curo1305andClaude Sonnet 4.6
169c2e7e29
Plan 03 human checkpoint passed. 07.3-03-SUMMARY.md written. ROADMAP: 07.3-03 checked, progress table updated to 3/3 Complete 2026-06-06. STATE: current_phase → 07.4, completed_phases → 12, completed_plans → 63. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
5.1 KiB
5.1 KiB
phase: 07.3-security-es256-algorithm-upgrade-inserted plan: "03" subsystem: backend/auth + frontend/auth tags:
- security
- jwt
- remember-me
- session-lifetime
- frontend
dependency_graph:
requires:
- 07.3-02 provides:
- remember_me param in create_refresh_token (16h default / 30d opt-in)
- Conditional cookie Max-Age in _set_refresh_cookie
- "Stay signed in for 30 days" checkbox in LoginView.vue
- All 9 Phase 7.3 tests PASSED (RM-01, RM-02, RM-03 promoted) affects:
- backend/services/auth.py
- backend/api/auth.py
- backend/tests/test_auth_es256.py
- frontend/src/views/auth/LoginView.vue
- frontend/src/stores/auth.js tech_stack: added: [] patterns:
- "remember_me=False default param threading: LoginView → store → api → LoginRequest → services"
- "Conditional TTL: timedelta(hours=16) default, timedelta(days=30) when remember_me=True"
- "Conditional Max-Age: 57600 default, 2592000 when remember_me=True" key_files: created: [] modified:
- path: backend/services/auth.py note: "create_refresh_token gains remember_me: bool = False; selects 16h or 30d TTL"
- path: backend/api/auth.py note: "LoginRequest.remember_me bool field; _set_refresh_cookie remember_me param; login handler threads remember_me"
- path: backend/tests/test_auth_es256.py note: "RM-01, RM-02, RM-03 promoted from xfail to passing — all 9 tests now PASSED"
- path: frontend/src/views/auth/LoginView.vue note: "rememberMe ref(false) + checkbox 'Stay signed in for 30 days'; threaded through all 3 submit handlers"
- path: frontend/src/stores/auth.js note: "login() forwards options.rememberMe as remember_me in api.login body" decisions:
- "rotate_refresh_token intentionally NOT updated — rotated sessions revert to 16h default (per Pitfall 4 in RESEARCH.md; simpler path chosen)"
- "api/client.js unchanged — already forwards full body verbatim, no field stripping"
- "Checkbox unchecked by default — explicit opt-in for extended session, not opt-out" metrics: duration: "~20 minutes" completed: "2026-06-06" tasks_completed: 2 files_modified: 5 human_checkpoint: PASSED
Phase 07.3 Plan 03: Remember-Me Feature — TTL Split + Cookie Max-Age + Frontend Checkbox Summary
Shipped "Stay signed in for 30 days" opt-in: backend TTL split (16h default / 30d opt-in), conditional cookie Max-Age, and LoginView checkbox with full threading from UI through store, API client, LoginRequest, and service layer. All 9 Phase 7.3 tests now PASSED.
Tasks Completed
| Task | Name | Commit | Files |
|---|---|---|---|
| 1 | Backend remember_me — TTL split + cookie Max-Age + 3 promoted tests | 9cc11b5 |
backend/services/auth.py, backend/api/auth.py, backend/tests/test_auth_es256.py |
| 2 | Frontend remember_me — checkbox + ref threading + store pass-through | 21e5d27 |
frontend/src/views/auth/LoginView.vue, frontend/src/stores/auth.js |
Grep Gate Results (Acceptance Criteria Verified)
| Gate | Expected | Actual | Status |
|---|---|---|---|
remember_me in services/auth.py |
>= 3 | 4 | PASS |
remember_me in api/auth.py |
>= 5 | 7 | PASS |
Max-Age / max_age in api/auth.py |
>= 2 | 4 | PASS |
Stay signed in for 30 days in LoginView.vue |
1 | 1 | PASS |
remember_me in stores/auth.js |
>= 1 | 1 | PASS |
Promoted Tests (xfail → PASSED)
| Test | Requirement | Before | After |
|---|---|---|---|
| test_default_ttl_16_hours | RM-01 | XFAIL (strict) | PASSED |
| test_remember_me_ttl_30_days | RM-02 | XFAIL (strict) | PASSED |
| test_remember_me_cookie_max_age | RM-03 | XFAIL (strict) | PASSED |
Net suite delta: +3 PASSED. All 9 Phase 7.3 tests now PASSED. Zero XFAILED remain.
Must-Haves Verified
| Truth | Status |
|---|---|
| Login without remember_me → TTL = 16 hours | PASS (RM-01) |
| Login with remember_me=True → TTL = 30 days | PASS (RM-02) |
| Login with remember_me=True → cookie Max-Age = 2592000 | PASS (RM-03) |
| Login without remember_me → cookie Max-Age = 57600 | PASS (RM-03, default branch) |
| LoginView.vue shows "Stay signed in for 30 days" checkbox, unchecked by default | PASS (human checkpoint) |
| State flows: LoginView ref → store → api body → LoginRequest → create_refresh_token | PASS (grep + human) |
Deviations from Plan
None. All tasks completed as specified. Intended non-updates (rotate_refresh_token, api/client.js) confirmed as correct.
Human Checkpoint: PASSED
User confirmed:
- "Stay signed in for 30 days" checkbox visible on login page
- Cookie Max-Age verified in DevTools → Network → POST /api/auth/login → Response Headers → set-cookie
Phase 7.3 Complete
All 3 plans shipped:
- Plan 01 (Wave 0): 9 xfail TDD stubs scaffolded
- Plan 02 (Wave 1): ES256 JWT signing at all 4 sites + startup rotation hook + operator wiring
- Plan 03 (Wave 2): remember_me TTL split + cookie Max-Age + frontend checkbox
Phase outcome: ES256 asymmetric JWT signing live; default session 16h; opt-in 30-day sessions; startup bulk-revocation on algorithm change; all 9 ES256/remember-me tests green.