From 8601a021894aac1dd1d77606427c0b7c13885646 Mon Sep 17 00:00:00 2001 From: curo1305 Date: Mon, 1 Jun 2026 14:37:23 +0200 Subject: [PATCH] =?UTF-8?q?docs(02):=20update=20verification=20report=20af?= =?UTF-8?q?ter=20plan=2006=20gap=20closure=20=E2=80=94=202=20security=20bl?= =?UTF-8?q?ockers=20flagged?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../02-VERIFICATION.md | 308 ++++++++++-------- 1 file changed, 177 insertions(+), 131 deletions(-) diff --git a/.planning/phases/02-users-authentication/02-VERIFICATION.md b/.planning/phases/02-users-authentication/02-VERIFICATION.md index 370bd01..e321bff 100644 --- a/.planning/phases/02-users-authentication/02-VERIFICATION.md +++ b/.planning/phases/02-users-authentication/02-VERIFICATION.md @@ -1,76 +1,86 @@ --- phase: 02-users-authentication -verified: 2026-05-22T18:18:52Z -status: gaps_found -score: 4/5 +verified: 2026-06-01T14:35:00Z +status: human_needed +score: 6/6 overrides_applied: 0 -re_verification: false -gaps: +re_verification: + previous_status: gaps_found + previous_score: 4/5 + gaps_closed: + - "Admin can create a new user via POST /api/admin/users without HTTP 500 (session.flush() confirmed, regression test passes)" + - "Auth/login pages show AuthLayout only — App.vue now layout-aware via route.meta.layout conditional" + - "After logout the sidebar is gone — same App.vue v-if fix covers the logged-out state" + - "Non-admin user navigating to /admin is redirected to / — requiresAdmin guard in beforeEach wired" + - "TOTP enrollment shows scannable QR image — qrcode library installed, img tag renders QR from QRCode.toDataURL" + - "TOTP enrollment accessible from Account tab in /settings — SettingsAccountTab.vue created and wired" + gaps_remaining: + - "SC5 (admin JWT returns 403 on document content) — deferred to Phase 3 per D-07 CONTEXT.md decision" + open_findings: + - "CR-01: change_password does not revoke active sessions (CLAUDE.md line 153 — security invariant)" + - "CR-02: disable_totp does not revoke active sessions (CLAUDE.md line 153 — security invariant)" + - "CR-03: ConfirmBlock.vue has no named slot — #confirm-button in SettingsAccountTab is dead (spinner/guard never activates)" + - "WR-01: decodeURIComponent on query param in SettingsView.vue has no error handling — URIError on malformed %encoding" + - "WR-02: TOTP verify code button re-enables during 800ms success flash — double-submission possible" + - "WR-03: Password error routing uses fragile string-matching on raw API messages" + - "WR-04: topicsStore.fetchTopics() fires unconditionally on every page load including auth pages" + regressions: [] +deferred: - truth: "Attempting to access document content via an admin JWT returns 403" - status: partial - reason: "The documents API (backend/api/documents.py) has no authentication enforcement at all — no get_current_user dependency, no JWT validation. Any request (with or without a JWT) accesses documents. An admin JWT does not receive a 403; it is simply ignored. Admin.py has no document-content endpoints (SEC-07's admin-response clause is met), but the documents API does not reject admin-role tokens or any tokens." - artifacts: - - path: "backend/api/documents.py" - issue: "No auth dependency on any endpoint. get_current_user is not imported or used. This is the pre-Phase-3 single-user API state — per D-03 note in STATE.md, auth enforcement on documents is deferred to Phase 3." - missing: - - "Either: add get_current_user + role check to documents.py endpoints NOW to make admin-JWT return 403, OR explicitly scope SC5's 'admin JWT returns 403' clause as a Phase 3 deliverable in ROADMAP.md." + addressed_in: "Phase 3" + evidence: "Phase 3 goal: Document Migration and Multi-User Isolation. CONTEXT.md D-07: existing /api/documents stays public in Phase 2; gains get_current_user guards in Phase 3. REQUIREMENTS.md traceability: SEC-04 mapped to Phase 3." human_verification: - test: "TOTP enrollment end-to-end" - expected: "User scans otpauth:// link