summercms/.planning/phases/07-user-plugin-and-authentication/07-06-SUMMARY.md

phase, plan, subsystem, tags, requires, provides, affects, tech-stack, key-files, key-decisions, patterns-established, requirements-completed, duration, completed

phase	plan	subsystem	tags	requires	provides	affects	tech-stack	key-files	key-decisions	patterns-established	requirements-completed	duration	completed
07-user-plugin-and-authentication	06	testing	bouncer jwt fonoteka parity race	phase provides 07-user-plugin-and-authentication session, account, token, and locale handlers plus the recorded user-api corpus	mint/refresh/blacklist round-trip and concurrent blacklist tests in-process register-to-logout sequence and per-scope token mints signed-off 07-VALIDATION.md	phase-7-verification	added patterns phase gate is go test -race in both modules including nested plugin modules	created modified bouncer/phase07_coverage_test.go ../fonoteka.go/plugins/golem15/user/sequence_test.go .planning/phases/07-user-plugin-and-authentication/07-VALIDATION.md ../fonoteka.go/parity/schema_diff_test.go	user_throttle and jwt_blacklist are named allowed diffs against the frozen PHP schema snapshot AUTH-01 through AUTH-04 and I18N-02 stay unchecked; user-api routes stay pending	Pattern: nested plugin modules are tested with explicit ./plugins/golem15/... paths		40min	2026-09-22

Phase 7 Plan 06: Unit coverage Summary

Phase 7's session, token, and blacklist paths have direct tests, and go test -race is green in both modules.

Performance

• Duration: 40 min
• Started: 2026-09-22T16:50:00Z
• Completed: 2026-09-22T17:20:32Z
• Tasks: 3
• Files modified: 8

Accomplishments

• Mint, verify, refresh, and blacklist round-trip, plus concurrent Memory and Postgres blacklist calls, pass under -race.
• TestSessionSequence walks register, fetch, update, change-password, refresh, logout, and a 401 on the logged-out token. Token mint covers read, write, ai, and read+write.
• 07-VALIDATION.md task IDs are filled, Wave 0 and sign-off boxes are checked, and nyquist_compliant is true.
• Corpus inventory stays recorded 169, ported 7, pending 162, failing 0. TestParityCorpus passes.

Task Commits

1. Task 1: Framework blacklist coverage — 4754377 in summercms.go
2. Task 2: Session sequence and token scopes — a9f3531 in fonoteka.go (lock and deferred-route tests already in 9e5a125)
3. Task 3: Validation sign-off — this docs commit

Files Created/Modified

• bouncer/phase07_coverage_test.go — round-trip and concurrent blacklist tests
• plugins/golem15/user/sequence_test.go — register through logout
• plugins/golem15/fonoteka/token_locale_test.go — one mint per allowed scope set
• parity/schema_diff_test.go — allowed extra tables for the user plugin
• parity/migrate_test.go — user history is five migrations
• 07-VALIDATION.md — task IDs and green statuses

Decisions Made

The frozen PHP schema snapshot predates the user plugin. user_throttle and jwt_blacklist are allowed extra Go tables, with the reason written on the diff entry. jwt_blacklist is Go-only: PHP logout does not blacklist, and the recorded fetch-after-logout stays 200.

Requirement checkboxes stay open. The user-api routes are still pending, and authenticated activate with a wrong code is still an HTML 500 in PHP while Go returns 200.

Deviations from Plan

Auto-fixed Issues

1. [Rule 1 - Bug] Schema and migration tests still described the pre-phase-7 user plugin

• Found during: Task 3 (full go test -race)
• Issue: TestSchemaMatchesPHPSnapshot rejected user_throttle and jwt_blacklist. Migration status expected 2 user migrations; there are 5. TestHiddenNeverMarshals expected 2 user models; Throttle makes 3. TestGenreSecurityBoundaries booted without http.body_limits.
• Fix: Named the two tables in allowedDiffs, expected 5 user migrations and 3 user models, and set the body-limit keys on that test config.
• Files modified: parity/schema_diff_test.go, parity/migrate_test.go, plugins/golem15/fonoteka/classes/hidden_marshal_test.go, parity/genre_security_test.go
• Verification: go test ./... -race and the nested plugin packages passed
• Committed in: 280ff56

---

Total deviations: 1 auto-fixed Impact on plan: The gate was red on counts the phase itself had already shipped. No production code changed.

Issues Encountered

summer parity:replay requires --target and --fixtures. The in-process gate is go test ./parity/ -run TestParityCorpus, which reports passing 7, failing 0, pending 162. Pending user-api fixtures are loaded and not sent to the Go handler.

User Setup Required

None - no external service configuration required.

Next Phase Readiness

Phase 7 plans are done and ready for verification. AUTH-01, AUTH-02, AUTH-03, AUTH-04, and I18N-02 stay unchecked until that sign-off. The activate HTML 500 and fetch-after-logout 200 gaps stay recorded, not patched.

Self-Check: PASSED

• go vet ./... && go test ./... -race passed in summercms.go.
• go vet ./... && go test ./... -race passed in fonoteka.go, including ./plugins/golem15/user, ./plugins/golem15/fonoteka, and ./plugins/golem15/fonoteka/....
• TestParityCorpus inventory is recorded 169, ported 7, pending 162, failing 0.
• Commits 4754377, a9f3531, and 280ff56 are on master. go.work.sum is untracked and not committed.