curo1305andClaude Sonnet 4.6
123ae5b29b
Moves phases 08–11 execution artifacts from .planning/phases/ to .planning/milestones/v0.2-phases/ to keep .planning/phases/ clean for the next milestone. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
21 lines
885 B
Markdown
21 lines
885 B
Markdown
# Plan 08-06 Summary — Auth API Decomposition
|
|
|
|
**Status:** Complete
|
|
**Requirements:** CODE-03, CODE-08, CR-01, CR-02, CR-03
|
|
**Date:** 2026-06-12
|
|
|
|
## What Was Done
|
|
|
|
- Created `backend/api/auth/` package: `shared.py`, `tokens.py`, `totp.py`, `password.py`, `__init__.py`
|
|
- `limiter` defined in `shared.py`, re-exported from `__init__.py` — `from api.auth import limiter` unchanged
|
|
- CR-01 (`change_password`), CR-02 (`enable_totp`), CR-03 (`disable_totp`) — `revoke_all_refresh_tokens(skip_token_hash=skip_hash)` preserved verbatim
|
|
- ES256, JTI, fgp token hardening preserved verbatim in `tokens.py`
|
|
- Deleted `backend/api/auth.py` monolith; zero test files modified
|
|
|
|
## Test Results
|
|
|
|
- `tests/test_auth.py` CR tests: PASSED (all 3)
|
|
- Auth + rate-limit + TOTP + replay + headers: 52 passed
|
|
- `app.state.limiter is api.auth.limiter` identity: confirmed
|
|
- Full suite: 405 passed
|