in authenticator app, enters 6-digit code, sees 10 backup codes, checks acknowledgment checkbox, enables 2FA, and thereafter login requires TOTP code" - why_human: "Multi-step UI flow with authenticator app interaction cannot be verified by grep or build" + expected: "User navigates to /settings, clicks Account tab, sees TotpEnrollment component. In setup step: QR image renders (not a text link). User scans QR with authenticator app. In verify step: user enters 6-digit code. In backup-codes step: 10 codes displayed in 2-column grid with Copy All button and acknowledgment checkbox gating Enable 2FA. After enabling: account shows 2FA active; next login requires TOTP code." + why_human: "Multi-step flow requires authenticator app; QR image rendering requires visual confirmation; backup-code acknowledgment gate requires UI interaction" - test: "Password reset email delivery" - expected: "User receives reset email at their address, link expires after 1 hour, following the link and setting a new password returns 200 with 'Please sign in' (no auto-login), user must pass TOTP gate on next login" - why_human: "Requires SMTP/Celery infrastructure running and actual email receipt" - - test: "Sign out all devices from account settings" - expected: "Clicking 'Sign out all devices' in AccountView invalidates all active sessions; other browser tabs/devices lose access on next request" - why_human: "Multi-session behavior requires multiple live browser sessions" - - test: "Admin panel tab navigation" - expected: "Admin user sees shield icon 'Admin' link in sidebar, can navigate Users / Quotas / AI Config tabs, non-admin user does not see the admin link" - why_human: "UI rendering and role-conditional visibility require browser" + expected: "User triggers /password-reset for a real email account. Email arrives with correct signed link. Link expires after 1 hour. Following the link and submitting a new strong password returns success message with no auto-login. User must go to /login and pass TOTP gate if 2FA was enabled." + why_human: "Requires SMTP/Celery infrastructure running and actual email receipt; anti-enumeration 202 response cannot confirm dispatch" + - test: "Sign out all devices" + expected: "User clicks Sign out all devices in /settings Account tab. ConfirmBlock appears. On confirm: all sessions revoked, current browser redirected to /login. A second browser tab's next authenticated request fails with 401." + why_human: "Multi-session testing requires two live sessions; refresh token family invalidation requires browser-level verification" + - test: "Admin panel role visibility and CRUD" + expected: "Regular user does not see Admin link in sidebar and cannot navigate to /admin (redirected to /). Admin user sees Admin link with shield icon; can navigate Users/Quotas/AI Config tabs; can create a test user (no HTTP 500); can deactivate a user with inline confirmation showing correct email." + why_human: "Visual rendering, role-conditional DOM, and inline confirmation UX require browser interaction" + - test: "CR-01 / CR-02: Session revocation on password change and TOTP disable" + expected: "After successfully changing password in Account tab: current session is invalidated and user is redirected to /login (or receives a clear sign-out prompt). Any other active refresh tokens are revoked. Same behavior after disabling TOTP. A previously-valid refresh cookie must fail with 401 after the change." + why_human: "Requires confirming backend revocation behavior with live sessions; current code does NOT revoke sessions (CR-01/CR-02 are open code-review blockers — this test is expected to FAIL until the backend fix is applied)" --- -# Phase 2: Users & Authentication — Verification Report +# Phase 2: Users & Authentication — Verification Report (Re-Verification after Plan 06 Gap Closure) **Phase Goal:** Users can register, log in (with optional TOTP 2FA), reset their password, and sign out all active sessions; admins can manage user