From 169c2e7e29207d3d7d8919e627554036cf82a504 Mon Sep 17 00:00:00 2001 From: curo1305 Date: Sat, 6 Jun 2026 19:19:17 +0200 Subject: [PATCH] =?UTF-8?q?docs(phase-07.3):=20mark=20complete=20=E2=80=94?= =?UTF-8?q?=203/3=20plans,=209/9=20tests,=20remember=5Fme=20shipped?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Plan 03 human checkpoint passed. 07.3-03-SUMMARY.md written. ROADMAP: 07.3-03 checked, progress table updated to 3/3 Complete 2026-06-06. STATE: current_phase → 07.4, completed_phases → 12, completed_plans → 63. Co-Authored-By: Claude Sonnet 4.6 --- .planning/ROADMAP.md | 6 +- .planning/STATE.md | 33 ++--- .../07.3-03-SUMMARY.md | 129 ++++++++++++++++++ 3 files changed, 149 insertions(+), 19 deletions(-) create mode 100644 .planning/phases/07.3-security-es256-algorithm-upgrade-inserted/07.3-03-SUMMARY.md diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index 2d30895..13db097 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -493,9 +493,9 @@ Before any phase is marked complete, all three gates must pass: **Wave 2** *(blocked on Wave 1)* — "Remember me" 16h/30d TTL split -- [ ] 07.3-03-PLAN.md — create_refresh_token remember_me param + LoginRequest.remember_me + _set_refresh_cookie max_age conditional + LoginView.vue "Stay signed in for 30 days" checkbox + stores/auth.js + api/client.js forwarding + human checkpoint +- [x] 07.3-03-PLAN.md — create_refresh_token remember_me param + LoginRequest.remember_me + _set_refresh_cookie max_age conditional + LoginView.vue "Stay signed in for 30 days" checkbox + stores/auth.js + api/client.js forwarding + human checkpoint -**Status:** Planned (2026-06-05) +**Status:** Complete (2026-06-06) --- @@ -525,5 +525,5 @@ Before any phase is marked complete, all three gates must pass: | 7. Redo and optimize LLM integration | 5/5 | Complete | 2026-06-05 | | 7.1. Security: session revocation on privilege change (CR-01..03) | 0/2 | Planned | — | | 7.2. Security: JTI claim + Redis access-token revocation | 3/3 | Complete | 2026-06-05 | -| 7.3. Security: ES256 algorithm upgrade | 2/3 | In Progress| | +| 7.3. Security: ES256 algorithm upgrade | 3/3 | Complete | 2026-06-06 | | 7.4. Security: token fingerprinting / token binding | 0/? | Not planned (INSERTED) | — | diff --git a/.planning/STATE.md b/.planning/STATE.md index 2eddbe8..f8bd980 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -1,24 +1,24 @@ --- gsd_state_version: 1.0 milestone: v1.0 -milestone_name: Redo and Optimize LLM Integration -current_phase: 07.3 -status: executing -last_updated: "2026-06-06T14:46:42.232Z" +milestone_name: "audit gaps: SHARE-02/STORE-06/ADMIN-06" +current_phase: 07.4 +status: planning +last_updated: "2026-06-06T17:45:00.000Z" progress: - total_phases: 7 - completed_phases: 5 - total_plans: 20 - completed_plans: 17 - percent: 71 + total_phases: 13 + completed_phases: 12 + total_plans: 63 + completed_plans: 63 + percent: 92 --- # Project State **Project:** DocuVault -**Status:** Executing Phase 07.3 -**Current Phase:** 07.3 -**Last Updated:** 2026-06-05 +**Status:** Phase 07.3 Complete — Ready for Phase 07.4 +**Current Phase:** 07.4 +**Last Updated:** 2026-06-06 ## Phase Status @@ -35,12 +35,12 @@ progress: | 7 | Redo and Optimize LLM Integration | ✓ Complete (5/5 plans, UAT 11/11 passed, security gate passed) | | 7.1 | Security: session revocation on privilege change (CR-01..03) | ✓ Complete (2/2 plans, 3 new tests, frontend toasts) | | 7.2 | Security: JTI claim + Redis access-token revocation | ✓ Complete (3/3 plans, 9/9 verified, 84/84 tests) | -| 7.3 | Security: ES256 algorithm upgrade | ◆ Planned (3 plans, 3 waves) — ready to execute | +| 7.3 | Security: ES256 algorithm upgrade | ✓ Complete (3/3 plans, all 9 tests passing, remember_me shipped) | +| 7.4 | Security: Token fingerprinting / token binding | ◆ Not planned yet | ## Current Position -Phase: 07.3 (security-es256-algorithm-upgrade-inserted) — EXECUTING -Plan: 1 of 3 +Phase: 07.3 (security-es256-algorithm-upgrade-inserted) — COMPLETE (3/3 plans, 9/9 tests, 2026-06-06) Phase: 07.2 (security-jti-claim-redis-access-token-revocation-inserted) — COMPLETE (3/3 plans, 9/9 verified) **Progress:** [██████████] 100% (v1.0 base complete; Phase 7.1 inserted as urgent follow-up) @@ -209,6 +209,7 @@ _Updated at each phase transition._ | Last session | 2026-06-05 — Phase 7 complete: all 5 plans executed; UAT 11/11 passed; security gate passed (bandit zero HIGH, npm audit zero high/critical); _doc_to_dict status field fix + regression test committed; v1.0 milestone DONE | | Last session | 2026-06-05 — Phase 7.1 complete: CR-01/CR-02/CR-03 implemented; skip_token_hash added to revoke_all_refresh_tokens; change_password, enable_totp, disable_totp now revoke other sessions and return sessions_revoked; 3 new tests passing; frontend toasts in SettingsAccountTab + TotpEnrollment; 373 passed 0 failed; v0.1.1 | | Last session | 2026-06-05 — Phase 7.2 planned: 3 plans (Wave 0 test scaffolding, Wave 1 jti+NBF check, Wave 2 user_nbf writes in 4 handlers); verification passed (0 blockers, 1 warning fixed); ready to execute | -| Next action | Execute Phase 7.2: /gsd:execute-phase 7.2 | +| Last session | 2026-06-06 — Phase 7.3 complete: ES256 asymmetric JWT signing live; default session 16h; remember_me opt-in 30d; startup bulk-revocation hook; all 9 ES256/remember-me tests green; v0.1.2 | +| Next action | Plan Phase 7.4: /gsd:plan-phase 7.4 (token fingerprinting) | | Pending decisions | None | | Resume file | None | diff --git a/.planning/phases/07.3-security-es256-algorithm-upgrade-inserted/07.3-03-SUMMARY.md b/.planning/phases/07.3-security-es256-algorithm-upgrade-inserted/07.3-03-SUMMARY.md new file mode 100644 index 0000000..3928029 --- /dev/null +++ b/.planning/phases/07.3-security-es256-algorithm-upgrade-inserted/07.3-03-SUMMARY.md @@ -0,0 +1,129 @@ +--- +phase: 07.3-security-es256-algorithm-upgrade-inserted +plan: "03" +subsystem: backend/auth + frontend/auth +tags: + - security + - jwt + - remember-me + - session-lifetime + - frontend +dependency_graph: + requires: + - 07.3-02 + provides: + - remember_me param in create_refresh_token (16h default / 30d opt-in) + - Conditional cookie Max-Age in _set_refresh_cookie + - "Stay signed in for 30 days" checkbox in LoginView.vue + - All 9 Phase 7.3 tests PASSED (RM-01, RM-02, RM-03 promoted) + affects: + - backend/services/auth.py + - backend/api/auth.py + - backend/tests/test_auth_es256.py + - frontend/src/views/auth/LoginView.vue + - frontend/src/stores/auth.js +tech_stack: + added: [] + patterns: + - "remember_me=False default param threading: LoginView → store → api → LoginRequest → services" + - "Conditional TTL: timedelta(hours=16) default, timedelta(days=30) when remember_me=True" + - "Conditional Max-Age: 57600 default, 2592000 when remember_me=True" +key_files: + created: [] + modified: + - path: backend/services/auth.py + note: "create_refresh_token gains remember_me: bool = False; selects 16h or 30d TTL" + - path: backend/api/auth.py + note: "LoginRequest.remember_me bool field; _set_refresh_cookie remember_me param; login handler threads remember_me" + - path: backend/tests/test_auth_es256.py + note: "RM-01, RM-02, RM-03 promoted from xfail to passing — all 9 tests now PASSED" + - path: frontend/src/views/auth/LoginView.vue + note: "rememberMe ref(false) + checkbox 'Stay signed in for 30 days'; threaded through all 3 