curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(07.1): create phase plan — 2 waves, CR-01..03 session revocation

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
curo1305
2026-06-05 12:27:24 +02:00
co-authored by Claude Sonnet 4.6
parent 0fa23f5211
commit a3a97430a2
3 changed files with 424 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/ROADMAP.md
+10 -2
View File
@@ -451,7 +451,15 @@ Before any phase is marked complete, all three gates must pass:
**Depends on**: Phase 7
**Requirements**: CR-01, CR-02, CR-03
**Status:** Context gathered — ready for planning
**Plans**: 2 plans
**Wave 1** — Backend: service + API changes
- [ ] 07.1-01-PLAN.md — Add skip_token_hash param to revoke_all_refresh_tokens + wire revoke into change_password, enable_totp, disable_totp with sessions_revoked response + audit log
**Wave 2** *(blocked on Wave 1)*
- [ ] 07.1-02-PLAN.md — Tests (3 new test_*_revokes_other_sessions) + frontend toast in SettingsAccountTab.vue + TotpEnrollment.vue
---
@@ -501,7 +509,7 @@ Before any phase is marked complete, all three gates must pass:
| 6.1. Close v1.0 audit gaps | 2/2 | Complete | 2026-05-30 |
| 6.2. Close v1 sharing + cloud-delete + CSV export gaps | 5/5 | Complete | 2026-05-31 |
| 7. Redo and optimize LLM integration | 5/5 | Complete | 2026-06-05 |
| 7.1. Security: session revocation on privilege change (CR-01..03) | 0/? | Context gathered | — |
| 7.1. Security: session revocation on privilege change (CR-01..03) | 0/2 | Planned | — |
| 7.2. Security: JTI claim + Redis access-token revocation | 0/? | Not planned (INSERTED) | — |
| 7.3. Security: ES256 algorithm upgrade | 0/? | Not planned (INSERTED) | — |
| 7.4. Security: token fingerprinting / token binding | 0/? | Not planned (INSERTED) | — |