- admin-controllers: placement, values, Load/Save, permissions,
widgets, partials and boot errors, with the ExtrasPlugin snippet
- Example_formExtension compiles an owner form with the extension
- coming-from-wintercms maps extendFormFields, addFields, addTabFields
and removeField to the form extension
- cabana README feature bullet and Activate row
- placement: tabs before/after tab anchors, anchor cursor for plugin
order, own-field anchors sorted with cycle detection, Requires() rule,
anchor tab inheritance, Hide with reference checks, zone refusal (D-101)
- boot errors name plugin, controller and offending name; fileupload is
refused (D-100); localized tab label collisions checked in Activate
- extension widgets dispatch to AdminFormExtension.Actions, partials
render from the contributor's Dir through PartialData, plugin field
types decode for Save and load after Load, translatable values reach
Save as locale maps and never the owner's translations
- Permissions and Visible apply to schema, show, save, widgets and
partials; AdminFormErrors answer 422, Save notices join meta.notices
- pact.AdminActionExtension.Form with AdminFormExtension: a fields
document (fields.yaml format plus before:/after:/zone: and a tabs:
list) given as an AdminFS path or YAML bytes, Load and Save hooks,
AdminFormLoad/Save/SaveResult, AdminFormErrors and zone constants
- cabana compileFormExtensions places extension fields at owner
anchors at boot, regrouping an extended form by tab
- save lifts extension values before any owner path and runs Save in
the record's transaction after the owner row; show merges Load
- TestFormExtensionTracer: c after a on a, b gives a, c, b through the
admin API, stored in the contributor's table
Six plans per D-98: form extensions, record events and content
descriptors with Journal adoption, sm-seo-plugin core, redirects and
robots.txt, management API with MCP, batch, undo and CSV, then unit
tests and the patch release. COVERAGE.md declares no external API
integration.
- security review: T-19.6-37 closed by sm-mfa-plugin v0.1.1, F-1 deferred
with the corrected reason for the activate-by-code mint path
- validation map: plan 04 Tasks 5 and 6 green
- todo for F-1; deferred items: tag message resolved, F-1 deferred
- 19.6-SECURITY-REVIEW.md: T-19.6-01..38 mapped to their tests or accepted
dispositions, the D-14 passkey section, D-18 hardening, ASVS notes, log
sweep, residual risks and open finding F-1 (activate-by-code)
- 19.6-VALIDATION.md: validated, one row per task of plans 01-04 with its
gate stage and tests
- mfa stage: the seven Docker-free decision tests by name
- docker stage: the sixteen Postgres decision tests of sm-mfa-plugin,
TestEveryLoginPathIsGated included, and TestSocialGate
- userplugin stage: TestLoginGates (also under -race), TestDeviceAuthURL,
TestDeviceDisplayName and TestDeviceCodes in classes
- docker stage: the gate order, password-change sources, reset action and
device-flow tests, and TestDeviceAuthSessionsMigration in updates
- stages go, userplugin, mfa, sociallogin, demo, demo-web, bm, fonoteka,
docker and docs across the seven repositories the phase touched
- go test -json detector refuses fail, skip, zero tests and missing names;
--self-test proves it, the additive and migration checks and the docker
NOT RUN rule on planted input
sm-demo-app mounts golem15.mfa v0.1.0 at user v0.1.12, sociallogin v0.1.4
and the two-factor UI (0eb1f60..bb24207, pushed with the 19 earlier
commits as 18597e5..bb24207, not deployed). The summary records the
"proceed" reply, the push checks and the tests. deferred-items.md gains the
private sm-mfa-plugin repository's effect on the demo's release build, and
a pending todo tracks the demo's leftover journal and oauthserver moves.
- WebAuthn and passkeys committed in sm-mfa-plugin (2662252, 6c8916f),
demo two-factor UI in vue-demo-app (44a5229)
- sociallogin D-09 change kept as a patch: the checkout is jin's
- deferred items: sociallogin gofmt finding, no demo type check
pquerna/otp v1.5.0, go-webauthn/webauthn v0.18.2 and boombuler/barcode
v1.1.0 (QR, with the plugin's own SVG writer), imported only by
sm-mfa-plugin and gated by a blocking human package check.
SEO moves to sm-seo-plugin and sm-sitemap-plugin on three generic
framework seams (form extensions with field placement, record events,
signpost content descriptors), following the mpseo pattern. Phase 32 is
split into 32/33/34.
