curo1305andClaude Sonnet 4.6
b7994efd06
3 plans (3 waves): Wave 0 xfail stubs, Wave 1 ES256 core + startup rotation, Wave 2 remember-me TTL split + LoginView checkbox. Verification passed (0 blockers, 1 minor doc warning fixed). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
83 lines
4.6 KiB
Markdown
83 lines
4.6 KiB
Markdown
---
|
|
phase: 7.3
|
|
slug: 07.3-security-es256-algorithm-upgrade-inserted
|
|
status: draft
|
|
nyquist_compliant: false
|
|
wave_0_complete: false
|
|
created: 2026-06-05
|
|
---
|
|
|
|
# Phase 7.3 — Validation Strategy
|
|
|
|
> Per-phase validation contract for feedback sampling during execution.
|
|
|
|
---
|
|
|
|
## Test Infrastructure
|
|
|
|
| Property | Value |
|
|
|----------|-------|
|
|
| **Framework** | pytest + pytest-asyncio |
|
|
| **Config file** | `backend/pytest.ini` |
|
|
| **Quick run command** | `cd backend && pytest tests/test_auth_es256.py tests/test_task1_models_config.py -x -v` |
|
|
| **Full suite command** | `cd backend && pytest -v` |
|
|
| **Estimated runtime** | ~30 seconds |
|
|
|
|
---
|
|
|
|
## Sampling Rate
|
|
|
|
- **After every task commit:** Run `cd backend && pytest tests/test_auth_es256.py tests/test_task1_models_config.py -x -v`
|
|
- **After every plan wave:** Run `cd backend && pytest -v`
|
|
- **Before `/gsd:verify-work`:** Full suite must be green
|
|
- **Max feedback latency:** 30 seconds
|
|
|
|
---
|
|
|
|
## Per-Task Verification Map
|
|
|
|
| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|
|
|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
|
|
| 7.3-01-01 | 01 | 0 | ES256-01..RM-03 | T-7.3-01 | Wave 0 xfail stubs for all 9 test cases | unit/integration | `pytest tests/test_auth_es256.py -x` | ❌ Wave 0 | ⬜ pending |
|
|
| 7.3-01-02 | 01 | 1 | CFG-01 | — | `settings.jwt_private_key`, `settings.jwt_public_key`, `settings.refresh_token_expire_hours` all present | unit | `pytest tests/test_task1_models_config.py -x` | ✅ (extend) | ⬜ pending |
|
|
| 7.3-01-03 | 01 | 1 | ES256-01 | T-7.3-01 | `create_access_token` returns token with `alg=ES256` in header | unit | `pytest tests/test_auth_es256.py::test_access_token_uses_es256 -x` | ❌ Wave 0 | ⬜ pending |
|
|
| 7.3-01-04 | 01 | 1 | ES256-02 | T-7.3-02 | HS256 token presented to ES256 verifier raises 401 | unit | `pytest tests/test_auth_es256.py::test_hs256_token_rejected -x` | ❌ Wave 0 | ⬜ pending |
|
|
| 7.3-01-05 | 01 | 1 | ES256-03 | T-7.3-01 | `create_password_reset_token` uses ES256 | unit | `pytest tests/test_auth_es256.py::test_reset_token_uses_es256 -x` | ❌ Wave 0 | ⬜ pending |
|
|
| 7.3-01-06 | 01 | 1 | ES256-04 | T-7.3-03 | Startup rotation bulk-revokes all refresh tokens when algorithm changes | integration | `pytest tests/test_auth_es256.py::test_startup_rotation_revokes_tokens -x` | ❌ Wave 0 | ⬜ pending |
|
|
| 7.3-01-07 | 01 | 1 | ES256-05 | T-7.3-03 | Startup rotation skips revocation on second boot (idempotent) | integration | `pytest tests/test_auth_es256.py::test_startup_rotation_idempotent -x` | ❌ Wave 0 | ⬜ pending |
|
|
| 7.3-02-01 | 02 | 2 | RM-01 | T-7.3-04 | Default login (no remember_me) issues 16-hour refresh token | integration | `pytest tests/test_auth_es256.py::test_default_ttl_16_hours -x` | ❌ Wave 0 | ⬜ pending |
|
|
| 7.3-02-02 | 02 | 2 | RM-02 | T-7.3-04 | `remember_me=True` issues 30-day refresh token | integration | `pytest tests/test_auth_es256.py::test_remember_me_ttl_30_days -x` | ❌ Wave 0 | ⬜ pending |
|
|
| 7.3-02-03 | 02 | 2 | RM-03 | T-7.3-04 | `remember_me=True` sets `Set-Cookie: Max-Age=2592000` | integration | `pytest tests/test_auth_es256.py::test_remember_me_cookie_max_age -x` | ❌ Wave 0 | ⬜ pending |
|
|
|
|
*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
|
|
|
|
---
|
|
|
|
## Wave 0 Requirements
|
|
|
|
- [ ] `backend/tests/test_auth_es256.py` — 9 xfail stubs covering ES256-01 through RM-03
|
|
- [ ] `backend/tests/test_task1_models_config.py` — extend `test_settings_has_jwt_config` to assert `refresh_token_expire_hours == 16`
|
|
|
|
---
|
|
|
|
## Manual-Only Verifications
|
|
|
|
| Behavior | Requirement | Why Manual | Test Instructions |
|
|
|----------|-------------|------------|-------------------|
|
|
| "Stay signed in for 30 days" checkbox visible on login form | D-12 | Frontend visual verification | Load `http://localhost:5173/login`; checkbox appears below password field; unchecked by default |
|
|
| Login without checkbox issues ~16h cookie | RM-03 | Browser cookie inspection | Login without checkbox; open DevTools → Application → Cookies; `refresh_token` `Max-Age` ≈ 57600 |
|
|
| Login with checkbox issues 30-day cookie | RM-03 | Browser cookie inspection | Login with checkbox checked; `refresh_token` `Max-Age` = 2592000 |
|
|
|
|
---
|
|
|
|
## Validation Sign-Off
|
|
|
|
- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
|
|
- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
|
|
- [ ] Wave 0 covers all MISSING references
|
|
- [ ] No watch-mode flags
|
|
- [ ] Feedback latency < 30s
|
|
- [ ] `nyquist_compliant: true` set in frontmatter
|
|
|
|
**Approval:** pending
|