golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(quick-261022-wah): user-plugin opt-in token_cookie session cookie and cookie-carried /refresh rotation

Browse Source
This commit is contained in:
Jakub Zych
2026-10-22 23:51:57 +02:00
parent 6a1974c0d2
commit cd90be9de3
6 changed files with 749 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
.planning/STATE.md
View File

@@ -5,10 +5,10 @@ current_phase: "19.7"
current_phase_name: Generic MCP module (INSERTED)
status: executing
stopped_at: Completed 19.7-01-PLAN.md
last_updated: "2026-10-22T20:36:03.317Z"
last_updated: "2026-10-22T21:51:48.670Z"
last_activity: 2026-10-22
last_activity_desc: "Completed quick task 261022-usi: user-plugin jwt blacklist and hooks wired via lagoon.OnDatabase (logout revokes under serve)"
state_head: b8bf71c5dda8021ada897b4e8a759d7e9474a0b4
last_activity_desc: "Completed quick task 261022-wah: user-plugin opt-in token_cookie session cookie and cookie-carried /refresh rotation"
state_head: 6a1974c0d2ee89ead533ee8f887d7be2f7549f10
progress:
total_phases: 45
completed_phases: 37
@@ -32,7 +32,7 @@ See: .planning/PROJECT.md (updated 2026-10-22)
Phase: 19.7 (Generic MCP module (INSERTED)) — EXECUTING
Plan: 2 of 5
Status: Ready to execute
Last activity: 2026-10-22 — Completed quick task 261022-vfz: user-plugin /login throttle via surf.ClientIP and whole-second tokens_valid_after writers
Last activity: 2026-10-22 — Completed quick task 261022-wah: user-plugin opt-in token_cookie session cookie and cookie-carried /refresh rotation
Progress: [████████░░] 82%
@@ -1048,6 +1048,7 @@ Recent decisions affecting current work:
| 261022-tto | User plugin /fetch, /refresh, /update, /change-password accept token/auth_token session cookies (sm-user-plugin 8e4b863, ships v0.5.0) | 2026-10-22 | 8e4b863 (sm-user-plugin) | [261022-tto-fetch-refresh-update-change-password-mus](./quick/261022-tto-fetch-refresh-update-change-password-mus/) |
| 261022-usi | User plugin jwt blacklist and GORM hooks wired via lagoon.OnDatabase so logout revokes under serve; jwt guard uses SessionCookieNames (sm-user-plugin 4bf44fc, ships v0.5.0) | 2026-10-22 | 4bf44fc (sm-user-plugin) | [261022-usi-user-plugin-jwt-blacklist-and-hooks-wire](./quick/261022-usi-user-plugin-jwt-blacklist-and-hooks-wire/) |
| 261022-vfz | User plugin /login throttle keyed on surf.ClientIP (trusted proxies); reset-password and admin password set stamp tokens_valid_after in whole seconds (sm-user-plugin b6f8055, a484d0e, ships v0.5.0; verified) | 2026-10-22 | b6f8055, a484d0e (sm-user-plugin) | [261022-vfz-user-plugin-login-throttle-via-surf-clie](./quick/261022-vfz-user-plugin-login-throttle-via-surf-clie/) |
| 261022-wah | User plugin opt-in golem15.user.jwt.token_cookie (default off) sets the HttpOnly auth.cookie session cookie on /login, /register and /activate-by-code instead of the body token; a /refresh carried by the auth.cookie cookie rewrites it (sm-user-plugin 846087d, 8bdf2c7, ships v0.5.0; verified) | 2026-10-22 | 846087d, 8bdf2c7 (sm-user-plugin) | [261022-wah-opt-in-httponly-session-cookie-on-user-p](./quick/261022-wah-opt-in-httponly-session-cookie-on-user-p/) |
## Deferred Items