docs(phase-07.3): mark complete — 3/3 plans, 9/9 tests, remember_me shipped

Plan 03 human checkpoint passed. 07.3-03-SUMMARY.md written. ROADMAP: 07.3-03 checked, progress table updated to 3/3 Complete 2026-06-06. STATE: current_phase → 07.4, completed_phases → 12, completed_plans → 63. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-06 19:19:17 +02:00
parent 739d5b3d9a
commit 169c2e7e29
3 changed files with 149 additions and 19 deletions
@@ -0,0 +1,129 @@
+---
+phase: 07.3-security-es256-algorithm-upgrade-inserted
+plan: "03"
+subsystem: backend/auth + frontend/auth
+tags:
+  - security
+  - jwt
+  - remember-me
+  - session-lifetime
+  - frontend
+dependency_graph:
+  requires:
+    - 07.3-02
+  provides:
+    - remember_me param in create_refresh_token (16h default / 30d opt-in)
+    - Conditional cookie Max-Age in _set_refresh_cookie
+    - "Stay signed in for 30 days" checkbox in LoginView.vue
+    - All 9 Phase 7.3 tests PASSED (RM-01, RM-02, RM-03 promoted)
+  affects:
+    - backend/services/auth.py
+    - backend/api/auth.py
+    - backend/tests/test_auth_es256.py
+    - frontend/src/views/auth/LoginView.vue
+    - frontend/src/stores/auth.js
+tech_stack:
+  added: []
+  patterns:
+    - "remember_me=False default param threading: LoginView → store → api → LoginRequest → services"
+    - "Conditional TTL: timedelta(hours=16) default, timedelta(days=30) when remember_me=True"
+    - "Conditional Max-Age: 57600 default, 2592000 when remember_me=True"
+key_files:
+  created: []
+  modified:
+    - path: backend/services/auth.py
+      note: "create_refresh_token gains remember_me: bool = False; selects 16h or 30d TTL"
+    - path: backend/api/auth.py
+      note: "LoginRequest.remember_me bool field; _set_refresh_cookie remember_me param; login handler threads remember_me"
+    - path: backend/tests/test_auth_es256.py
+      note: "RM-01, RM-02, RM-03 promoted from xfail to passing — all 9 tests now PASSED"
+    - path: frontend/src/views/auth/LoginView.vue
+      note: "rememberMe ref(false) + checkbox 'Stay signed in for 30 days'; threaded through all 3 submit handlers"
+    - path: frontend/src/stores/auth.js
+      note: "login() forwards options.rememberMe as remember_me in api.login body"
+decisions:
+  - "rotate_refresh_token intentionally NOT updated — rotated sessions revert to 16h default (per Pitfall 4 in RESEARCH.md; simpler path chosen)"
+  - "api/client.js unchanged — already forwards full body verbatim, no field stripping"
+  - "Checkbox unchecked by default — explicit opt-in for extended session, not opt-out"
+metrics:
+  duration: "~20 minutes"
+  completed: "2026-06-06"
+  tasks_completed: 2
+  files_modified: 5
+human_checkpoint: PASSED
+---
+
+# Phase 07.3 Plan 03: Remember-Me Feature — TTL Split + Cookie Max-Age + Frontend Checkbox Summary
+
+Shipped "Stay signed in for 30 days" opt-in: backend TTL split (16h default / 30d opt-in), conditional cookie Max-Age, and LoginView checkbox with full threading from UI through store, API client, LoginRequest, and service layer. All 9 Phase 7.3 tests now PASSED.
+
+---
+
+## Tasks Completed
+
+| Task | Name | Commit | Files |
+|------|------|--------|-------|
+| 1 | Backend remember_me — TTL split + cookie Max-Age + 3 promoted tests | 9cc11b5 | backend/services/auth.py, backend/api/auth.py, backend/tests/test_auth_es256.py |
+| 2 | Frontend remember_me — checkbox + ref threading + store pass-through | 21e5d27 | frontend/src/views/auth/LoginView.vue, frontend/src/stores/auth.js |
+
+---
+
+## Grep Gate Results (Acceptance Criteria Verified)
+
+| Gate | Expected | Actual | Status |
+|------|----------|--------|--------|
+| `remember_me` in services/auth.py | >= 3 | 4 | PASS |
+| `remember_me` in api/auth.py | >= 5 | 7 | PASS |
+| `Max-Age` / `max_age` in api/auth.py | >= 2 | 4 | PASS |
+| `Stay signed in for 30 days` in LoginView.vue | 1 | 1 | PASS |
+| `remember_me` in stores/auth.js | >= 1 | 1 | PASS |
+
+---
+
+## Promoted Tests (xfail → PASSED)
+
+| Test | Requirement | Before | After |
+|------|-------------|--------|-------|
+| test_default_ttl_16_hours | RM-01 | XFAIL (strict) | PASSED |
+| test_remember_me_ttl_30_days | RM-02 | XFAIL (strict) | PASSED |
+| test_remember_me_cookie_max_age | RM-03 | XFAIL (strict) | PASSED |
+
+**Net suite delta:** `+3 PASSED`. All 9 Phase 7.3 tests now PASSED. Zero XFAILED remain.
+
+---
+
+## Must-Haves Verified
+
+| Truth | Status |
+|-------|--------|
+| Login without remember_me → TTL = 16 hours | PASS (RM-01) |
+| Login with remember_me=True → TTL = 30 days | PASS (RM-02) |
+| Login with remember_me=True → cookie Max-Age = 2592000 | PASS (RM-03) |
+| Login without remember_me → cookie Max-Age = 57600 | PASS (RM-03, default branch) |
+| LoginView.vue shows "Stay signed in for 30 days" checkbox, unchecked by default | PASS (human checkpoint) |
+| State flows: LoginView ref → store → api body → LoginRequest → create_refresh_token | PASS (grep + human) |
+
+---
+
+## Deviations from Plan
+
+None. All tasks completed as specified. Intended non-updates (rotate_refresh_token, api/client.js) confirmed as correct.
+
+---
+
+## Human Checkpoint: PASSED
+
+User confirmed:
+- "Stay signed in for 30 days" checkbox visible on login page
+- Cookie Max-Age verified in DevTools → Network → POST /api/auth/login → Response Headers → set-cookie
+
+---
+
+## Phase 7.3 Complete
+
+All 3 plans shipped:
+- **Plan 01 (Wave 0):** 9 xfail TDD stubs scaffolded
+- **Plan 02 (Wave 1):** ES256 JWT signing at all 4 sites + startup rotation hook + operator wiring
+- **Plan 03 (Wave 2):** remember_me TTL split + cookie Max-Age + frontend checkbox
+
+Phase outcome: ES256 asymmetric JWT signing live; default session 16h; opt-in 30-day sessions; startup bulk-revocation on algorithm change; all 9 ES256/remember-me tests green.