docs(08-04/05/06): add plan summaries — wave 2 backend decomposition complete

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-12 10:29:40 +02:00
parent 81337bd9e3
commit 9a3ce6ef39
3 changed files with 65 additions and 0 deletions
@@ -0,0 +1,25 @@
+# Plan 08-04 Summary — Admin API Decomposition
+
+**Status:** Complete  
+**Requirements:** CODE-01, CODE-08  
+**Date:** 2026-06-12
+
+## What Was Done
+
+- Added `validate_provider_id()` to `backend/services/ai_config.py` (D-11 migration)
+- Created `backend/api/admin/` package: `shared.py`, `users.py`, `quotas.py`, `ai.py`, `__init__.py`
+- `__init__.py` aggregates with `prefix="/api/admin"` — 13 routes total
+- All sub-routers declare no prefix (D-04)
+- `_user_to_dict` shared helper in `shared.py` (T-02-27 / SEC-07 field whitelist)
+- Both `SystemAiConfigUpdate` and `TestConnectionRequest` call `validate_provider_id()` (CODE-08)
+- Deleted `backend/api/admin.py` monolith after 54-test URL regression passed
+
+## Test Results
+
+- `tests/test_admin_api.py`: 27 passed
+- `tests/test_cloud.py` + `tests/test_admin_ai_config.py`: 27 passed
+- Full suite: 405 passed (1 pre-existing docx env skip)
+
+## Admin Paths (unchanged)
+
+`/api/admin/users`, `/api/admin/users/{id}`, `/api/admin/users/{id}/status`, `/api/admin/users/{id}/quota`, `/api/admin/users/{id}/ai-config`, `/api/admin/users/{id}/password-reset`, `/api/admin/topics`, `/api/admin/ai-config`, `/api/admin/ai-config/models`, `/api/admin/ai-config/test-connection`
@@ -0,0 +1,20 @@
+# Plan 08-05 Summary — Documents API Decomposition
+
+**Status:** Complete  
+**Requirements:** CODE-02, CODE-08  
+**Date:** 2026-06-12
+
+## What Was Done
+
+- Created `backend/api/documents/` package: `shared.py`, `upload.py`, `crud.py`, `content.py`, `__init__.py`
+- `__init__.py` aggregates with `prefix="/api/documents"` — 9 routes total
+- `_CLOUD_PROVIDERS`, `UploadUrlRequest`, `DocumentPatch` defined once in `shared.py` (CODE-08)
+- `list_documents` registered directly on parent router (FastAPI 0.128 empty-path/prefix restriction)
+- `get_storage_backend_for_document` re-exported in `__init__.py` for test monkeypatching compatibility
+- Deleted `backend/api/documents.py` monolith after 43-test regression passed
+
+## Test Results
+
+- `tests/test_documents.py`: 39 passed, 4 xfailed
+- `tests/test_shares.py`: 4 passed
+- Full suite: 405 passed
@@ -0,0 +1,20 @@
+# Plan 08-06 Summary — Auth API Decomposition
+
+**Status:** Complete  
+**Requirements:** CODE-03, CODE-08, CR-01, CR-02, CR-03  
+**Date:** 2026-06-12
+
+## What Was Done
+
+- Created `backend/api/auth/` package: `shared.py`, `tokens.py`, `totp.py`, `password.py`, `__init__.py`
+- `limiter` defined in `shared.py`, re-exported from `__init__.py` — `from api.auth import limiter` unchanged
+- CR-01 (`change_password`), CR-02 (`enable_totp`), CR-03 (`disable_totp`) — `revoke_all_refresh_tokens(skip_token_hash=skip_hash)` preserved verbatim
+- ES256, JTI, fgp token hardening preserved verbatim in `tokens.py`
+- Deleted `backend/api/auth.py` monolith; zero test files modified
+
+## Test Results
+
+- `tests/test_auth.py` CR tests: PASSED (all 3)
+- Auth + rate-limit + TOTP + replay + headers: 52 passed
+- `app.state.limiter is api.auth.limiter` identity: confirmed
+- Full suite: 405 passed