7.6 KiB
created, title, priority, area, severity, g15office, files
| created | title | priority | area | severity | g15office | files | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026-10-21T15:00:00.000Z | Release the email-proof fix (sm-user-plugin v0.1.5, sm-sociallogin-plugin v0.1.2) and move the app pins | high | sm-user-plugin, sm-sociallogin-plugin | major | sqnwn1zi |
|
Hand-off
For the 19.8 session (console commands overhaul): review this release and decide on it together with the framework v0.4.0 release. On 2026-10-21 the user answered the 19.5-05 Task 6 checkpoint with hold: nothing was pushed or tagged and no pointer moved. Every step below needs the user's go-ahead; never force-push, never deploy.
The plugin tags live in the plugins' own repositories (sm-user-plugin, sm-sociallogin-plugin). They are separate from the framework v0.4.0 tag on summercms.go and need no framework release; the framework tag does not carry them.
Problem
Phase 19.5 plan 05 (gap closure) made a verified social sign-in link only onto an account whose owner proved the address: users.email_verified_at (migration 202610210001_add_users_email_verified_at, stamped by the mailed activation code and the reset-code password reset, cleared on an email change), and sociallogin's ownerVerifiedEmail reads it (D-26). Details: .planning/phases/19.5-social-login-in-sm-user-plugin/19.5-05-SUMMARY.md.
The fix sits in local commits only. Until it is released, sm-demo-app and sm-bm-app keep the pre-account-takeover path (19.5 VERIFICATION item 1): an auto-mode /register account with someone else's address is linked when that address's owner signs in with Google, handing the sign-in to the squatter.
Unreleased commits (git log --oneline origin/master..master, fetched 2026-10-21 about 12:25Z):
| Repository | Unpushed commits | This plan's? |
|---|---|---|
sm-user-plugin (../fonoteka.go/plugins/golem15/user) |
35cf166, a99cb46, add1f7a |
all 19.5-05 |
| sm-sociallogin-plugin | 79cebb9, c4ebf05, 962190b, 3bb5650 |
all 19.5-05 (79cebb9: README, CR-02 wording) |
| sm-bm-app | 5fd0cc3 (bm OAuth callback view test) |
19.5-05 Task 4 |
| sm-demo-app | b325460 feat(demo): roadmap deck describes the new console |
foreign: another session (19.8), touches only plugins/demo/content/ROADMAP.md and plugins/demo/roadmap/ |
| fonoteka.go | 31 commits (f4d5728 … ca746fc) |
all foreign; fonoteka.go is never pushed by this release |
| summercms.go | this plan's 7170c5b, 30e0cd9, c2c8c6a, 7e43873, 8c7794e among others |
never pushed by this release |
Proposed tags (free on the remotes at the time of the check; no tag points at either plugin's master):
| Repository | Tag | Points at |
|---|---|---|
| sm-user-plugin | v0.1.5 |
35cf166 |
| sm-sociallogin-plugin | v0.1.2 |
the new commit chore: require sm-user-plugin v0.1.5 on top of 79cebb9 |
Current pins: sm-demo-app and sm-bm-app plugins/golem15/user c43ba87 (v0.1.4) and plugins/golem15/sociallogin d7ee28d (v0.1.1); sm-demo-app go.mod requires sm-user-plugin v0.1.4 and sm-sociallogin-plugin v0.1.1; sm-bm-app go.mod requires sm-user-plugin v0.1.4 and sm-sociallogin-plugin v0.0.0 (replace to the submodule; only the user line names a version); fonoteka.go gitlink c43ba87, with the worktree already at 35cf166 and left unstaged.
Solution
D-21 order: user plugin first, then sociallogin, then the apps (user bump, then sociallogin bump). Before every push: git fetch origin, no uncommitted change to the release paths, and git log --oneline origin/master..master lists only the expected commits; otherwise stop and report. Stage by path.