accounts and assign AI providers — all enforced by a complete FastAPI dependency chain. -**Verified:** 2026-05-22T18:18:52Z -**Status:** GAPS FOUND -**Re-verification:** No — initial verification +**Verified:** 2026-06-01T14:35:00Z +**Status:** HUMAN NEEDED (all automated checks pass; 5 items require human testing; 2 security invariants from CLAUDE.md require developer resolution) +**Re-verification:** Yes — after Plan 06 gap closure (5 UAT gaps closed) --- ## Goal Achievement -### Observable Truths (Success Criteria) +### Observable Truths (Success Criteria from Plan 06 must_haves) | # | Truth | Status | Evidence | |---|-------|--------|----------| -| SC1 | New user can register with strength-validated password; HIBP-listed password rejected | VERIFIED | `check_hibp()` in services/auth.py uses k-anonymity SHA-1 prefix (5 chars); `_validate_password_strength()` enforces 12+ chars, upper, lower, digit, special; 4 tests covering register success, duplicate email, weak password, HIBP breach all pass | -| SC2 | User can enroll TOTP authenticator, receive 10 backup codes with acknowledgment gate, TOTP required on every subsequent login, backup code invalidated on first use | VERIFIED | `provision_totp()`, `generate_backup_codes(10)`, `store_backup_codes()` in services/auth.py; `BackupCodesDisplay.vue` has acknowledgment checkbox gating "Enable 2FA" button; `verify_backup_code()` iterates all codes (constant-time) and sets `used_at=now()` on match; Redis replay prevention on `totp_used:{user_id}:{code}` TTL=90s | -| SC3 | User can reset password via email link (1-hour token), no auto-login after reset, returns to TOTP gate | VERIFIED | `create_password_reset_token()` / `decode_password_reset_token()` uses `typ="password-reset"` claim; `/password-reset/confirm` explicitly does NOT return access_token (comment: "AUTH-05 — user must pass TOTP gate on next login"); anti-enumeration: `/password-reset` always returns 202; test `test_password_reset_confirm_valid_no_autologin` passes | -| SC4 | User can trigger "sign out all devices"; other sessions immediately invalidated; reuse of rotated refresh token revokes entire family | VERIFIED | `revoke_all_refresh_tokens()` marks all user's tokens revoked; `rotate_refresh_token()` checks `row.revoked=True` → calls `revoke_all_refresh_tokens()` + `send_security_alert_email.delay()` + raises `ValueError("token_family_revoked")`; `logout_all` endpoint (lines 370-379 api/auth.py) calls `revoke_all_refresh_tokens()` | -| SC5 | Admin can create/deactivate/reset user accounts and assign AI provider; **attempting to access document content via admin JWT returns 403** | PARTIAL — BLOCKER | Admin CRUD endpoints verified (7 endpoints, `get_current_admin` on all, `_user_to_dict()` whitelist excludes `password_hash`/`credentials_enc`). BUT: `backend/api/documents.py` has NO auth enforcement at all — any request (with or without JWT) accesses documents. An admin JWT is not rejected; it is simply ignored. The 403 clause of SC5 is not met. | +| T1 | Admin can create a new user via POST /api/admin/users without HTTP 500 | VERIFIED | `await session.flush()` at admin.py:247 (before `write_audit_log()`); `test_create_user_writes_audit_log` passes (1 passed, 2.23s) | +| T2 | Login, register, and password-reset pages show AuthLayout only — no sidebar, no user identity footer | VERIFIED | App.vue line 2: ``; all 4 auth routes have `meta: { public: true, layout: 'auth' }` in router/index.js (4 grep matches at lines 22, 27, 32, 37) | +| T3 | After logout the sidebar is gone — the user lands on the login page with AuthLayout | VERIFIED | Same App.vue v-if fix covers logged-out state; /login has `layout: 'auth'` meta so AuthLayout renders, not app shell | +| T4 | Non-admin user navigating to /admin is redirected to / | VERIFIED | router/index.js:91-93: `if (to.meta.requiresAdmin && authStore.user?.role !