curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(07.1): capture phase context

Browse Source
This commit is contained in:
curo1305
2026-06-05 11:23:07 +02:00
parent d86664d3f7
commit a7ee4fbd23
3 changed files with 228 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/ROADMAP.md
+48
View File
@@ -444,6 +444,50 @@ Before any phase is marked complete, all three gates must pass:
---
### Phase 7.1: Security: session revocation on privilege change (CR-01..03) (INSERTED)
**Goal**: Fix the three missing session-revocation calls in `backend/api/auth.py`: `change_password`, `enable_totp`, and `disable_totp` must all call `revoke_all_refresh_tokens()` (excluding the current session). Add `sessions_revoked` to their response shapes and a frontend toast when other sessions are terminated.
**Mode:** quick
**Depends on**: Phase 7
**Requirements**: CR-01, CR-02, CR-03
**Status:** Context gathered — ready for planning
---
### Phase 7.2: Security — JTI Claim + Redis Access-Token Revocation (INSERTED)
**Goal**: Add a `jti` (JWT ID) claim to every issued access token. In `get_current_user`, check `redis.get("jti_revoked:{jti}")` and raise 401 if set. Add `revoke_access_token(jti, ttl)` helper called from `change_password`, `enable_totp`, `disable_totp`, and admin account deactivation. Closes the 15-minute window where a revoked session's live access token remains valid.
**Mode:** quick
**Depends on**: Phase 7.1
**Requirements**: Tracked in `.planning/codebase/CONCERNS.md` §"No JTI Claim and No JTI Revocation in Redis"
**Status:** Not planned yet
---
### Phase 7.3: Security — ES256 Algorithm Upgrade (INSERTED)
**Goal**: Replace HS256 with ES256 (ECDSA P-256) for JWT signing. Generate a P-256 key pair; store private key in `JWT_PRIVATE_KEY` env var, public key in `JWT_PUBLIC_KEY`. Update `create_access_token` and all `decode_*` functions. Rotate all active refresh tokens on first boot after deploy. A leaked public key cannot forge tokens.
**Mode:** quick
**Depends on**: Phase 7.2
**Requirements**: Tracked in `.planning/codebase/CONCERNS.md` §"JWT Algorithm Downgrade: HS256 Instead of ES256"
**Status:** Not planned yet
---
### Phase 7.4: Security — Token Fingerprinting / Token Binding (INSERTED)
**Goal**: Add a `fgp` (fingerprint) claim = `hmac(key, User-Agent + Accept-Language)[:16]` to every issued access token. In `get_current_user`, recompute the fingerprint from the request headers and compare with `hmac.compare_digest`. Limits replay of stolen access tokens to the original device/browser context.
**Mode:** quick
**Depends on**: Phase 7.3
**Requirements**: Tracked in `.planning/codebase/CONCERNS.md` §"No Token Fingerprint / Token Binding"
**Status:** Not planned yet
---
## Progress Table
| Phase | Plans Complete | Status | Completed |
@@ -457,3 +501,7 @@ Before any phase is marked complete, all three gates must pass:
| 6.1. Close v1.0 audit gaps | 2/2 | Complete | 2026-05-30 |
| 6.2. Close v1 sharing + cloud-delete + CSV export gaps | 5/5 | Complete | 2026-05-31 |
| 7. Redo and optimize LLM integration | 5/5 | Complete | 2026-06-05 |
| 7.1. Security: session revocation on privilege change (CR-01..03) | 0/? | Context gathered | — |
| 7.2. Security: JTI claim + Redis access-token revocation | 0/? | Not planned (INSERTED) | — |
| 7.3. Security: ES256 algorithm upgrade | 0/? | Not planned (INSERTED) | — |
| 7.4. Security: token fingerprinting / token binding | 0/? | Not planned (INSERTED) | — |