From 9a3ce6ef3910a8ebf66966e344c1cf43248f26d5 Mon Sep 17 00:00:00 2001 From: curo1305 Date: Fri, 12 Jun 2026 10:29:40 +0200 Subject: [PATCH] =?UTF-8?q?docs(08-04/05/06):=20add=20plan=20summaries=20?= =?UTF-8?q?=E2=80=94=20wave=202=20backend=20decomposition=20complete?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Sonnet 4.6 --- .../08-04-SUMMARY.md | 25 +++++++++++++++++++ .../08-05-SUMMARY.md | 20 +++++++++++++++ .../08-06-SUMMARY.md | 20 +++++++++++++++ 3 files changed, 65 insertions(+) create mode 100644 .planning/phases/08-stack-upgrade-backend-decomposition/08-04-SUMMARY.md create mode 100644 .planning/phases/08-stack-upgrade-backend-decomposition/08-05-SUMMARY.md create mode 100644 .planning/phases/08-stack-upgrade-backend-decomposition/08-06-SUMMARY.md diff --git a/.planning/phases/08-stack-upgrade-backend-decomposition/08-04-SUMMARY.md b/.planning/phases/08-stack-upgrade-backend-decomposition/08-04-SUMMARY.md new file mode 100644 index 0000000..841b890 --- /dev/null +++ b/.planning/phases/08-stack-upgrade-backend-decomposition/08-04-SUMMARY.md @@ -0,0 +1,25 @@ +# Plan 08-04 Summary — Admin API Decomposition + +**Status:** Complete +**Requirements:** CODE-01, CODE-08 +**Date:** 2026-06-12 + +## What Was Done + +- Added `validate_provider_id()` to `backend/services/ai_config.py` (D-11 migration) +- Created `backend/api/admin/` package: `shared.py`, `users.py`, `quotas.py`, `ai.py`, `__init__.py` +- `__init__.py` aggregates with `prefix="/api/admin"` — 13 routes total +- All sub-routers declare no prefix (D-04) +- `_user_to_dict` shared helper in `shared.py` (T-02-27 / SEC-07 field whitelist) +- Both `SystemAiConfigUpdate` and `TestConnectionRequest` call `validate_provider_id()` (CODE-08) +- Deleted `backend/api/admin.py` monolith after 54-test URL regression passed + +## Test Results + +- `tests/test_admin_api.py`: 27 passed +- `tests/test_cloud.py` + `tests/test_admin_ai_config.py`: 27 passed +- Full suite: 405 passed (1 pre-existing docx env skip) + +## Admin Paths (unchanged) + +`/api/admin/users`, `/api/admin/users/{id}`, `/api/admin/users/{id}/status`, `/api/admin/users/{id}/quota`, `/api/admin/users/{id}/ai-config`, `/api/admin/users/{id}/password-reset`, `/api/admin/topics`, `/api/admin/ai-config`, `/api/admin/ai-config/models`, `/api/admin/ai-config/test-connection` diff --git a/.planning/phases/08-stack-upgrade-backend-decomposition/08-05-SUMMARY.md b/.planning/phases/08-stack-upgrade-backend-decomposition/08-05-SUMMARY.md new file mode 100644 index 0000000..3a519a1 --- /dev/null +++ b/.planning/phases/08-stack-upgrade-backend-decomposition/08-05-SUMMARY.md @@ -0,0 +1,20 @@ +# Plan 08-05 Summary — Documents API Decomposition + +**Status:** Complete +**Requirements:** CODE-02, CODE-08 +**Date:** 2026-06-12 + +## What Was Done + +- Created `backend/api/documents/` package: `shared.py`, `upload.py`, `crud.py`, `content.py`, `__init__.py` +- `__init__.py` aggregates with `prefix="/api/documents"` — 9 routes total +- `_CLOUD_PROVIDERS`, `UploadUrlRequest`, `DocumentPatch` defined once in `shared.py` (CODE-08) +- `list_documents` registered directly on parent router (FastAPI 0.128 empty-path/prefix restriction) +- `get_storage_backend_for_document` re-exported in `__init__.py` for test monkeypatching compatibility +- Deleted `backend/api/documents.py` monolith after 43-test regression passed + +## Test Results + +- `tests/test_documents.py`: 39 passed, 4 xfailed +- `tests/test_shares.py`: 4 passed +- Full suite: 405 passed diff --git a/.planning/phases/08-stack-upgrade-backend-decomposition/08-06-SUMMARY.md b/.planning/phases/08-stack-upgrade-backend-decomposition/08-06-SUMMARY.md new file mode 100644 index 0000000..219a4e1 --- /dev/null +++ b/.planning/phases/08-stack-upgrade-backend-decomposition/08-06-SUMMARY.md @@ -0,0 +1,20 @@ +# Plan 08-06 Summary — Auth API Decomposition + +**Status:** Complete +**Requirements:** CODE-03, CODE-08, CR-01, CR-02, CR-03 +**Date:** 2026-06-12 + +## What Was Done + +- Created `backend/api/auth/` package: `shared.py`, `tokens.py`, `totp.py`, `password.py`, `__init__.py` +- `limiter` defined in `shared.py`, re-exported from `__init__.py` — `from api.auth import limiter` unchanged +- CR-01 (`change_password`), CR-02 (`enable_totp`), CR-03 (`disable_totp`) — `revoke_all_refresh_tokens(skip_token_hash=skip_hash)` preserved verbatim +- ES256, JTI, fgp token hardening preserved verbatim in `tokens.py` +- Deleted `backend/api/auth.py` monolith; zero test files modified + +## Test Results + +- `tests/test_auth.py` CR tests: PASSED (all 3) +- Auth + rate-limit + TOTP + replay + headers: 52 passed +- `app.state.limiter is api.auth.limiter` identity: confirmed +- Full suite: 405 passed