== 'admin') return { path: '/' }`; /admin has `meta: { requiresAdmin: true }` at line 42 | +| T5 | TOTP enrollment step 1 shows a scannable QR image, not a text link | VERIFIED | TotpEnrollment.vue:111 `import QRCode from 'qrcode'`; line 120 `const qrDataUrl = ref('')`; line 136 `qrDataUrl.value = await QRCode.toDataURL(qrUri.value, ...)`; line 34 `TOTP QR code` | +| T6 | TOTP enrollment option is accessible from a tab within /settings (Account tab) | VERIFIED | SettingsView.vue:92 imports SettingsAccountTab; line 100 `{ id: 'account', label: 'Account' }` in tabs array; line 52 ``; SettingsAccountTab.vue contains TotpEnrollment component at line 63 | -**Score: 4/5 truths verified** +**Score: 6/6 truths verified** --- -### Gap Detail: SC5 — Admin JWT Document Access +### Deferred Items (from Initial Verification — SC5) -**Status:** PARTIAL / BLOCKER +Items not yet met but explicitly addressed in later milestone phases. -The documents API (`backend/api/documents.py`) has no `get_current_user` or `get_current_admin` dependency on any endpoint. No JWT is validated. This is the pre-Phase 3 single-user API state, explicitly noted in STATE.md (D-03 decision): - -> "documents.user_id nullable Phase 1 — D-03 — no auth in Phase 1; Phase 2 migration adds NOT NULL after auth lands" - -However, SEC-07 (Phase 2 requirement) states: "Admin role verified on every admin endpoint request; admin cannot access document content, extracted text, or cloud credentials in any response." The admin API endpoints correctly meet the first clause (all protected by `get_current_admin`) and the second clause (no document content in admin responses via `_user_to_dict()` whitelist). But the documents API itself is fully open — an admin JWT does not return 403 when accessing document content there. - -Phase 3's scope (Document Migration & Multi-User Isolation) will add `get_current_user` to document endpoints and enforce `resource.user_id == current_user.id`. Once Phase 3 lands, all users (including admins) will only see their own documents. However, the ROADMAP SC5 specifically says "admin JWT returns 403 for document content" as a Phase 2 deliverable. - -**Options for resolution:** -1. Add a narrow role-check guard in documents.py now (e.g., admin role in `get_current_user` → 403) — minimal Phase 2 work -2. Update ROADMAP.md to scope the "admin JWT → 403 on documents" clause to Phase 3 alongside full auth enforcement -3. Accept as-is noting Phase 3 fully resolves it (with ROADMAP update) +| # | Item | Addressed In | Evidence | +|---|------|-------------|---------| +| 1 | Attempting to access document content via an admin JWT returns 403 | Phase 3 | Phase 3 goal: "Document Migration and Multi-User Isolation." CONTEXT.md D-07: `/api/documents`, `/api/topics`, `/api/settings` stay public in Phase 2; gain `get_current_user` guards in Phase 3. REQUIREMENTS.md: SEC-04 mapped to Phase 3. The admin panel API (`/api/admin/*`) correctly enforces `get_current_admin` on all endpoints. | --- @@ -78,20 +88,14 @@ Phase 3's scope (Document Migration & Multi-User Isolation) will add `get_curren | Artifact | Expected | Status | Details | |----------|----------|--------|---------| -| `backend/services/auth.py` | Full auth service layer (Argon2, JWT, refresh, TOTP, backup codes, HIBP) | VERIFIED | 428 lines; 16 exported functions; no FastAPI coupling (single mention of "HTTPException" is in module docstring comment, not import or raise) | -| `backend/deps/auth.py` | `get_current_user` + `get_current_admin` FastAPI dependencies | VERIFIED | Both functions present; `get_current_admin` raises 403 on non-admin role | -| `backend/api/auth.py` | Register, login, refresh, logout, logout-all, me, change-password, TOTP setup/enable/disable, password-reset, password-reset/confirm | VERIFIED | 615 lines; 13 async handlers; all endpoints present | -| `backend/api/admin.py` | 7 admin endpoints with `get_current_admin` on every handler | VERIFIED | 380 lines; 7 handlers; `get_current_admin` count = 10; `_user_to_dict()` whitelist | -| `backend/db/models.py` (BackupCode) | `class BackupCode` with `used_at` nullable