docs(phase-07.3): mark complete — 3/3 plans, 9/9 tests, remember_me shipped
Plan 03 human checkpoint passed. 07.3-03-SUMMARY.md written. ROADMAP: 07.3-03 checked, progress table updated to 3/3 Complete 2026-06-06. STATE: current_phase → 07.4, completed_phases → 12, completed_plans → 63. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
curo1305
co-authored by
Claude Sonnet 4.6
Claude Sonnet 4.6
parent
739d5b3d9a
commit
169c2e7e29
@@ -493,9 +493,9 @@ Before any phase is marked complete, all three gates must pass:
|
||||
|
||||
**Wave 2** *(blocked on Wave 1)* — "Remember me" 16h/30d TTL split
|
||||
|
||||
- [ ] 07.3-03-PLAN.md — create_refresh_token remember_me param + LoginRequest.remember_me + _set_refresh_cookie max_age conditional + LoginView.vue "Stay signed in for 30 days" checkbox + stores/auth.js + api/client.js forwarding + human checkpoint
|
||||
- [x] 07.3-03-PLAN.md — create_refresh_token remember_me param + LoginRequest.remember_me + _set_refresh_cookie max_age conditional + LoginView.vue "Stay signed in for 30 days" checkbox + stores/auth.js + api/client.js forwarding + human checkpoint
|
||||
|
||||
**Status:** Planned (2026-06-05)
|
||||
**Status:** Complete (2026-06-06)
|
||||
|
||||
---
|
||||
|
||||
@@ -525,5 +525,5 @@ Before any phase is marked complete, all three gates must pass:
|
||||
| 7. Redo and optimize LLM integration | 5/5 | Complete | 2026-06-05 |
|
||||
| 7.1. Security: session revocation on privilege change (CR-01..03) | 0/2 | Planned | — |
|
||||
| 7.2. Security: JTI claim + Redis access-token revocation | 3/3 | Complete | 2026-06-05 |
|
||||
| 7.3. Security: ES256 algorithm upgrade | 2/3 | In Progress| |
|
||||
| 7.3. Security: ES256 algorithm upgrade | 3/3 | Complete | 2026-06-06 |
|
||||
| 7.4. Security: token fingerprinting / token binding | 0/? | Not planned (INSERTED) | — |
|
||||
|
||||
+17
-16
@@ -1,24 +1,24 @@
|
||||
---
|
||||
gsd_state_version: 1.0
|
||||
milestone: v1.0
|
||||
milestone_name: Redo and Optimize LLM Integration
|
||||
current_phase: 07.3
|
||||
status: executing
|
||||
last_updated: "2026-06-06T14:46:42.232Z"
|
||||
milestone_name: "audit gaps: SHARE-02/STORE-06/ADMIN-06"
|
||||
current_phase: 07.4
|
||||
status: planning
|
||||
last_updated: "2026-06-06T17:45:00.000Z"
|
||||
progress:
|
||||
total_phases: 7
|
||||
completed_phases: 5
|
||||
total_plans: 20
|
||||
completed_plans: 17
|
||||
percent: 71
|
||||
total_phases: 13
|
||||
completed_phases: 12
|
||||
total_plans: 63
|
||||
completed_plans: 63
|
||||
percent: 92
|
||||
---
|
||||
|
||||
# Project State
|
||||
|
||||
**Project:** DocuVault
|
||||
**Status:** Executing Phase 07.3
|
||||
**Current Phase:** 07.3
|
||||
**Last Updated:** 2026-06-05
|
||||
**Status:** Phase 07.3 Complete — Ready for Phase 07.4
|
||||
**Current Phase:** 07.4
|
||||
**Last Updated:** 2026-06-06
|
||||
|
||||
## Phase Status
|
||||
|
||||
@@ -35,12 +35,12 @@ progress:
|
||||
| 7 | Redo and Optimize LLM Integration | ✓ Complete (5/5 plans, UAT 11/11 passed, security gate passed) |
|
||||
| 7.1 | Security: session revocation on privilege change (CR-01..03) | ✓ Complete (2/2 plans, 3 new tests, frontend toasts) |
|
||||
| 7.2 | Security: JTI claim + Redis access-token revocation | ✓ Complete (3/3 plans, 9/9 verified, 84/84 tests) |
|
||||
| 7.3 | Security: ES256 algorithm upgrade | ◆ Planned (3 plans, 3 waves) — ready to execute |
|
||||
| 7.3 | Security: ES256 algorithm upgrade | ✓ Complete (3/3 plans, all 9 tests passing, remember_me shipped) |
|
||||
| 7.4 | Security: Token fingerprinting / token binding | ◆ Not planned yet |
|
||||
|
||||
## Current Position
|
||||
|
||||
Phase: 07.3 (security-es256-algorithm-upgrade-inserted) — EXECUTING
|
||||
Plan: 1 of 3
|
||||
Phase: 07.3 (security-es256-algorithm-upgrade-inserted) — COMPLETE (3/3 plans, 9/9 tests, 2026-06-06)
|
||||
Phase: 07.2 (security-jti-claim-redis-access-token-revocation-inserted) — COMPLETE (3/3 plans, 9/9 verified)
|
||||
**Progress:** [██████████] 100% (v1.0 base complete; Phase 7.1 inserted as urgent follow-up)
|
||||
|
||||
@@ -209,6 +209,7 @@ _Updated at each phase transition._
