From cb38c493ceacb1a4a6006dd059234eaf56ed3eeb Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Wed, 21 Oct 2026 12:23:51 +0200 Subject: [PATCH] docs(notes): allow diary as wristband's one framework import --- .planning/notes/2026-10-19-oidc-on-wristband-golang-jwt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.planning/notes/2026-10-19-oidc-on-wristband-golang-jwt.md b/.planning/notes/2026-10-19-oidc-on-wristband-golang-jwt.md index 4a44e084..6295c699 100644 --- a/.planning/notes/2026-10-19-oidc-on-wristband-golang-jwt.md +++ b/.planning/notes/2026-10-19-oidc-on-wristband-golang-jwt.md @@ -35,6 +35,6 @@ This note supersedes the zitadel/oidc row of `.planning/research/STACK.md` for O ## Consequences - The framework `go.mod` gains no module; `grep -E 'zitadel|go-jose|coreos' go.mod` stays empty. -- `wristband` stays a protocol leaf: no ORM, no framework module, no application package. Storage, keys at rest, pages and routes belong to `sm-oauthserver-plugin` (D-01). +- `wristband` stays a protocol leaf: no ORM, no framework module except `diary`, no application package. Logging through `diary` is required (amended 2026-10-21, phase 19.8: every framework module logs through diary components). Storage, keys at rest, pages and routes belong to `sm-oauthserver-plugin` (D-01). - The OIDC flavour owns every byte a relying party sees (discovery field order, redirect encoding, error bodies, headers), so parity with the PHP provider is a matter of tests and `tide` recordings, not of fighting library defaults. - Replacing golang-jwt later means re-checking the id_token header (`alg`, `kid`) and the string `aud` against the go-oidc interop test.