TestPHPMethodMap, the zero-edit port and the Docker-free internals join
the plugin stage, the Postgres internals the docker stage; the plugin
stage points SUMMERCMS_ROOT and USER_PLUGIN at this run's checkouts.
- scripts/check-phase19.4.sh: go, plugin, userplugin, fonoteka, docker,
parity and docs stages; go test -json detectors refuse a fail, a skip,
zero tests or a missing name
- additive check on the user plugin since c077029; NOT RUN rules for
docker and parity proven on a faked host by --self-test
- required names: the smoke tests of plans 01-03
ASVS L1 walk over the wristband OIDC flavour, sm-oauthserver-plugin and the
sm-user-plugin additions. T-19.4-01..34 and T-19.4-SC verified or fixed (test
pins in summercms.go eaa545c and sm-oauthserver-plugin b4223be, f8eaf70);
new findings T-19.4-36..39 accepted with reasons; nothing left unresolved.
- a code is refused for another client or redirect URI and burned
- authorize refuses plain and malformed challenges; verifier rules; 60 s code TTL
- rejected token exchanges log client id, IP and reason only; key parse errors quote no key
- a public sub is a random UUIDv4
The user skipped the parity recording at 19.4-03 Task 5 and decided the
phase passes without it. D-14 in this phase is the fail-closed harness;
recording WavePath and a green replay move to the WavePath cutover phase
(todo 2026-10-19-record-php-oidc-parity-against-wavepath).
- capture rule from: response.form reads the value of the <input> with
the rule's name (a server-rendered form's one-shot token), so a parity
flow can post a consent form back
- README and parity docs list the capture sources
- DefaultOptions().Resource is empty; comments name the host application,
no consuming application (folded todo)
- Tests set an explicit neutral resource; TestDefaultOptionsResourceEmpty
- wristband README: new summary, two flavours, OIDC usage, API reference,
OIDC defaults, dependencies, testing; root README row matches
- docs/services/oauth-server.md: OpenID Connect provider section;
Resource described as required with an empty default
- ExampleNewOIDCServer and the newOIDCServer docs region
- Full validation chain with PHP order and messages; repeated params last-wins
- is_dev loopback port matching (matchOIDCRedirectURI); PHP http_build_query redirects, no iss
- One-shot consent token burned under row lock; deny; SwitchAccount; JSON-mode
ConsentRequest and DecideConsent
- ClientRecord.Kind with ClientKindMCP/ClientKindOIDC; each flavour refuses the
other kind at authorize, token and userinfo (D-08)
- Smoke tests: start, resume/decide/switch, kind isolation, PHP encoding
- NewOIDCServer/SetOIDCBackend build a second Server on the same engine;
Authorize and Token dispatch by flavour, Metadata/Register 404 on OIDC
- OIDCBackend/OIDCTx, KeyStore and OIDCHost seams; MCP Backend untouched
- Discovery (PHP field order), JWKS (stdlib JWK encoding), authorize with
resume and one-shot consent token, token with an RS256 id_token signed
through golang-jwt map claims, userinfo
- TestOIDCTracerSmoke verifies the id_token against the served JWKS
- One shared localizer for ValidationError and ForbiddenError, tested in
writeCRUDError's order; replaces the ForbiddenError-only one.
- Applied on the CRUD and relation service transactions, the detached bulk
branch, runAction, the record read (ShowRecord), and the reorder,
singleton and relation-options routes, which localized neither type.
- Only strings containing "::" are looked up, so translated text passes
through unchanged and logs no missing-key warning.
- Copy-on-write: the plugin's error value is never modified.
- README and backend docs describe the localized ValidationError.
New Phase 20 is a public demo instance on sm-demo-app with every shared
plugin. Phases 21-29 stay off the roadmap until their goals firm up.
The cutover (closing v1.0) moves to 30; WavePath work starts at 31 with
the former 19.2, Horoskopia follows at 36-40. Seeds, notes and the
30-CONTEXT now point at the new numbers.
An optional dependency is optional at activation, not at compile time:
importing the package that declares a looked-up type keeps the other
plugin in go.mod; only party.Plugin.Requires leaves it out.
- PG_CHATVIDEO_TESTS runs TestUserDeletionReassignsSession (WR-05)
- self-test lists the token and pins it in the PG_CHATVIDEO_TESTS line
- NOT RUN postgres banner names it
The docs stage now refuses secret-shaped content (key names, PEM private
keys, JWTs) in each sibling's testdata/goldens; --self-test plants each
pattern. Closes T-19.1-12.
Copy the phase 19 detector shape onto five sibling plugin roots, named short tests, postgres tracers plus GDPR names, and the three decision-note greps.
Co-authored-by: Cursor <cursoragent@cursor.com>
