curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(07.3): create phase plan — ES256 algorithm upgrade

Browse Source 
3 plans (3 waves): Wave 0 xfail stubs, Wave 1 ES256 core + startup
rotation, Wave 2 remember-me TTL split + LoginView checkbox.
Verification passed (0 blockers, 1 minor doc warning fixed).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
curo1305
2026-06-05 19:07:25 +02:00
co-authored by Claude Sonnet 4.6
parent 7ee87c001b
commit b7994efd06
8 changed files with 1649 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/phases/07.3-security-es256-algorithm-upgrade-inserted/07.3-RESEARCH.md
+5 -8
View File
@@ -562,17 +562,14 @@ async function login(email, password, options = {}) {
---
## Open Questions
## Open Questions (RESOLVED)
1. **TTL preservation across refresh token rotation**
1. **TTL preservation across refresh token rotation** (RESOLVED)
- What we know: `rotate_refresh_token` calls `create_refresh_token` internally with no `remember_me` param (default=False → 16 hours)
- What's unclear: Should a user who selected "stay signed in 30 days" get a new 30-day token on each rotation, or is 16-hour degradation acceptable?
- Recommendation: Accept 16-hour degradation on rotation for Phase 7.3 (simpler implementation). If users report confusion, Phase 7.4 or a follow-up can add TTL preservation by reading original `expires_at` or adding a `remember_me` column to `RefreshToken`.
- RESOLVED: Accept 16-hour degradation on rotation for Phase 7.3 (simpler implementation). `rotate_refresh_token` is intentionally NOT updated. Documented in Plan 07.3-03 objective and acceptance criteria.
2. **Test `test_settings_has_jwt_config` assertion on `refresh_token_expire_days == 30`**
- What we know: The test at `backend/tests/test_task1_models_config.py:31` asserts the existing field equals 30. This field is NOT changed.
- What's unclear: Nothing — this test continues to pass. A new test should assert `refresh_token_expire_hours == 16`.
- Recommendation: Add assertion for `refresh_token_expire_hours` in the same test function or a new one.
2. **Test `test_settings_has_jwt_config` assertion on `refresh_token_expire_days == 30`** (RESOLVED)
- RESOLVED: Nothing — this test continues to pass. Plan 07.3-01-T2 adds assertion for `refresh_token_expire_hours == 16` to the same test function.
---