field | VERIFIED | `grep -c "class BackupCode"` = 1; `used_at: Mapped[Optional[datetime]]` present | -| `backend/db/models.py` (password_must_change) | `password_must_change` BOOLEAN column on User | VERIFIED | `grep -c "password_must_change"` = 1 | -| `backend/migrations/versions/0002_add_backup_codes_and_password_must_change.py` | Alembic migration for backup_codes table and password_must_change column | VERIFIED | File exists: `ls migrations/versions/ \| grep backup_codes` returns file | -| `frontend/src/stores/auth.js` | Pinia store with `accessToken` in `ref()` memory only — no localStorage | VERIFIED | `grep -c "localStorage"` = 0; `accessToken = ref(null)` confirmed | -| `frontend/src/router/index.js` | `beforeEach` guard with redirect preservation | VERIFIED | `grep -c "beforeEach"` = 1 | -| `frontend/src/views/auth/LoginView.vue` | Three-step login with TOTP + backup code paths | VERIFIED | File exists; contains backup code toggle | -| `frontend/src/views/auth/RegisterView.vue` | Registration with PasswordStrengthBar | VERIFIED | File exists; contains PasswordStrengthBar import | -| `frontend/src/views/AdminView.vue` | Tabbed admin panel | VERIFIED | File exists; imports all three tab components | -| `frontend/src/components/admin/AdminUsersTab.vue` | User CRUD with create/deactivate/reset | VERIFIED | File exists; wired to real API endpoints | -| `frontend/src/components/layout/AppSidebar.vue` | Role-gated admin link | VERIFIED | `grep -c "role.*admin"` = 1; shield-icon admin link with `v-if` | +| `backend/api/admin.py` | `await session.flush()` before `write_audit_log()` in create_user | VERIFIED | Line 247: `await session.flush() # persist User + Quota before audit_log FK references them` | +| `backend/tests/test_admin_api.py` | `test_create_user_writes_audit_log` regression test | VERIFIED | Line 145; test passes (confirmed by pytest run) | +| `frontend/src/router/index.js` | `meta: { layout: 'auth' }` on 4 auth routes; `meta: { requiresAdmin: true }` on /admin; beforeEach role check | VERIFIED | 4 routes at lines 22, 27, 32, 37; /admin at line 42; beforeEach check at lines 91-93 | +| `frontend/src/App.vue` | Layout-aware root — AuthLayout for auth routes, app shell for all others | VERIFIED | Line 2: ``; line 3: `
` with AppSidebar + router-view | +| `frontend/src/views/SettingsView.vue` | Account tab rendering SettingsAccountTab | VERIFIED | Line 52: ``; line 92: import; line 100: tab array entry | +| `frontend/src/components/settings/SettingsAccountTab.vue` | Full AccountView content (2FA, change password, sign-out-all) | VERIFIED | 253 lines; 4 sections (Account info, 2FA/TotpEnrollment, Change password, Sessions); all script setup logic ported | +| `frontend/src/components/auth/TotpEnrollment.vue` | QR image via qrcode library (no ``) | VERIFIED | QRCode imported line 111; qrDataUrl ref line 120; toDataURL call line 136; img tag line 34 | +| `frontend/package.json` | `"qrcode"` in dependencies | VERIFIED | `"qrcode": "^1.5.4"` in dependencies section (not devDependencies) | --- @@ -99,14 +103,11 @@ Phase 3's scope (Document Migration & Multi-User Isolation) will add `get_curren | From | To | Via | Status | Details | |------|----|-----|--------|---------| -| `api/auth.py` | `services/auth.py` | All auth functions called in handlers | WIRED | `verify_totp()`, `rotate_refresh_token()`, `revoke_all_refresh_tokens()`, `check_hibp()`, etc. | -| `api/auth.py` | `app.state.redis` | `request.app.state.redis` in login + TOTP enable handlers | WIRED | Lines 212, 489 pass redis_client to `verify_totp()` | -| `api/admin.py` | `deps/auth.py:get_current_admin` | `Depends(get_current_admin)` on every handler | WIRED | Count = 10; all 7 handlers + deps chain | -| `api/admin.py` | `main.py` | `app.include_router(admin_router)` | WIRED | Confirmed in main.py | -| `frontend/src/stores/auth.js` | `frontend/src/api/client.js` | Bearer token injection in `request()` | WIRED | `accessToken` used for `Authorization: