diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index e402cb2..10affce 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -1044,7 +1044,7 @@ Plans: 5. Module READMEs and `docs/` cover the token API, scopes and CLI commands. 6. The new code has unit tests, delivered in the phase's last plan. -**Plans:** 3/4 plans executed +**Plans:** 4/4 plans executed Plans: **Wave 1** @@ -1057,7 +1057,7 @@ Plans: - [x] 16.3-03-PLAN.md — Journal: journal and journal:read scopes, token auth through ResolveBackend with byte-identical bodies (reverses Phase 15 D-15), Journal README and the ResolveBackend docs example; release gate (human), summercms tag after v0.1.20, Journal go.mod and host gitlink bumps **Wave 4** *(blocked on Wave 3 completion)* -- [ ] 16.3-04-PLAN.md — Unit tests: scope rules, route classification, guard, resolver, account API, CLI, migration, SPA backstops, Journal token matrix; Postgres tests for a Docker host; phase gate scripts/check-phase16.3.sh; validation map +- [x] 16.3-04-PLAN.md — Unit tests: scope rules, route classification, guard, resolver, account API, CLI, migration, SPA backstops, Journal token matrix; Postgres tests for a Docker host; phase gate scripts/check-phase16.3.sh; validation map ### Phase 17: Blog companions diff --git a/.planning/STATE.md b/.planning/STATE.md index 6ccc861..24b117d 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -4,16 +4,16 @@ milestone: v1.0 current_phase: "16.3" current_phase_name: Backend admin personal API tokens with scopes status: executing -stopped_at: Completed 16.3-03-PLAN.md -last_updated: "2026-10-11T11:08:53.900Z" +stopped_at: Completed 16.3-04-PLAN.md +last_updated: "2026-10-11T11:42:00.000Z" last_activity: 2026-10-11 -last_activity_desc: Completed 16.3-02 admin SPA API tokens card -state_head: 2030fd881aa08347931c638a90548b16bc188f86 +last_activity_desc: Completed 16.3-04 unit tests, Postgres suites and phase gate +state_head: 463541549f374c328b121433a4e884146f86d25c progress: total_phases: 40 completed_phases: 13 total_plans: 162 - completed_plans: 157 + completed_plans: 158 gsd_state_version: "1.0" milestone_name: milestone --- @@ -31,8 +31,8 @@ See: .planning/PROJECT.md (updated 2026-09-16) Phase: 16.3 (Backend admin personal API tokens with scopes) — EXECUTING Plan: 4 of 4 -Status: Ready to execute -Last activity: 2026-10-11 — Completed 16.3-02 (admin SPA API tokens card) +Status: Plans complete — ready for verify-work +Last activity: 2026-10-11 — Completed 16.3-04 (unit tests, Postgres suites, phase gate) Progress: [█████░░░░░] 48% @@ -212,6 +212,7 @@ Progress: [█████░░░░░] 48% | Phase 16.3 P01 | 95 | 4 tasks | 43 files | | Phase 16.3 P02 | 9 min | 3 tasks | 17 files | | Phase 16.3 P03 | 658 min | 4 tasks | 12 files | +| Phase 16.3 P04 | 30 min | 3 tasks | 16 files | ## Accumulated Context @@ -693,6 +694,8 @@ Recent decisions affecting current work: - [Phase 16.3]: 16.3-02: expired from API drives Expired chip; dates use CellValue local YYYY-MM-DD / YYYY-MM-DD HH:mm — Plan decisions; no new date format - [Phase 16.3]: Released summercms v0.1.21 after human resume release v0.1.21; Journal requires it; grzybyfunkcjonalne journal gitlink bumped; summercmsio not bumped - [Phase 16.3]: Journal API uses cabana.ResolveBackend with cover golem15.journal.*; ErrTokenScope maps to PHP Insufficient permissions +- [Phase 16.3]: 16.3-04: full unit coverage + scripts/check-phase16.3.sh; postgres PASS on Docker host; nyquist_compliant true — Lean rule 3 phase-ending plan +- [Phase 16.3]: Public Journal Show under optional-auth needs published_at in the past, not only published:true — TestJournalTokens fixture ### Pending Todos @@ -765,6 +768,6 @@ Items acknowledged and carried forward from previous milestone close: ## Session Continuity -Last session: 2026-10-11T11:08:53.266Z -Stopped at: Completed 16.3-03-PLAN.md +Last session: 2026-10-11T11:42:00.000Z +Stopped at: Completed 16.3-04-PLAN.md Resume file: None diff --git a/.