golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: tune items 9-10 quick after G4

Browse Source
This commit is contained in:
Jakub Zych
2026-10-22 22:37:41 +02:00
parent 575a110378
commit c309a1abe9
2 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.planning/notes/2026-10-22-external-user-plugin-escalations.md
View File

@@ -41,7 +41,7 @@ Status values: `open` · `done` · `declined`. Shipped: local commit now; replac
/msd-quick --discuss --validate Under serve, user-plugin Boot runs before lagoon.Publish so the jwt blacklist is never wired and logout does not revoke. Wire BlacklistStore and RegisterHooks through lagoon.OnDatabase; test Activate-then-Publish. When re-registering the jwt guard, pass classes.SessionCookieNames() instead of the hardcoded token/auth_token names (G3 leftover). See .planning/todos/pending/2026-10-22-user-logout-blacklist-missing-under-serve.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
/msd-quick --validate User-plugin /login throttle must use surf.ClientIP (trusted proxies), not RemoteAddr. Remaining tokens_valid_after writers (reset-password, admin password set) must Truncate(time.Second) like RevokeUserAccess so a same-second JWT iat is not refused. See .planning/todos/pending/2026-10-22-user-login-lockout-and-same-second-cutoff.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
/msd-quick --validate User-plugin /login throttle must use surf.ClientIP (trusted proxies), not RemoteAddr. Leave exported RemoteIP as the RemoteAddr helper. Remaining tokens_valid_after writers (reset-password, admin password set) must Truncate(time.Second) like RevokeUserAccess; leave change-password and bouncer's comparison alone. See .planning/todos/pending/2026-10-22-user-login-lockout-and-same-second-cutoff.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
/msd-quick --discuss --validate Opt-in HttpOnly session cookie on user-plugin POST /login, following sociallogin token_cookie / bouncer.LoadCookieConfig. Default off. Discuss: a cookie-carried /refresh must rotate that cookie (G3 left body-only); keep SameSite=Lax, no new CSRF token. See .planning/todos/pending/2026-10-22-user-login-opt-in-session-cookie.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
@@ -54,7 +54,7 @@ Suggested order if you care about risk: G4 (serve blacklist), then G3, G2, 9+10,
- **G2.** `require_activation` is documented and `/register` honors it; `/login` does not. Deactivation (`deleted_at`) stays reversible.
- **G3.** Done locally (`8e4b863`). Cookie extractors are `classes.SessionToken` / `SessionCookieNames`. `/refresh` does not rewrite a cookie. CSRF was not added (SameSite=Lax + current-password on change-password).
- **G4.** `Boot` before `lagoon.Publish`. Tests publish first and hide it. Seam is `lagoon.OnDatabase`. `RegisterHooks` has the same hole. When re-registering the jwt guard, pass `classes.SessionCookieNames()`.
- **G4.** Done locally (`4bf44fc`). Lazy `appBlacklist` + `lagoon.OnDatabase` for hooks, Postgres store and sweep. Guard uses `SessionCookieNames()`.
- **G6.** D-27: email change clears `email_verified_at` and does not write a new proof. A confirm-the-new-inbox flow would be a later feature.
- **G7.** Stock form omission was a 12.1 decision. Stale `organisation_role` is already cleared (`ClearOnChange`, v0.1.8). Apps extend the form.
- **G8.** Personal tokens die via `revoked_at`. `RevokeUserAccess` already sets that on deactivate/ban. Do not teach the API-token guard a JWT cutoff. Password reset killing API tokens would be a separate, explicit revoke.