golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(quick-261022-wah): user-plugin opt-in token_cookie session cookie and cookie-carried /refresh rotation

Browse Source
This commit is contained in:
Jakub Zych
2026-10-22 23:51:57 +02:00
parent 6a1974c0d2
commit cd90be9de3
6 changed files with 749 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.planning/notes/2026-10-22-external-user-plugin-escalations.md
View File

@@ -48,7 +48,7 @@ Status values: `open` · `done` · `declined`. Shipped: local commit now; replac
/msd-quick --validate User-plugin config switch that does not register POST /login /forgot-password /reset-password so they 404. Default keeps today’s routes. No framework route-wrap seam. See .planning/todos/pending/2026-10-22-user-password-routes-404-switch.md and .planning/notes/2026-10-22-external-user-plugin-escalations.md
```
Suggested order if you care about risk: G4 (serve blacklist), then G3, G2, 9+10, then the two features. Bugs are done locally; remaining are item 7 (cookie) then item 8 (password-routes 404). Do not overlap on the same plugin files.
Suggested order if you care about risk: G4 (serve blacklist), then G3, G2, 9+10, then the two features. Bugs and item 7 (cookie) are done locally; item 8 (password-routes 404) remains. Do not overlap on the same plugin files.
## Verdicts (kept for the sessions)