Bearer` header | -| `frontend/src/router/index.js` | `frontend/src/stores/auth.js` | `beforeEach` guard checks `authStore.accessToken` | WIRED | Guard redirects unauthenticated users to `/login?redirect=` | -| `frontend/src/components/auth/BackupCodesDisplay.vue` | `acknowledged` ref | Gates "Enable 2FA" button | WIRED | `@click="acknowledged && $emit('acknowledged')"` | -| `api/auth.py` | `tasks/email_tasks.py` | Deferred import `from tasks.email_tasks import send_reset_email` inside handler | WIRED | Pattern confirmed; consistent with document_tasks pattern | +| `frontend/src/App.vue` | `frontend/src/layouts/AuthLayout.vue` | `v-if route.meta.layout === 'auth'` | WIRED | Line 2 template; line 15 import | +| `frontend/src/router/index.js` | `frontend/src/stores/auth.js` | `beforeEach` reads `authStore.user?.role` | WIRED | Line 91: `authStore.user?.role !== 'admin'` | +| `frontend/src/components/auth/TotpEnrollment.vue` | `qrcode` npm package | `import QRCode from 'qrcode'`; `QRCode.toDataURL(qrUri.value)` | WIRED | Lines 111, 136 | +| `frontend/src/views/SettingsView.vue` | `frontend/src/components/settings/SettingsAccountTab.vue` | import + v-if render | WIRED | Lines 52, 92, 100 | +| `frontend/src/router/index.js` | `/settings` redirect for `/account` | `{ path: '/account', redirect: '/settings' }` | WIRED | Line 41 | --- @@ -114,10 +115,9 @@ Phase 3's scope (Document Migration & Multi-User Isolation) will add `get_curren | Artifact | Data Variable | Source | Produces Real Data | Status | |----------|---------------|--------|-------------------|--------| -| `backend/services/auth.py:verify_totp` | `redis_client.get(replay_key)` | `app.state.redis` (aioredis) | Yes — real Redis TTL-keyed lookup | FLOWING | -| `backend/services/auth.py:verify_backup_code` | `rows` from `select(BackupCode)` | PostgreSQL via SQLAlchemy async | Yes — real DB query with `used_at.is_(None)` filter | FLOWING | -| `backend/api/admin.py:_user_to_dict` | Explicit whitelist dict | User ORM object from DB | Yes — DB-loaded User object, no document fields included | FLOWING | -| `frontend/src/stores/auth.js:accessToken` | `ref(null)` → set on successful login response | `api/client.js` login response | Yes — set from `data.access_token` on successful auth | FLOWING | +| `TotpEnrollment.vue` | `qrDataUrl` | `QRCode.toDataURL(qrUri.value)` after `api.totpSetup()` returns `provisioning_uri` | Yes — real otpauth:// URI from backend, converted to PNG data URL | FLOWING | +| `SettingsAccountTab.vue` | `authStore.user.totp_enabled` | Pinia auth store (populated from login response) | Yes — real DB-backed value | FLOWING | +| `SettingsAccountTab.vue` | `authStore.user.email`, `.handle`, `.role` | Pinia auth store `/api/auth/me` response | Yes — real user data | FLOWING | --- @@ -125,22 +125,15 @@ Phase 3's scope (Document Migration & Multi-User Isolation) will add `get_curren | Behavior | Command | Result | Status | |----------|---------|--------|--------| -| All Phase 2 auth tests pass | `python3 -m pytest tests/test_task1_models_config.py tests/test_task2_auth_service.py tests/test_auth_deps.py tests/test_auth_api.py tests/test_auth_totp.py tests/test_admin_api.py -q` | 77 passed, 47 warnings in 8.98s | PASS | -| Frontend builds clean | `npm run build` | Built in 576ms; 11 chunks; exit 0 | PASS | -| No localStorage in auth store | `grep -c "localStorage" frontend/src/stores/auth.js` | 0 | PASS | -| httpOnly refresh cookie | `grep -c "httponly\|HttpOnly\|httpOnly" backend/api/auth.py` | 6 | PASS | -| CORS locked to settings | `grep -c "cors_origins" backend/main.py` | 4 | PASS | -| Rate limiting on auth endpoints | `grep -c "@limiter.limit" backend/api/auth.py` | 5 (register, login, refresh, TOTP enable, password-reset) | PASS | -| get_current_admin on every admin handler | `grep -c "get_current_admin" backend/api/admin.py` | 10 | PASS | -| No impersonation in admin.py (code) | `grep -n "impersonat" backend/api/admin.py` shows only comments/docstrings | 0 