- Docker gate runs: the NordLayer VPN's nftables table drops loopback traffic to published container ports, so testcontainers Postgres times out. Restore it with
sudo nft insert rule inet nordlayer input iifname "lo" acceptandsudo nft insert rule inet nordlayer output oifname "lo" accept(lost when the VPN reconnects). Probe in fonoteka.go:TESTCONTAINERS_HOST_OVERRIDE=127.0.0.1 go test -short -count=1 -timeout 120s -run '^TestPermissionSetScan$' ./plugins/golem15/user/classesfinishes in about 15 s when it works. Full gate:PHASE195_REQUIRE_DOCKER=1 TESTCONTAINERS_HOST_OVERRIDE=127.0.0.1 bash scripts/check-phase19.5.sh --all(summercms.go). - sm-user-plugin (
../fonoteka.go/plugins/golem15/user): vet and the short suite green through the fonoteka.go workspace; push master; annotated tagv0.1.5at35cf166(message: users.email_verified_at records a proved address (mail activation, reset code); an email change clears it; no backfill; routes, payloads and config unchanged); push the tag. - sm-sociallogin-plugin: go.mod require
git.golem15.com/golem15/sm-user-plugin v0.1.5, keep the summercms replace;GOWORK=off GOPRIVATE='git.golem15.com/*' go mod tidy; vet, short suite andGOWORK=off go build ./...green; commitchore: require sm-user-plugin v0.1.5; push master; annotated tagv0.1.2(message: a verified sign-in links only onto an account whose owner proved the address; accounts registered with a password in auto mode, created by an administrator or created before golem15.user v0.1.5 go to the pending screen; requires sm-user-plugin v0.1.5); push the tag. - sm-demo-app, two commits:
plugins/golem15/userto v0.1.5 with go.mod/go.sum,bash scripts/check-phase19.5.sh --demoandscripts/check-pins.shgreen, commitchore: bump sm-user-plugin to v0.1.5; thenplugins/golem15/socialloginto v0.1.2 the same way, commitchore: bump sm-sociallogin-plugin to v0.1.2; gate green after each; push. The push carries the foreignb325460(19.8 roadmap deck) unless that session has pushed it first; include it only with the user's or the 19.8 session's say-so. - sm-bm-app: the same two commits in the same order (only the versioned require line changes, keep the replace lines, add the go.sum change to the commit it belongs to);
bash scripts/check-phase19.5.sh --bmgreen after each; push, including5fd0cc3. - fonoteka.go:
git -C plugins/golem15/user describe --exact-matchnames v0.1.5;bash scripts/check-phase19.5.sh --fonoteka; stage onlyplugins/golem15/user, commitchore: bump sm-user-plugin to v0.1.5, local only (its unpushed range is other work). Other sessions' gitlink changes (feedback, golem) stay untouched. - g15office: comment on the Phase 19.5 milestone task
onunbz3l(released, awaiting re-verification), set it to Testing, and close this todo's task to Live.
When done: record the tags, pushed ranges and final pins in 19.5-05-SUMMARY.md (or a follow-up note), move this todo to todos/done/, and re-run /msd-verify-work 19.5.
Done
Released 2026-10-21 by the 19.8 session (plan 19.8-03, before Task 7) under the user's "release v0.4.0" go-ahead, steps 0-5 as written: sm-user-plugin v0.1.5 at 35cf166 (pushed c7635c5..35cf166), sm-sociallogin-plugin 9fd58db chore: require sm-user-plugin v0.1.5 and v0.1.2 (pushed d7ee28d..9fd58db), sm-demo-app f16ef6c and 1afd7ff plus a snapshot sync a5703f9 (pushed 61a00e9..a5703f9, carrying b325460), sm-bm-app 1e09c23 and cc4b23f (pushed 99af8c2..cc4b23f, carrying 5fd0cc3), fonoteka.go 2be9e1f local only. Tags, ranges and final pins: 19.5-05-SUMMARY.md, "Release (2026-10-21, after the hold)". Step 6 (g15office: comment on onunbz3l, set it to Testing, this task sqnwn1zi to Live) was not done: no g15office tool in that session.