diff --git a/.planning/phases/07.2-security-jti-claim-redis-access-token-revocation-inserted/07.2-VALIDATION.md b/.planning/phases/07.2-security-jti-claim-redis-access-token-revocation-inserted/07.2-VALIDATION.md index 1b5a442..3aa7dd2 100644 --- a/.planning/phases/07.2-security-jti-claim-redis-access-token-revocation-inserted/07.2-VALIDATION.md +++ b/.planning/phases/07.2-security-jti-claim-redis-access-token-revocation-inserted/07.2-VALIDATION.md @@ -1,10 +1,11 @@ --- phase: 7.2 slug: security-jti-claim-redis-access-token-revocation-inserted -status: draft -nyquist_compliant: false -wave_0_complete: false +status: complete +nyquist_compliant: true +wave_0_complete: true created: 2026-06-05 +audited: 2026-06-06 --- # Phase 7.2 — Validation Strategy @@ -36,33 +37,24 @@ created: 2026-06-05 ## Per-Task Verification Map -| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status | -|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------| -| jti-claim | 01 | 0 | SEC (JTI) | — | Every access token contains a `jti` UUID key | unit | `pytest tests/test_task2_auth_service.py -k jti -v` | ❌ W0 | ⬜ pending | -| test-fakeredis | 01 | 0 | SEC (infra) | — | `test_auth_deps.py` test app has `app.state.redis` set | unit | `pytest tests/test_auth_deps.py -v` | ❌ W0 | ⬜ pending | -| nbf-write-change-password | 02 | 1 | SEC (NBF-write) | T-7.2-01 | `change_password` writes `user_nbf:{user_id}` to Redis | integration | `pytest tests/test_auth_api.py -k nbf -v` | ❌ W0 | ⬜ pending | -| nbf-write-enable-totp | 02 | 1 | SEC (NBF-write) | T-7.2-01 | `enable_totp` writes `user_nbf:{user_id}` to Redis | integration | `pytest tests/test_auth_api.py -k nbf -v` | ❌ W0 | ⬜ pending | -| nbf-write-disable-totp | 02 | 1 | SEC (NBF-write) | T-7.2-01 | `disable_totp` writes `user_nbf:{user_id}` to Redis | integration | `pytest tests/test_auth_api.py -k nbf -v` | ❌ W0 | ⬜ pending | -| nbf-write-deactivation | 03 | 1 | SEC (NBF-write) | T-7.2-01 | admin deactivation writes `user_nbf:{user_id}` to Redis | integration | `pytest tests/test_admin_api.py -k nbf -v` | ❌ W0 | ⬜ pending | -| nbf-check-reject | 04 | 1 | SEC (NBF-check) | T-7.2-02 | Token with `iat < user_nbf` returns HTTP 401 | integration | `pytest tests/test_auth_deps.py -k nbf -v` | ❌ W0 | ⬜ pending | -| nbf-check-allow | 04 | 1 | SEC (NBF-check) | T-7.2-03 | Token with `iat > user_nbf` is accepted | integration | `pytest tests/test_auth_deps.py -k nbf_after -v` | ❌ W0 | ⬜ pending | -| nbf-fail-open | 04 | 1 | SEC (fail-open) | T-7.2-04 | Redis error in NBF check does not block request | unit | `pytest tests/test_auth_deps.py -k failopen -v` | ❌ W0 | ⬜ pending | +| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Test Function | File Exists | Status | +|---------|------|------|-------------|------------|-----------------|-----------|---------------|-------------|--------| +| jti-claim | 01 | 0 | SEC (JTI) | D-01 | Every access token contains a `jti` UUID claim | unit | `test_create_access_token_includes_jti_claim`, `test_create_access_token_jti_is_unique_per_call` | ✅ `tests/test_task2_auth_service.py` | ✅ green | +| test-fakeredis | 01 | 0 | SEC (infra) | — | `test_auth_deps.py` test app has `app.state.redis = FakeRedis()` set | unit | FakeRedis mounted in `make_test_app()` fixture | ✅ `tests/test_auth_deps.py` | ✅ green | +| nbf-write-change-password | 03 | 2 | SEC (NBF-write) | T-7.2-01 | `change_password` writes `user_nbf:{user_id}` to Redis | integration | `test_change_password_writes_user_nbf_to_redis` | ✅ `tests/test_auth_api.py` | ✅ green | +| nbf-write-enable-totp | 03 | 2 | SEC (NBF-write) | T-7.2-01 | `enable_totp` writes `user_nbf:{user_id}` to Redis | integration | `test_enable_totp_writes_user_nbf_to_redis` | ✅ `tests/test_auth_api.py` | ✅ green | +| nbf-write-disable-totp | 03 | 2 | SEC (NBF-write) | T-7.2-01 | `disable_totp` writes `user_nbf:{user_id}` to Redis | integration | `test_disable_totp_writes_user_nbf_to_redis` | ✅ `tests/test_auth_api.py` | ✅ green | +| nbf-write-password-reset-confirm | 03 | 2 | SEC (NBF-write) | CR-02 | `password_reset_confirm` writes `user_nbf:{user_id}` to Redis | integration | `test_password_reset_confirm_writes_user_nbf_to_redis` | ✅ `tests/test_auth_api.py` | ✅ green | +| nbf-write-deactivation | 03 | 2 | SEC (NBF-write) | T-7.2-01, D-05 | admin deactivation writes `user_nbf:{user_id}` to Redis | integration | `test_deactivate_user_writes_user_nbf_to_redis` | ✅ `tests/test_admin_api.py` | ✅ green | +| activate-no-nbf | 03 | 2 | SEC (anti-pattern) | D-05 | admin activation does NOT write `user_nbf` | integration | `test_activate_user_does_not_write_user_nbf` | ✅ `tests/test_admin_api.py` | ✅ green | +| nbf-check-reject | 02 | 1 | SEC (NBF-check) | T-7.2-02 | Token with `iat < user_nbf` returns HTTP 401 "Session invalidated" | integration | `test_get_current_user_rejects_token_when_iat_before_user_nbf` | ✅ `tests/test_auth_deps.py` | ✅ green | +| nbf-check-allow | 02 | 1 | SEC (NBF-check) | T-7.2-03 | Token with `iat > user_nbf` is accepted (HTTP 200) | integration | `test_get_current_user_allows_token_when_iat_after_user_nbf` | ✅ `tests/test_auth_deps.py` | ✅ green | +| nbf-fail-open | 02 | 1 | SEC (fail-open) | T-7.2-04, D-04 | Redis error in NBF check does not block request (HTTP 200) | unit | `test_get_current_user_failopen_on_redis_error` | ✅ `tests/test_auth_deps.py` | ✅ green | *Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky* --- -## Wave 0 Requirements - -- [ ] `backend/tests/test_task2_auth_service.py` — add JTI presence test for `create_access_token` -- [ ] `backend/tests/test_auth_deps.py` — add `app.state.redis = FakeRedis()` to `make_test_app()` or auth_client fixture; add NBF-check tests (iat < nbf → 401, iat > nbf → pass, Redis error → pass) -- [ ] `backend/tests/test_auth_api.py` — add NBF-write stub tests for `change_password`, `enable_totp`, `disable_totp` -- [ ] `backend/tests/test_admin_api.py` — add NBF-write stub test for deactivation handler - -*Existing 34+ auth tests in `test_auth_deps.py` and `test_auth_api.py` must remain green with zero regressions.* - ---- - ## Manual-Only Verifications | Behavior | Requirement | Why Manual | Test Instructions | @@ -82,13 +74,30 @@ created: 2026-06-05 --- +## Validation Audit 2026-06-06 + +| Metric | Count | +|--------|-------| +| Tasks in original map | 9 | +| Extra tasks added (CR-02 gap + anti-pattern guard) | 2 | +| Total tasks audited | 11 | +| Gaps found | 0 | +| Resolved | 0 | +| Escalated to manual-only | 0 | +| Tests passing (full suite) | 84/84 | +| xfail stubs remaining | 0 | + +All Wave 0 xfail stubs were promoted to passing assertions during Phase 7.2 execution. The CR-02 gap (`password_reset_confirm` missing `user_nbf` write) was closed in the phase and has full test coverage. + +--- + ## Validation Sign-Off -- [ ] All tasks have `` verify or Wave 0 dependencies -- [ ] Sampling continuity: no 3 consecutive tasks without automated verify -- [ ] Wave 0 covers all MISSING references -- [ ] No watch-mode flags -- [ ] Feedback latency < 30s -- [ ] `nyquist_compliant: true` set in frontmatter +- [x] All tasks have automated verify commands +- [x] Sampling continuity: no 3 consecutive tasks without automated verify +- [x] Wave 0 covers all MISSING references (stubs promoted to green) +- [x] No watch-mode flags +- [x] Feedback latency < 30s +- [x] `nyquist_compliant: true` set in frontmatter -**Approval:** pending +**Approval:** 2026-06-06 — 84/84 tests passing, 0 gaps, nyquist-compliant