summercms/.planning/phases/08-oauth2-1-authorization-server/08-05-PLAN.md

phase, plan, type, wave, depends_on, files_modified, autonomous, requirements, must_haves

phase	plan	type	wave	depends_on	files_modified	autonomous	requirements	must_haves
08-oauth2-1-authorization-server	05	execute	5	08-04	../fonoteka.go/plugins/golem15/fonoteka/controllers/api/oauth_consent_controller.go ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/oauth_consent_controller_test.go ../fonoteka.go/plugins/golem15/fonoteka/plugin.go ../fonoteka.go/plugins/golem15/fonoteka/routes.go ../fonoteka.go/plugins/golem15/fonoteka/oauth_connect_test.go scripts/check-phase8-ui.mjs	true	AUTH-05 AUTH-06 AUTH-07	truths artifacts key_links D-08: JWT consent returns exact unchanged-Nuxt payloads and derives scopes and collection ids server-side. D-09: Authorize/token remain raw while consent routes remain in the JWT group. Invalid handles make no request, login uses the closed return-path allow-list, and English/Polish consent copy resolves. Consent state, keyboard/focus, 44px target, and mobile stacking matrices are proven without changing Nuxt source. path provides ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/oauth_consent_controller.go Owner-bound consent show/allow/deny API path provides scripts/check-phase8-ui.mjs Read-only browser harness for the approved UI-SPEC from to via pattern scripts/check-phase8-ui.mjs /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app existing Playwright dependency, mocked backend responses, and no source writes playwright

Wire browser consent and prove the complete approved UI contract against the unchanged Nuxt checkout.

Purpose: Separate browser-facing API/state compatibility from protocol internals and make preservation objectively executable. Output: JWT consent controllers/routes, assembled flow tests, and an external read-only browser/UI gate.

<execution_context> @/home/jin/.codex/get-shit-done/workflows/execute-plan.md @/home/jin/.codex/get-shit-done/templates/summary.md </execution_context>