|
||||
| Last session | 2026-06-05 — Phase 7 complete: all 5 plans executed; UAT 11/11 passed; security gate passed (bandit zero HIGH, npm audit zero high/critical); _doc_to_dict status field fix + regression test committed; v1.0 milestone DONE |
|
||||
| Last session | 2026-06-05 — Phase 7.1 complete: CR-01/CR-02/CR-03 implemented; skip_token_hash added to revoke_all_refresh_tokens; change_password, enable_totp, disable_totp now revoke other sessions and return sessions_revoked; 3 new tests passing; frontend toasts in SettingsAccountTab + TotpEnrollment; 373 passed 0 failed; v0.1.1 |
|
||||
| Last session | 2026-06-05 — Phase 7.2 planned: 3 plans (Wave 0 test scaffolding, Wave 1 jti+NBF check, Wave 2 user_nbf writes in 4 handlers); verification passed (0 blockers, 1 warning fixed); ready to execute |
|
||||
| Next action | Execute Phase 7.2: /gsd:execute-phase 7.2 |
|
||||
| Last session | 2026-06-06 — Phase 7.3 complete: ES256 asymmetric JWT signing live; default session 16h; remember_me opt-in 30d; startup bulk-revocation hook; all 9 ES256/remember-me tests green; v0.1.2 |
|
||||
| Next action | Plan Phase 7.4: /gsd:plan-phase 7.4 (token fingerprinting) |
|
||||
| Pending decisions | None |
|
||||
| Resume file | None |
|
||||
|
||||
@@ -0,0 +1,129 @@
|
||||
---
|
||||
phase: 07.3-security-es256-algorithm-upgrade-inserted
|
||||
plan: "03"
|
||||
subsystem: backend/auth + frontend/auth
|
||||
tags:
|
||||
- security
|
||||
- jwt
|
||||
- remember-me
|
||||
- session-lifetime
|
||||
- frontend
|
||||
dependency_graph:
|
||||
requires:
|
||||
- 07.3-02
|
||||
provides:
|
||||
- remember_me param in create_refresh_token (16h default / 30d opt-in)
|
||||
- Conditional cookie Max-Age in _set_refresh_cookie
|
||||
- "Stay signed in for 30 days" checkbox in LoginView.vue
|
||||
- All 9 Phase 7.3 tests PASSED (RM-01, RM-02, RM-03 promoted)
|
||||
affects:
|
||||
- backend/services/auth.py
|
||||
- backend/api/auth.py
|
||||
- backend/tests/test_auth_es256.py
|
||||
- frontend/src/views/auth/LoginView.vue
|
||||
- frontend/src/stores/auth.js
|
||||
tech_stack:
|
||||
added: []
|
||||
patterns:
|
||||
- "remember_me=False default param threading: LoginView → store → api → LoginRequest → services"
|
||||
- "Conditional TTL: timedelta(hours=16) default, timedelta(days=30) when remember_me=True"
|
||||
- "Conditional Max-Age: 57600 default, 2592000 when remember_me=True"
|
||||
key_files:
|
||||
created: []
|
||||
modified:
|
||||
- path: backend/services/auth.py
|
||||
note: "create_refresh_token gains remember_me: bool = False; selects 16h or 30d TTL"
|
||||
- path: backend/api/auth.py
|
||||
note: "LoginRequest.remember_me bool field; _set_refresh_cookie remember_me param; login handler threads remember_me"
|
||||
- path: backend/tests/test_auth_es256.py
|
||||
note: "RM-01, RM-02, RM-03 promoted from xfail to passing — all 9 tests now PASSED"
|
||||
- path: frontend/src/views/auth/LoginView.vue
|
||||
note: "rememberMe ref(false) + checkbox 'Stay signed in for 30 days'; threaded through all 3 submit handlers"
|
||||
- path: frontend/src/stores/auth.js
|
||||
note: "login() forwards options.rememberMe as remember_me in api.login body"
|
||||
decisions:
|
||||
- "rotate_refresh_token intentionally NOT updated — rotated sessions revert to 16h default (per Pitfall 4 in RESEARCH.md; simpler path chosen)"
|
||||
- "api/client.js unchanged — already forwards full body verbatim, no field stripping"
|
||||
- "Checkbox unchecked by default — explicit opt-in for extended session, not opt-out"
|
||||
metrics:
|
||||
duration: "~20 minutes"
|
||||
completed: "2026-06-06"
|
||||
tasks_completed: 2
|
||||
files_modified: 5
|
||||
human_checkpoint: PASSED
|
||||
---
|
||||
|
||||
# Phase 07.3 Plan 03: Remember-Me Feature — TTL Split + Cookie Max-Age + Frontend Checkbox Summary
|
||||
|
||||
Shipped "Stay signed in for 30 days" opt-in: backend TTL split (16h default / 30d opt-in), conditional cookie Max-Age, and LoginView checkbox with full threading from UI through store, API client, LoginRequest, and service layer. All 9 Phase 7.3 tests now PASSED.
