When a public image's thumb_url or url fails to load, the fileupload
field fetches its preview once through the authenticated thumb route
(session key in the header) and shows it from an object URL, revoked
when the item is forgotten and on unmount. The preview is reported as
unavailable only when that fetch or the object-URL image fails too.
Protected fields behave as before.
The record and relation-child thumb routes now also serve the thumbnail
of a public JPEG, PNG, GIF or WebP file, under the same record or
pending-session scope and D-10 headers as a protected one, so the admin
can preview a public image whose public URL does not load. The download
routes still answer 404 for every public file, and a public non-image
thumb stays 404.
TestPublicImageThumb covers owner, foreign and hidden records, image
types, a public row under a protected field, another admin's pending
upload and the relation-child route.
The userplugin stage compared against c077029 only; the merge of
origin/master brought in 24b16b1's pre-phase console signature change.
A declaration now counts as removed only when removed against every base.
TestEndRequestSession joins the userplugin stage; TestRequestUser,
TestAvatarURL and TestDeactivatingEvent the docker stage. --all is green
on a Docker host (parity NOT RUN, deferred).
TestPHPMethodMap, the zero-edit port and the Docker-free internals join
the plugin stage, the Postgres internals the docker stage; the plugin
stage points SUMMERCMS_ROOT and USER_PLUGIN at this run's checkouts.
- scripts/check-phase19.4.sh: go, plugin, userplugin, fonoteka, docker,
parity and docs stages; go test -json detectors refuse a fail, a skip,
zero tests or a missing name
- additive check on the user plugin since c077029; NOT RUN rules for
docker and parity proven on a faked host by --self-test
- required names: the smoke tests of plans 01-03
ASVS L1 walk over the wristband OIDC flavour, sm-oauthserver-plugin and the
sm-user-plugin additions. T-19.4-01..34 and T-19.4-SC verified or fixed (test
pins in summercms.go eaa545c and sm-oauthserver-plugin b4223be, f8eaf70);
new findings T-19.4-36..39 accepted with reasons; nothing left unresolved.
- a code is refused for another client or redirect URI and burned
- authorize refuses plain and malformed challenges; verifier rules; 60 s code TTL
- rejected token exchanges log client id, IP and reason only; key parse errors quote no key
- a public sub is a random UUIDv4
The user skipped the parity recording at 19.4-03 Task 5 and decided the
phase passes without it. D-14 in this phase is the fail-closed harness;
recording WavePath and a green replay move to the WavePath cutover phase
(todo 2026-10-19-record-php-oidc-parity-against-wavepath).
- capture rule from: response.form reads the value of the <input> with
the rule's name (a server-rendered form's one-shot token), so a parity
flow can post a consent form back
- README and parity docs list the capture sources
- DefaultOptions().Resource is empty; comments name the host application,
no consuming application (folded todo)
- Tests set an explicit neutral resource; TestDefaultOptionsResourceEmpty
- wristband README: new summary, two flavours, OIDC usage, API reference,
OIDC defaults, dependencies, testing; root README row matches
- docs/services/oauth-server.md: OpenID Connect provider section;
Resource described as required with an empty default
- ExampleNewOIDCServer and the newOIDCServer docs region
- Full validation chain with PHP order and messages; repeated params last-wins
- is_dev loopback port matching (matchOIDCRedirectURI); PHP http_build_query redirects, no iss
- One-shot consent token burned under row lock; deny; SwitchAccount; JSON-mode
ConsentRequest and DecideConsent
- ClientRecord.Kind with ClientKindMCP/ClientKindOIDC; each flavour refuses the
other kind at authorize, token and userinfo (D-08)
- Smoke tests: start, resume/decide/switch, kind isolation, PHP encoding
- NewOIDCServer/SetOIDCBackend build a second Server on the same engine;
Authorize and Token dispatch by flavour, Metadata/Register 404 on OIDC
- OIDCBackend/OIDCTx, KeyStore and OIDCHost seams; MCP Backend untouched
- Discovery (PHP field order), JWKS (stdlib JWK encoding), authorize with
resume and one-shot consent token, token with an RS256 id_token signed
through golang-jwt map claims, userinfo
- TestOIDCTracerSmoke verifies the id_token against the served JWKS
- One shared localizer for ValidationError and ForbiddenError, tested in
writeCRUDError's order; replaces the ForbiddenError-only one.
- Applied on the CRUD and relation service transactions, the detached bulk
branch, runAction, the record read (ShowRecord), and the reorder,
singleton and relation-options routes, which localized neither type.
- Only strings containing "::" are looked up, so translated text passes
through unchanged and logs no missing-key warning.
- Copy-on-write: the plugin's error value is never modified.
- README and backend docs describe the localized ValidationError.
