curo1305andClaude Sonnet 4.6
c9fe69db3a
All 6 tasks covered: 3 backend integration tests (pytest, green) + 3 frontend unit tests (vitest, green). 0 manual-only. Gap audit resolved 3/3 missing gaps. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
90 lines
4.0 KiB
Markdown
90 lines
4.0 KiB
Markdown
---
|
|
phase: "07.1"
|
|
slug: security-session-revocation-on-privilege-change
|
|
status: complete
|
|
nyquist_compliant: true
|
|
wave_0_complete: false
|
|
created: 2026-06-05
|
|
---
|
|
|
|
# Phase 07.1 — Validation Strategy
|
|
|
|
> Per-phase validation contract for session-revocation on privilege change.
|
|
|
|
---
|
|
|
|
## Test Infrastructure
|
|
|
|
| Property | Value |
|
|
|----------|-------|
|
|
| **Framework (backend)** | pytest 7.x + pytest-asyncio |
|
|
| **Config file (backend)** | `backend/pytest.ini` |
|
|
| **Framework (frontend)** | Vitest + @vue/test-utils |
|
|
| **Config file (frontend)** | `frontend/vitest.config.js` |
|
|
| **Backend quick run** | `cd backend && python3 -m pytest tests/test_auth_api.py -k "revokes_other_sessions" -v` |
|
|
| **Backend full suite** | `cd backend && python3 -m pytest -x -q --ignore=tests/test_extractor.py` |
|
|
| **Frontend quick run** | `cd frontend && npx vitest run src/components/settings/__tests__/SettingsAccountTab.test.js src/components/auth/__tests__/TotpEnrollment.test.js --reporter=verbose` |
|
|
| **Frontend full suite** | `cd frontend && npx vitest run --reporter=verbose` |
|
|
| **Estimated runtime** | ~5 s backend · ~10 s frontend |
|
|
|
|
---
|
|
|
|
## Sampling Rate
|
|
|
|
- **After every task commit:** Run backend quick run + frontend quick run
|
|
- **After every plan wave:** Run full backend + frontend suites
|
|
- **Before `/gsd:verify-work`:** Both full suites must be green
|
|
- **Max feedback latency:** ~15 seconds
|
|
|
|
---
|
|
|
|
## Per-Task Verification Map
|
|
|
|
| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|
|
|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
|
|
| 07.1-01-01 | 01 | 1 | CR-01 | T-7.1-01 | `skip_token_hash` excludes current session from revocation | integration | `cd backend && python3 -m pytest tests/test_auth_api.py -k "test_change_password_revokes_other_sessions" -v` | ✅ | ✅ green |
|
|
| 07.1-01-02 | 01 | 1 | CR-02 | T-7.1-01 | `enable_totp` revokes other sessions, keeps current alive | integration | `cd backend && python3 -m pytest tests/test_auth_api.py -k "test_enable_totp_revokes_other_sessions" -v` | ✅ | ✅ green |
|
|
| 07.1-01-03 | 01 | 1 | CR-03 | T-7.1-01 | `disable_totp` revokes other sessions, keeps current alive | integration | `cd backend && python3 -m pytest tests/test_auth_api.py -k "test_disable_totp_revokes_other_sessions" -v` | ✅ | ✅ green |
|
|
| 07.1-02-01 | 02 | 2 | CR-01 | T-7.1-04 | SettingsAccountTab shows toast when `changePassword` returns `sessions_revoked > 0` | unit | `cd frontend && npx vitest run src/components/settings/__tests__/SettingsAccountTab.test.js --reporter=verbose` | ✅ | ✅ green |
|
|
| 07.1-02-02 | 02 | 2 | CR-03 | T-7.1-04 | SettingsAccountTab shows toast when `disableTotp` returns `sessions_revoked > 0` | unit | `cd frontend && npx vitest run src/components/settings/__tests__/SettingsAccountTab.test.js --reporter=verbose` | ✅ | ✅ green |
|
|
| 07.1-02-03 | 02 | 2 | CR-02 | T-7.1-04 | TotpEnrollment shows inline alert when `enable_totp` returns `sessions_revoked > 0` | unit | `cd frontend && npx vitest run src/components/auth/__tests__/TotpEnrollment.test.js --reporter=verbose` | ✅ | ✅ green |
|
|
|
|
*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
|
|
|
|
---
|
|
|
|
## Wave 0 Requirements
|
|
|
|
Existing infrastructure covers all phase requirements. No Wave 0 installs needed.
|
|
|
|
---
|
|
|
|
## Manual-Only Verifications
|
|
|
|
All phase behaviors have automated verification.
|
|
|
|
---
|
|
|
|
## Validation Audit 2026-06-05
|
|
|
|
| Metric | Count |
|
|
|--------|-------|
|
|
| Gaps found | 3 |
|
|
| Resolved | 3 |
|
|
| Escalated | 0 |
|
|
|
|
Auditor: gsd-nyquist-auditor — 5 new Vitest tests added (+3 positive, +2 negative), all green. Backend suite previously green (3 passing integration tests). No regressions.
|
|
|
|
---
|
|
|
|
## Validation Sign-Off
|
|
|
|
- [x] All tasks have `<automated>` verify
|
|
- [x] Sampling continuity: no 3 consecutive tasks without automated verify
|
|
- [x] Wave 0 covers all MISSING references (N/A — infra pre-existing)
|
|
- [x] No watch-mode flags
|
|
- [x] Feedback latency < 15s
|
|
- [x] `nyquist_compliant: true` set in frontmatter
|
|
|
|
**Approval:** approved 2026-06-05
|