|
||||
|
||||
---
|
||||
|
||||
## Tasks Completed
|
||||
|
||||
| Task | Name | Commit | Files |
|
||||
|------|------|--------|-------|
|
||||
| 1 | Backend remember_me — TTL split + cookie Max-Age + 3 promoted tests | 9cc11b5 | backend/services/auth.py, backend/api/auth.py, backend/tests/test_auth_es256.py |
|
||||
| 2 | Frontend remember_me — checkbox + ref threading + store pass-through | 21e5d27 | frontend/src/views/auth/LoginView.vue, frontend/src/stores/auth.js |
|
||||
|
||||
---
|
||||
|
||||
## Grep Gate Results (Acceptance Criteria Verified)
|
||||
|
||||
| Gate | Expected | Actual | Status |
|
||||
|------|----------|--------|--------|
|
||||
| `remember_me` in services/auth.py | >= 3 | 4 | PASS |
|
||||
| `remember_me` in api/auth.py | >= 5 | 7 | PASS |
|
||||
| `Max-Age` / `max_age` in api/auth.py | >= 2 | 4 | PASS |
|
||||
| `Stay signed in for 30 days` in LoginView.vue | 1 | 1 | PASS |
|
||||
| `remember_me` in stores/auth.js | >= 1 | 1 | PASS |
|
||||
|
||||
---
|
||||
|
||||
## Promoted Tests (xfail → PASSED)
|
||||
|
||||
| Test | Requirement | Before | After |
|
||||
|------|-------------|--------|-------|
|
||||
| test_default_ttl_16_hours | RM-01 | XFAIL (strict) | PASSED |
|
||||
| test_remember_me_ttl_30_days | RM-02 | XFAIL (strict) | PASSED |
|
||||
| test_remember_me_cookie_max_age | RM-03 | XFAIL (strict) | PASSED |
|
||||
|
||||
**Net suite delta:** `+3 PASSED`. All 9 Phase 7.3 tests now PASSED. Zero XFAILED remain.
|
||||
|
||||
---
|
||||
|
||||
## Must-Haves Verified
|
||||
|
||||
| Truth | Status |
|
||||
|-------|--------|
|
||||
| Login without remember_me → TTL = 16 hours | PASS (RM-01) |
|
||||
| Login with remember_me=True → TTL = 30 days | PASS (RM-02) |
|
||||
| Login with remember_me=True → cookie Max-Age = 2592000 | PASS (RM-03) |
|
||||
| Login without remember_me → cookie Max-Age = 57600 | PASS (RM-03, default branch) |
|
||||
| LoginView.vue shows "Stay signed in for 30 days" checkbox, unchecked by default | PASS (human checkpoint) |
|
||||
| State flows: LoginView ref → store → api body → LoginRequest → create_refresh_token | PASS (grep + human) |
|
||||
|
||||
---
|
||||
|
||||
## Deviations from Plan
|
||||
|
||||
None. All tasks completed as specified. Intended non-updates (rotate_refresh_token, api/client.js) confirmed as correct.
|
||||
|
||||
---
|
||||
|
||||
## Human Checkpoint: PASSED
|
||||
|
||||
User confirmed:
|
||||
- "Stay signed in for 30 days" checkbox visible on login page
|
||||
- Cookie Max-Age verified in DevTools → Network → POST /api/auth/login → Response Headers → set-cookie
|
||||
|
||||
---
|
||||
|
||||
## Phase 7.3 Complete
|
||||
|
||||
All 3 plans shipped:
|
||||
- **Plan 01 (Wave 0):** 9 xfail TDD stubs scaffolded
|
||||
- **Plan 02 (Wave 1):** ES256 JWT signing at all 4 sites + startup rotation hook + operator wiring
|
||||
- **Plan 03 (Wave 2):** remember_me TTL split + cookie Max-Age + frontend checkbox
|
||||
|
||||
Phase outcome: ES256 asymmetric JWT signing live; default session 16h; opt-in 30-day sessions; startup bulk-revocation on algorithm change; all 9 ES256/remember-me tests green.
|
||||
Reference in New Issue
Block a user