From deff424c4ffb8c0e7e826f8345aac071d42d76c8 Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Wed, 21 Oct 2026 02:24:58 +0200 Subject: [PATCH] test(19.5): persist human verification items as UAT --- .../19.5-UAT.md | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 .planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md diff --git a/.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md b/.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md new file mode 100644 index 00000000..d8e6892c --- /dev/null +++ b/.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md @@ -0,0 +1,40 @@ +--- +status: testing +phase: 19.5-social-login-in-sm-user-plugin +source: [19.5-VERIFICATION.md] +started: 2026-10-21T00:24:54.347Z +updated: 2026-10-21T00:24:54.347Z +--- + +## Current Test + +number: 1 +name: Decide on the residual pre-account-takeover path left open by the T-19.5-38 fix. ownerVerifiedEmail treats has_self_set_password=true as proof the owner controls the address, but POST /register with golem15.user activation.activate_mode=auto (the default) creates an activated account with has_self_set_password=true and no email check. An attacker who registers victim@example.com with a password before the victim's first Google/GitHub sign-in gets the victim's verified identity auto-linked onto the attacker's account, and keeps password access. +expected: | + Either accept it explicitly (it is exactly PHP's D-10 behaviour, and the variant T-19.5-38 closed was the social-created one), or schedule a follow-up (for example: auto-link only when the account was activated by mail or set its password through the reset code, or require activate_mode=user for apps mounting sociallogin). Also correct 19.5-SECURITY-REVIEW.md / README wording that a self-set password means the owner 'proved the address'. +awaiting: user response + +## Tests + +### 1. Decide on the residual pre-account-takeover path left open by the T-19.5-38 fix. ownerVerifiedEmail treats has_self_set_password=true as proof the owner controls the address, but POST /register with golem15.user activation.activate_mode=auto (the default) creates an activated account with has_self_set_password=true and no email check. An attacker who registers victim@example.com with a password before the victim's first Google/GitHub sign-in gets the victim's verified identity auto-linked onto the attacker's account, and keeps password access. +expected: Either accept it explicitly (it is exactly PHP's D-10 behaviour, and the variant T-19.5-38 closed was the social-created one), or schedule a follow-up (for example: auto-link only when the account was activated by mail or set its password through the reset code, or require activate_mode=user for apps mounting sociallogin). Also correct 19.5-SECURITY-REVIEW.md / README wording that a self-set password means the owner 'proved the address'. +result: [pending] + +### 2. Walk the bm callback view in a browser (see behavior_unverified_items). +expected: As in behavior_unverified_items. +result: [pending] + +### 3. Review the judgment-tier prohibition verdicts in the 'Prohibitions' section of this report (non-authoritative LLM-judge verdicts). +expected: Confirm or dispute each verdict; all are recorded as no violation found. +result: [pending] + +## Summary + +total: 3 +passed: 0 +issues: 0 +pending: 3 +skipped: 0 +blocked: 0 + +## Gaps