|
||||
|
||||
## Invoke
|
||||
|
||||
```
|
||||
/msd-quick --validate User-plugin /login throttle must use surf.ClientIP (trusted proxies), not RemoteAddr. Remaining tokens_valid_after writers (reset-password, admin password set) must Truncate(time.Second) like RevokeUserAccess so a same-second JWT iat is not refused. See .planning/todos/pending/2026-10-22-user-login-lockout-and-same-second-cutoff.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
|
||||
/msd-quick --validate User-plugin /login throttle must use surf.ClientIP (trusted proxies), not RemoteAddr. Leave exported RemoteIP as the RemoteAddr helper. Remaining tokens_valid_after writers (reset-password, admin password set) must Truncate(time.Second) like RevokeUserAccess; leave change-password and bouncer's comparison alone. See .planning/todos/pending/2026-10-22-user-login-lockout-and-same-second-cutoff.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user