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-04-SUMMARY.md b/.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-04-SUMMARY.md new file mode 100644 index 0000000..f2654e9 --- /dev/null +++ b/.planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-04-SUMMARY.md @@ -0,0 +1,183 @@ +--- +phase: 16.3-backend-admin-personal-api-tokens-with-scopes +plan: 04 +subsystem: testing +tags: [api-tokens, unit-tests, vitest, testcontainers, phase-gate, nyquist] + +requires: + - phase: 16.3-backend-admin-personal-api-tokens-with-scopes + provides: token scopes, guard, account API, CLI, SPA card, Journal scopes +provides: + - "Full unit coverage of Phase 16.3 (lean rule 3)" + - "Postgres token suites for Docker hosts" + - "scripts/check-phase16.3.sh fail-closed gate" + - "16.3-VALIDATION.md with nyquist_compliant true" +affects: [verify-work, phase-16.3-close] + +actuals: + tokens: 34814 + tasks: 3 + commits: 7 +plan_head_before: 2030fd881aa08347931c638a90548b16bc188f86 +plan_head_after: 463541549f374c328b121433a4e884146f86d25c +TASK2_START: 91830e506f5e61537ae6180c3ff282bf19b81583 + +tech-stack: + added: [] + patterns: + - "Phase gate stages go/admin/docs/postgres with detect_go and detect_vitest fail-closed" + - "Journal TestJournalTokens matrix: writes × scopes with published_at for public Show" + - "SPA plaintext lifetime asserted via DOM/toast absence after Done and Esc-confirm" + +key-files: + created: + - modules/cabana/api_tokens_test.go + - modules/cabana/token_guard_test.go + - modules/cabana/account_tokens_test.go + - modules/cabana/token_commands_test.go + - modules/cabana/token_postgres_test.go + - scripts/check-phase16.3.sh + - ../sm-journal-plugin/journal_api_tokens_test.go + modified: + - modules/cabana/token_scopes_test.go + - modules/cabana/token_routes_test.go + - modules/bouncer/context_test.go + - modules/party/registry_test.go + - modules/lagoon/backend_admin_migrations_test.go + - admin/tests/account/ApiTokensPanel.test.ts + - admin/tests/account/ApiTokenCreateDialog.test.ts + - ../sm-journal-plugin/token_scopes_test.go + - .planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-VALIDATION.md + +key-decisions: + - "TASK2_START=91830e506f5e61537ae6180c3ff282bf19b81583 (framework Task 1 SHA); Task 2 diffs are *_test.go only" + - "Public Journal Show under optional-auth needs published_at in the past, not only published:true" + - "Phase gate --all ran postgres PASS on this Docker host (not NOT RUN)" + +patterns-established: + - "check-phase16.3.sh mirrors 16.2 detectors; PHASE163_REQUIRE_POSTGRES=1 fails --all without Docker" + - "Account SPA tests mount /account via helpers.mountApp with deferred fetch for loading skeletons" + +requirements-completed: [SC-6, SC-1, SC-2, SC-3, SC-4] + +coverage: + - id: D1 + description: "Scope match, Allows, compile/overlap, route gates and SPA plaintext backstop" + requirement: SC-6 + verification: + - kind: unit + ref: modules/cabana/token_scopes_test.go#TestScopeMatch + status: pass + - kind: unit + ref: modules/cabana/token_routes_test.go#TestTokenRouteGates + status: pass + - kind: automated_ui + ref: admin/tests/account/ApiTokenCreateDialog.test.ts#plaintext lifetime + status: pass + - kind: integration + ref: modules/cabana/token_postgres_test.go#TestBackendTokenPostgres + status: pass + human_judgment: false + - id: D2 + description: "Full Go coverage: bouncer, party, lagoon migration, guard, account API, CLI, Journal matrix" + requirement: SC-6 + verification: + - kind: unit + ref: modules/cabana (16 Docker-free named tests) + status: pass + - kind: integration + ref: modules/lagoon + modules/cabana + sm-journal-plugin Postgres suites (3+4+3) + status: pass + human_judgment: false + - id: D3 + description: "SPA UI-SPEC coverage, phase