From 537bbd83e6c29885b1305c3d27b2a69b3cd82aca Mon Sep 17 00:00:00 2001 From: curo1305 Date: Sat, 6 Jun 2026 22:17:42 +0200 Subject: [PATCH] =?UTF-8?q?docs(phase-07.4):=20mark=20phase=20complete=20?= =?UTF-8?q?=E2=80=94=202/2=20plans,=204=20FGP=20tests=20passing,=20v0.1.3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .planning/ROADMAP.md | 8 +++++--- .planning/STATE.md | 4 ++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index b03c6af..18e6ef6 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -510,11 +510,13 @@ Before any phase is marked complete, all three gates must pass: **Wave 0** — Test scaffolds (no production code) -- [ ] 07.4-01-PLAN.md — Wave 0 xfail stubs: test_auth_fgp.py (4 stubs covering FGP-01..04) +- [x] 07.4-01-PLAN.md — Wave 0 xfail stubs: test_auth_fgp.py (4 stubs covering FGP-01..04) **Wave 1** *(blocked on Wave 0)* — Production implementation + test promotion -- [ ] 07.4-02-PLAN.md — _compute_fgp helper + create_access_token fgp claim + get_current_user fgp validation + login/refresh call site updates + promote all 4 FGP tests +- [x] 07.4-02-PLAN.md — _compute_fgp helper + create_access_token fgp claim + get_current_user fgp validation + login/refresh call site updates + promote all 4 FGP tests + +**Status:** Complete (2026-06-06) --- @@ -534,4 +536,4 @@ Before any phase is marked complete, all three gates must pass: | 7.1. Security: session revocation on privilege change (CR-01..03) | 0/2 | Planned | — | | 7.2. Security: JTI claim + Redis access-token revocation | 3/3 | Complete | 2026-06-05 | | 7.3. Security: ES256 algorithm upgrade | 3/3 | Complete | 2026-06-06 | -| 7.4. Security: token fingerprinting / token binding | 0/2 | Planned | — | +| 7.4. Security: token fingerprinting / token binding | 2/2 | Complete | 2026-06-06 | diff --git a/.planning/STATE.md b/.planning/STATE.md index b8d6de8..02be971 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -36,7 +36,7 @@ progress: | 7.1 | Security: session revocation on privilege change (CR-01..03) | ✓ Complete (2/2 plans, 3 new tests, frontend toasts) | | 7.2 | Security: JTI claim + Redis access-token revocation | ✓ Complete (3/3 plans, 9/9 verified, 84/84 tests) | | 7.3 | Security: ES256 algorithm upgrade | ✓ Complete (3/3 plans, all 9 tests passing, remember_me shipped) | -| 7.4 | Security: Token fingerprinting / token binding | ◈ In Progress (1/2 plans complete) | +| 7.4 | Security: Token fingerprinting / token binding | ✓ Complete (2/2 plans, 4 FGP tests passing, v0.1.3) | ## Current Position @@ -210,6 +210,6 @@ _Updated at each phase transition._ | Last session | 2026-06-05 — Phase 7.1 complete: CR-01/CR-02/CR-03 implemented; skip_token_hash added to revoke_all_refresh_tokens; change_password, enable_totp, disable_totp now revoke other sessions and return sessions_revoked; 3 new tests passing; frontend toasts in SettingsAccountTab + TotpEnrollment; 373 passed 0 failed; v0.1.1 | | Last session | 2026-06-05 — Phase 7.2 planned: 3 plans (Wave 0 test scaffolding, Wave 1 jti+NBF check, Wave 2 user_nbf writes in 4 handlers); verification passed (0 blockers, 1 warning fixed); ready to execute | | Last session | 2026-06-06 — Phase 7.3 complete: ES256 asymmetric JWT signing live; default session 16h; remember_me opt-in 30d; startup bulk-revocation hook; all 9 ES256/remember-me tests green; v0.1.2 | -| Next action | Execute Phase 7.4 Wave 1: Plan 07.4-02 (FGP implementation) | +| Next action | Phase 7.4 complete — security review then ship | | Pending decisions | None | | Resume file | None |