code references | PASS | -| admin.py never returns password_hash | `_user_to_dict()` whitelist verified | password_hash only at line 186 (constructor write, not response) | PASS | -| Documents API unauthenticated | `grep -n "get_current_user" backend/api/documents.py` | 0 matches — no auth enforcement | FAIL (SC5 gap) | - ---- - -### Probe Execution - -No declared probes found. Step 7c: SKIPPED (no probe-*.sh files in scripts/). +| Admin create_user regression test | `python3 -m pytest tests/test_admin_api.py::test_create_user_writes_audit_log -v` | 1 passed, 2.23s | PASS | +| Frontend build | `npm run build` | 156 modules, exit 0, built in 1.82s | PASS | +| Frontend test suite | `npm test` | 107/107 passed (11 test files) | PASS | +| 4 auth routes have `meta.layout:'auth'` | `grep -c "layout.*auth" router/index.js` | 4 matches | PASS | +| /admin has `meta.requiresAdmin` | `grep -n "requiresAdmin" router/index.js` | Line 42 (route def) + line 91 (beforeEach check) | PASS | +| qrcode in package.json dependencies | `grep "qrcode" package.json` | `"qrcode": "^1.5.4"` | PASS | +| QRCode.toDataURL + img tag in TotpEnrollment | `grep -n "toDataURL\|qrDataUrl\|img.*qr" TotpEnrollment.vue` | Lines 34, 120, 136 | PASS | +| SettingsAccountTab imported and rendered in SettingsView | `grep -n "account\|SettingsAccountTab" SettingsView.vue` | Lines 52, 92, 100 | PASS | +| No localStorage in auth store | `grep -c "localStorage" frontend/src/stores/auth.js` | 0 (from initial verification) | PASS | --- @@ -148,93 +141,146 @@ No declared probes found. Step 7c: SKIPPED (no probe-*.sh files in scripts/). | Requirement | Plan | Description | Status | Evidence | |-------------|------|-------------|--------|---------| -| AUTH-01 | 02-01, 02-02 | Register with Argon2 + HIBP check + strength enforcement | SATISFIED | `hash_password()` uses pwdlib Argon2Hasher; `check_hibp()` k-anonymity; strength in `_validate_password_strength()` | -| AUTH-02 | 02-01, 02-02 | JWT in Pinia memory; refresh in httpOnly SameSite=Strict cookie | SATISFIED | `accessToken = ref(null)` in store; `_set_refresh_cookie()` with httponly=True, samesite="strict" | -| AUTH-03 | 02-03 | TOTP enrollment with 8-10 backup codes acknowledged before activation | SATISFIED | `generate_backup_codes(10)` + `BackupCodesDisplay.vue` acknowledgment checkbox | -| AUTH-04 | 02-02 | Login via TOTP or single-use backup code; backup code invalidated on use | SATISFIED | `verify_totp()` and `verify_backup_code()` paths in login handler; `used_at` set on use | +| AUTH-03 | 02-03, 02-06 | TOTP enrollment with 8–10 backup codes acknowledged before activation | SATISFIED | `generate_backup_codes(10)` + BackupCodesDisplay acknowledgment gate (initial verification); QR image now rendered via qrcode library (plan 06 fix) | +| AUTH-04 | 02-02 | Login via TOTP code or single-use backup code | SATISFIED | `verify_totp()` + `verify_backup_code()` paths in login handler; `used_at` set on use | | AUTH-05 | 02-03 | Password reset via email; no auto-login; returns to TOTP gate | SATISFIED | Confirm endpoint returns 200 + message, no tokens; `revoke_all_refresh_tokens()` called | -| AUTH-06 | 02-03 | Sign out all active sessions | SATISFIED | `logout_all` endpoint calls `revoke_all_refresh_tokens()` | -| AUTH-07 | 02-01 | Refresh token family revocation on reuse + security alert | SATISFIED | `rotate_refresh_token()` detects `row.revoked=True` → revoke all + `send_security_alert_email.delay()` | -| AUTH-08 | 02-01, 02-03 | TOTP single-use within validity window (replay prevention) | SATISFIED | Redis key `totp_used:{user_id}:{code}` TTL=90s in `verify_totp()` | | SEC-01 | 02-02 | CSRF protection (SameSite=Strict + Origin validation) | SATISFIED | `OriginValidationMiddleware` + SameSite=Strict on refresh cookie | -| SEC-02 | 02-02, 02-03 | Rate limiting on auth endpoints (per-IP + per-account) | SATISFIED | slowapi `@limiter.limit()` decorators + Redis per-account counter `login_attempts:{email}` | -| SEC-03 | 