golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(19.5): record the last UAT answers (prohibitions, CR-02 wording)

Browse Source
This commit is contained in:
Jakub Zych
2026-10-21 15:06:40 +02:00
parent 8af7c22cfc
commit ff0e3a6c69
2 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md
View File

@@ -1,9 +1,9 @@
---
status: testing
status: complete
phase: 19.5-social-login-in-sm-user-plugin
source: [19.5-VERIFICATION.md]
started: 2026-10-21T00:24:54.347Z
updated: 2026-10-21T13:20:00.000Z
updated: 2026-10-21T13:40:00.000Z
---
## Current Test
@@ -30,18 +30,20 @@ retested_by: 19.5-05
### 3. Review the judgment-tier prohibition verdicts in the 'Prohibitions' section of this report (non-authoritative LLM-judge verdicts).
expected: Confirm or dispute each verdict; all are recorded as no violation found.
result: [pending]
result: pass
reported: "prohibitions ok"
### 4. Decide on 19.5-REVIEW CR-02: an account pre-created by sociallogin from an unverified provider email (created activated, S classes/registration.go) keeps the attacker's Microsoft or Facebook identity after the real owner proves the address with a reset-code password reset.
expected: Either accept it (PHP parity on account creation) and correct sm-sociallogin-plugin README.md:50, which offers 'proves the address with a password reset' as the recovery; or schedule the follow-up the review proposes (create the account inactive unless p.EmailVerified, and/or drop unverified identities when the reset stamps email_verified_at).
result: [pending]
result: pass
reported: "fix README wording quickly" (behaviour accepted; sm-sociallogin-plugin 79cebb9 says a reset does not unlink identities linked before the proof and points to the identities list)
## Summary
total: 4
passed: 1
passed: 3
issues: 0
pending: 2
pending: 0
skipped: 1
blocked: 0

4
.planning/todos/pending/email-proof-release.md
View File

@@ -36,7 +36,7 @@ Unreleased commits (`git log --oneline origin/master..master`, fetched 2026-10-2
| Repository | Unpushed commits | This plan's? |
|------------|------------------|--------------|
| sm-user-plugin (`../fonoteka.go/plugins/golem15/user`) | `35cf166`, `a99cb46`, `add1f7a` | all 19.5-05 |
| sm-sociallogin-plugin | `c4ebf05`, `962190b`, `3bb5650` | all 19.5-05 |
| sm-sociallogin-plugin | `79cebb9`, `c4ebf05`, `962190b`, `3bb5650` | all 19.5-05 (79cebb9: README, CR-02 wording) |
| sm-bm-app | `5fd0cc3` (bm OAuth callback view test) | 19.5-05 Task 4 |
| sm-demo-app | `b325460` feat(demo): roadmap deck describes the new console | **foreign**: another session (19.8), touches only `plugins/demo/content/ROADMAP.md` and `plugins/demo/roadmap/` |
| fonoteka.go | 31 commits (`f4d5728` … `ca746fc`) | all foreign; fonoteka.go is never pushed by this release |
@@ -47,7 +47,7 @@ Proposed tags (free on the remotes at the time of the check; no tag points at ei
| Repository | Tag | Points at |
|------------|-----|-----------|
| sm-user-plugin | `v0.1.5` | `35cf166` |
| sm-sociallogin-plugin | `v0.1.2` | the new commit `chore: require sm-user-plugin v0.1.5` on top of `c4ebf05` |
| sm-sociallogin-plugin | `v0.1.2` | the new commit `chore: require sm-user-plugin v0.1.5` on top of `79cebb9` |
Current pins: sm-demo-app and sm-bm-app `plugins/golem15/user` c43ba87 (v0.1.4) and `plugins/golem15/sociallogin` d7ee28d (v0.1.1); sm-demo-app go.mod requires sm-user-plugin v0.1.4 and sm-sociallogin-plugin v0.1.1; sm-bm-app go.mod requires sm-user-plugin v0.1.4 and sm-sociallogin-plugin v0.0.0 (replace to the submodule; only the user line names a version); fonoteka.go gitlink c43ba87, with the worktree already at `35cf166` and left unstaged.