@.planning/PROJECT.md @.planning/ROADMAP.md @.planning/STATE.md @.planning/phases/08-oauth2-1-authorization-server/08-CONTEXT.md @.planning/phases/08-oauth2-1-authorization-server/08-UI-SPEC.md @.planning/phases/08-oauth2-1-authorization-server/08-VALIDATION.md @.planning/phases/08-oauth2-1-authorization-server/08-04-SUMMARY.md Task 1: Specify assembled consent and route behavior in executable RED ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/oauth_consent_controller_test.go, ../fonoteka.go/plugins/golem15/fonoteka/oauth_connect_test.go - Show/allow/deny cover exact 200/404/422 payloads, host-only redirect, canonical scopes, active collection, ownership, and ordered redirects. - Tests compile and fail only through `PHASE8_RED:consent`. D-18: add controller and assembled PKCE flow tests against 08-04 interfaces. Use `PHASE8_RED:consent` only for absent controller/route behavior and reject syntax/setup/missing-test failures via the RED verifier. Cover T-08-CROSS-USER, SCOPE-CEILING, REQUEST-LEAK, and SURFACE, including duplicate action single-use. scripts/check-phase8-red.sh consent bash -lc "cd ../fonoteka.go && go test ./plugins/golem15/fonoteka/... -run 'TestOAuth(Authorize|Consent|Deny|CodeExchange|Surface)' -count=1" Consent tests compile, execute, and fail only on the intended missing behavior. Task 2: Implement owner-bound JWT consent and raw route wiring ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/oauth_consent_controller.go, ../fonoteka.go/plugins/golem15/fonoteka/controllers/api/oauth_consent_controller_test.go, ../fonoteka.go/plugins/golem15/fonoteka/plugin.go, ../fonoteka.go/plugins/golem15/fonoteka/routes.go, ../fonoteka.go/plugins/golem15/fonoteka/oauth_connect_test.go - Show returns sanitized client, host-only redirect, ordered mintable scopes, active collection name, and ISO expiry. - Allow grants submitted ∩ requested ∩ ceiling ∩ mintable; deny consumes pending state; both return nonblank ordered redirect_to. D-08: implement show/allow/deny in the JWT+locale+must-change-password group using `bouncer.User`, `ResolveActiveCollection`, `lagoon.Validate`, and wristband operations; never accept collection IDs or extra scopes. Collapse missing/stale/used/foreign handles to exact 404 and empty/no-longer-grantable intersection to exact 422. D-09: mount authorize/token in raw routes and only token receives its throttle. D-10 and D-12: add no oauth guard, house middleware, backend Bearer challenge, or RFC 9728 document. cd ../fonoteka.go && go test ./plugins/golem15/fonoteka/... -run 'TestOAuth(Authorize|Consent|Deny|CodeExchange|Surface)' -count=1 The unchanged consent client can inspect, allow, or deny one owner-bound request and complete exact PKCE code exchange. Task 3: Prove the approved consent and connected-app UI contract read-only scripts/check-phase8-ui.mjs .planning/phases/08-oauth2-1-authorization-server/08-UI-SPEC.md /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/package.json /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/app/pages/connect.vue /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/app/components/fonoteka/ConsentScopePicker.vue /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/app/components/fonoteka/ConnectedAppsManager.vue /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app/app/stores/fonoteka.ts Create a read-only harness outside the Nuxt checkout using its already-installed Playwright runtime. First run `pnpm verify:oauth-return-path` and `pnpm verify:oauth-i18n`. Then boot the unchanged app and intercept API responses to prove: invalid/missing/repeated-first-invalid handles send no oauth/request call; logged-out entry preserves only a validated localized return path; 200, 404, network/error, empty-scope, allow-pending, deny-pending, and one-redirect outcomes render correctly; connected-app error/empty/manual-count/populated/cancel/revoke-pending/success/failure/identical-404 states render correctly. Assert keyboard order, visible 2px focus, dialog trap/Escape/restore, native disabled semantics, checkbox/revoke targets at least 44px, narrow/mobile stacking and no horizontal overflow, and both English/Polish strings with no raw keys. Snapshot the OAuth-related Nuxt paths before/after and fail on any diff; do not write fixtures, snapshots, generated files, or source inside Nuxt. cd /media/nvme/dev/golem15/fonoteka/vue-fonoteka-app && pnpm verify:oauth-return-path && pnpm verify:oauth-i18n && cd /media/nvme/dev/golem15/summercms.io/summercms/summercms.go && node scripts/check-phase8-ui.mjs --focused The full UI-SPEC state/accessibility/return-path/i18n matrix passes against unchanged Nuxt files, and the harness is callable from the final gate.

<threat_model>

Trust Boundaries

Boundary	Description
Browser JWT principal → consent API	Authenticated input crosses ownership/scope/tenant boundaries.
Backend data → unchanged Nuxt	Untrusted names and protocol state select rendered UI states.

STRIDE Threat Register

Threat ID	Category	Component	Disposition	Mitigation Plan
T-08-SCOPE-CEILING	Elevation	consent	mitigate	Four-way scope intersection and server-derived collection.
T-08-CROSS-USER	Elevation	consent	mitigate	Principal-bound lookup/consume and indistinguishable 404.
T-08-REQUEST-LEAK	Information Disclosure	browser/errors	mitigate	Opaque handle, no-referrer behavior, no request on invalid handle.
T-08-SURFACE	Elevation	route groups	mitigate	Raw/JWT isolation and browser contract harness.
T-08-SC	Tampering	Playwright reuse	mitigate	Reuse installed locked dependency; no package install.
</threat_model>

- Focused consent/app tests pass under 30 seconds where possible. - UI harness runs at the wave boundary and is invoked again by the final gate.

<success_criteria>

• Consent API matches every unchanged client state selector.
• Return-path, no-invalid-request, i18n, state, accessibility, and responsive matrices have runnable evidence.
• Nuxt source remains unchanged. </success_criteria>

Create `.planning/phases/08-oauth2-1-authorization-server/08-05-SUMMARY.md` when done.