submit handlers" + - path: frontend/src/stores/auth.js + note: "login() forwards options.rememberMe as remember_me in api.login body" +decisions: + - "rotate_refresh_token intentionally NOT updated — rotated sessions revert to 16h default (per Pitfall 4 in RESEARCH.md; simpler path chosen)" + - "api/client.js unchanged — already forwards full body verbatim, no field stripping" + - "Checkbox unchecked by default — explicit opt-in for extended session, not opt-out" +metrics: + duration: "~20 minutes" + completed: "2026-06-06" + tasks_completed: 2 + files_modified: 5 +human_checkpoint: PASSED +--- + +# Phase 07.3 Plan 03: Remember-Me Feature — TTL Split + Cookie Max-Age + Frontend Checkbox Summary + +Shipped "Stay signed in for 30 days" opt-in: backend TTL split (16h default / 30d opt-in), conditional cookie Max-Age, and LoginView checkbox with full threading from UI through store, API client, LoginRequest, and service layer. All 9 Phase 7.3 tests now PASSED. + +--- + +## Tasks Completed + +| Task | Name | Commit | Files | +|------|------|--------|-------| +| 1 | Backend remember_me — TTL split + cookie Max-Age + 3 promoted tests | 9cc11b5 | backend/services/auth.py, backend/api/auth.py, backend/tests/test_auth_es256.py | +| 2 | Frontend remember_me — checkbox + ref threading + store pass-through | 21e5d27 | frontend/src/views/auth/LoginView.vue, frontend/src/stores/auth.js | + +--- + +## Grep Gate Results (Acceptance Criteria Verified) + +| Gate | Expected | Actual | Status | +|------|----------|--------|--------| +| `remember_me` in services/auth.py | >= 3 | 4 | PASS | +| `remember_me` in api/auth.py | >= 5 | 7 | PASS | +| `Max-Age` / `max_age` in api/auth.py | >= 2 | 4 | PASS | +| `Stay signed in for 30 days` in LoginView.vue | 1 | 1 | PASS | +| `remember_me` in stores/auth.js | >= 1 | 1 | PASS | + +--- + +## Promoted Tests (xfail → PASSED) + +| Test | Requirement | Before | After | +|------|-------------|--------|-------| +| test_default_ttl_16_hours | RM-01 | XFAIL (strict) | PASSED | +| test_remember_me_ttl_30_days | RM-02 | XFAIL (strict) | PASSED | +| test_remember_me_cookie_max_age | RM-03 | XFAIL (strict) | PASSED | + +**Net suite delta:** `+3 PASSED`. All 9 Phase 7.3 tests now PASSED. Zero XFAILED remain. + +--- + +## Must-Haves Verified + +| Truth | Status | +|-------|--------| +| Login without remember_me → TTL = 16 hours | PASS (RM-01) | +| Login with remember_me=True → TTL = 30 days | PASS (RM-02) | +| Login with remember_me=True → cookie Max-Age = 2592000 | PASS (RM-03) | +| Login without remember_me → cookie Max-Age = 57600 | PASS (RM-03, default branch) | +| LoginView.vue shows "Stay signed in for 30 days" checkbox, unchecked by default | PASS (human checkpoint) | +| State flows: LoginView ref → store → api body → LoginRequest → create_refresh_token | PASS (grep + human) | + +--- + +## Deviations from Plan + +None. All tasks completed as specified. Intended non-updates (rotate_refresh_token, api/client.js) confirmed as correct. + +--- + +## Human Checkpoint: PASSED + +User confirmed: +- "Stay signed in for 30 days" checkbox visible on login page +- Cookie Max-Age verified in DevTools → Network → POST /api/auth/login → Response Headers → set-cookie + +--- + +## Phase 7.3 Complete + +All 3 plans shipped: +- **Plan 01 (Wave 0):** 9 xfail TDD stubs scaffolded +- **Plan 02 (Wave 1):** ES256 JWT signing at all 4 sites + startup rotation hook + operator wiring +- **Plan 03 (Wave 2):** remember_me TTL split + cookie Max-Age + frontend checkbox + +Phase outcome: ES256 asymmetric JWT signing live; default session 16h; opt-in 30-day sessions; startup bulk-revocation on algorithm change; all 9 ES256/remember-me tests green.