gate fail-closed, VALIDATION nyquist_compliant" + requirement: SC-6 + verification: + - kind: automated_ui + ref: npm --prefix admin test (1251 passed) + status: pass + - kind: other + ref: bash scripts/check-phase16.3.sh --all → Phase 16.3 gate passed + status: pass + human_judgment: false + - id: D4 + description: "Real-browser clipboard (Manual-Only in VALIDATION)" + verification: [] + human_judgment: true + rationale: "Clipboard API permissions differ from happy-dom; kept as Manual-Only row" + +duration: 30min +completed: 2026-10-11 +status: complete +--- + +# Phase 16.3 Plan 04: Unit tests, Postgres suites and phase gate Summary + +**Phase-ending coverage: every token security rule has a unit test, Docker Postgres suites are green, and `scripts/check-phase16.3.sh --all` ends with `Phase 16.3 gate passed`.** + +## Performance + +- **Duration:** ~30 min (executor wall clock for plan 04) +- **Started:** 2026-10-11T11:11:34Z +- **Completed:** 2026-10-11T11:41:20Z +- **Tasks:** 3 +- **Files modified:** 16 across summercms.go + sm-journal-plugin + +## Accomplishments + +- Docker-free Go suite: 16 named cabana tests, bouncer Scope serialization, party Activate order; Journal `TestJournalTokenScopes` with `-short`. +- Postgres: lagoon migration (3), cabana account/CLI/guard/OpenAPI (4), Journal token matrix (3) — all PASS on this Docker host. +- Admin SPA: 33 account-token vitest cases; full suite 1251 passed; gate self-test and `--all` green; VALIDATION `nyquist_compliant: true`. + +## Task Commits + +Each task was committed atomically: + +1. **Task 1: Tracer deny-by-default** — framework `91830e5`, Journal `7bbafcb` (`test(16.3-04)`) +2. **Task 2: Full Go coverage** — framework `78124ab`, Journal `58851dd` (`test(16.3-04)`); `TASK2_START=91830e5` +3. **Task 3: SPA + gate + VALIDATION** — SPA `55999b2`, gate `9b811f6` (`test(16.3): phase gate`), VALIDATION `4635415` (`docs(16.3)`) + +**Plan metadata:** (this SUMMARY commit) + +_Note: No `fix(...)` production commits were required; Journal create fixture needed `published_at` for public Show (test-only)._ + +## Test counts + +| Repository | Notes | +|------------|--------| +| summercms.go | 16 Docker-free cabana named tests; + bouncer/party; Postgres lagoon 3 + cabana 4 | +| admin SPA | 14 panel + 19 dialog cases; full vitest 1251 | +| sm-journal-plugin | `TestJournalTokenScopes` (short); Postgres `TestJournalTokens` + tracer + expansion | + +## Docker-host commands + +```bash +bash scripts/check-phase16.3.sh --self-test +bash scripts/check-phase16.3.sh --all # postgres PASS here +# or, if NOT RUN postgres was printed: +bash scripts/check-phase16.3.sh postgres +``` + +## Decisions Made + +- Public optional-auth Show asserts need `published_at` in the past alongside `published: true`. +- Gate reports NOT RUN postgres only without Docker; this run executed postgres. + +## Deviations from Plan + +None material — plan executed as written. Journal Show fixture clarified with `published_at` inside the test file (not a production fix). + +## Issues Encountered + +None. + +## Next Phase Readiness + +- Phase 16.3 plans 4/4 complete; ready for `/msd-verify-work` (and optional real-browser clipboard Manual-Only). +- No blockers. + +## Self-Check: PASSED + +- Acceptance greps for TestAccountTokens, TestTokenCommands, TestBackendAPITokensMigration, TestJournalTokens: one line each. +- Task 2 Docker-free count 16; Postgres 3/4/3; gate `--all` last line `Phase 16.3 gate passed`. +- VALIDATION: `nyquist_compliant: true`, zero TBD rows. diff --git a/.planning/state.json b/.planning/state.json index f6b9606..ad99675 100644 --- a/.planning/state.json +++ b/.planning/state.json @@ -169,5 +169,5 @@ "label": "Advance to the next step", "reason": "Phase 16.3 of 40 · executing" }, - "updated_at": "2026-10-11T00:07:52.680Z" + "updated_at": "2026-10-11T11:42:00.000Z" }