curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(07.3): create phase plan — ES256 algorithm upgrade

Browse Source 
3 plans (3 waves): Wave 0 xfail stubs, Wave 1 ES256 core + startup
rotation, Wave 2 remember-me TTL split + LoginView checkbox.
Verification passed (0 blockers, 1 minor doc warning fixed).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
curo1305
2026-06-05 19:07:25 +02:00
co-authored by Claude Sonnet 4.6
parent 7ee87c001b
commit b7994efd06
8 changed files with 1649 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/ROADMAP.md
+16 -2
View File
@@ -481,7 +481,21 @@ Before any phase is marked complete, all three gates must pass:
**Depends on**: Phase 7.2
**Requirements**: Tracked in `.planning/codebase/CONCERNS.md` §"JWT Algorithm Downgrade: HS256 Instead of ES256"
**Status:** Not planned yet
**Plans**: 3 plans
**Wave 0** — Test scaffolds (no production code)
- [ ] 07.3-01-PLAN.md — Wave 0 xfail stubs: test_auth_es256.py (9 stubs covering ES256-01..05 + RM-01..03 + CFG-01 satellite) + extend test_settings_has_jwt_config for refresh_token_expire_hours
**Wave 1** *(blocked on Wave 0)* — ES256 core + startup rotation
- [ ] 07.3-02-PLAN.md — config.py jwt_private_key/jwt_public_key/refresh_token_expire_hours + services/auth.py 4 sites to ES256 + main.py _rotate_tokens_on_algorithm_change lifespan hook + docker-compose JWT_PRIVATE_KEY/JWT_PUBLIC_KEY + README key-gen snippet + .env.example + version bump 0.1.2
**Wave 2** *(blocked on Wave 1)* — "Remember me" 16h/30d TTL split
- [ ] 07.3-03-PLAN.md — create_refresh_token remember_me param + LoginRequest.remember_me + _set_refresh_cookie max_age conditional + LoginView.vue "Stay signed in for 30 days" checkbox + stores/auth.js + api/client.js forwarding + human checkpoint
**Status:** Planned (2026-06-05)
---
@@ -511,5 +525,5 @@ Before any phase is marked complete, all three gates must pass:
| 7. Redo and optimize LLM integration | 5/5 | Complete | 2026-06-05 |
| 7.1. Security: session revocation on privilege change (CR-01..03) | 0/2 | Planned | — |
| 7.2. Security: JTI claim + Redis access-token revocation | 0/? | Not planned (INSERTED) | — |
| 7.3. Security: ES256 algorithm upgrade | 0/? | Not planned (INSERTED) | — |
| 7.3. Security: ES256 algorithm upgrade | 0/3 | Planned | — |
| 7.4. Security: token fingerprinting / token binding | 0/? | Not planned (INSERTED) | — |