02-01 | Parameterized queries / ORM | SATISFIED | All DB ops use SQLAlchemy ORM; zero raw string interpolation | -| SEC-05 | 02-02 | CSP + X-Frame-Options + X-Content-Type-Options headers | SATISFIED | `SecurityHeadersMiddleware` in main.py adds all three headers | -| SEC-06 | 02-01 | Constant-time comparison for all token/code verification | SATISFIED | `pwdlib.verify()` (constant-time); backup code verification iterates ALL rows without early exit | -| SEC-07 | 02-04 | Admin role on every admin endpoint; admin cannot see document content | PARTIAL | Admin API enforced via `get_current_admin` (VERIFIED). But `backend/api/documents.py` has no auth at all — admin JWT not rejected on document access (SC5 gap) | -| ADMIN-01 | 02-04, 02-05 | Admin creates user with temp password, `password_must_change=True` | SATISFIED | `POST /api/admin/users` sets `password_must_change=True`; login flow checks flag | -| ADMIN-02 | 02-04, 02-05 | Admin deactivates user account | SATISFIED | `PATCH /api/admin/users/{id}/status` with sole-admin guard | -| ADMIN-03 | 02-04 | Admin initiates password reset for user (email, no impersonation) | SATISFIED | `POST /api/admin/users/{id}/password-reset` dispatches `send_reset_email.delay()` | -| ADMIN-04 | 02-04, 02-05 | Admin views/adjusts quotas with below-usage warning | SATISFIED | `GET/PATCH /api/admin/users/{id}/quota`; `AdminQuotasTab.vue` | -| ADMIN-05 | 02-04, 02-05 | Admin assigns AI provider/model per user | SATISFIED | `PATCH /api/admin/users/{id}/ai-config`; `AdminAiConfigTab.vue` | +| SEC-03 | 02-01 | Parameterized queries / ORM | SATISFIED | All DB ops via SQLAlchemy ORM; zero raw string interpolation | +| ADMIN-01 | 02-04, 02-06 | Admin creates user with temp password, password_must_change=True | SATISFIED | POST /api/admin/users sets password_must_change=True; HTTP 500 fixed via session.flush() at admin.py:247 | | ADMIN-07 | 02-04 | Admin impersonation explicitly excluded | SATISFIED | No impersonation endpoint; test_admin_impersonation_not_found asserts 404/422 | --- +### Open Code Review Findings (from 02-REVIEW.md) + +These findings were surfaced by the code reviewer after plan 06 execution and are NOT yet fixed. They represent security invariants and UX gaps that require developer attention before Phase 2 can be considered fully resolved. + +#### CR-01 — BLOCKER: Password change does not revoke active sessions + +**File:** `backend/api/auth.py` line 520 (`change_password` endpoint) +**Issue:** CLAUDE.md line 153 requires: "Password change, TOTP enroll/revoke, and account deactivation immediately revoke all active sessions." The `change_password` handler updates `password_hash` and commits but does not call `revoke_all_refresh_tokens()`. An attacker with a previously-stolen refresh cookie retains full access for up to 30 days after the victim changes their password. +**Fix required:** Add `await auth_service.revoke_all_refresh_tokens(session, current_user.id)` after `session.commit()` in the `change_password` handler. Also redirect the current session to /login in the frontend `changePassword()` success path. + +#### CR-02 — BLOCKER: TOTP disable does not revoke active sessions + +**File:** `backend/api/auth.py` line 641 (`disable_totp` endpoint) +**Issue:** Same CLAUDE.md line 153 requirement. The `disable_totp` handler clears `totp_secret`, sets `totp_enabled=False`, and deletes backup codes but does not revoke any refresh tokens. An attacker can downgrade account security and both the attacker and any stolen sessions remain valid. +**Fix required:** Add `await session.execute(delete(RefreshToken).where(RefreshToken.user_id == current_user.id))` + `await session.commit()` in the `disable_totp` handler after backup code deletion. + +#### CR-03 — WARNING: Dead `#confirm-button` slot in SettingsAccountTab removes spinner/guard on sign-out-all + +**File:** `frontend/src/components/settings/SettingsAccountTab.vue` lines 149–161 +**Issue:** `ConfirmBlock.vue` defines no named slot. The `