style(13-03): apply Prettier formatting across repo
Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.
This commit is contained in:
Lucas Berger
@@ -3,38 +3,38 @@ phase: 03-event-write-back-pwa-install
|
||||
plan: 08
|
||||
type: execute
|
||||
wave: 5
|
||||
depends_on: ["03-04", "03-06", "03-07"]
|
||||
depends_on: ['03-04', '03-06', '03-07']
|
||||
files_modified:
|
||||
- .planning/phases/03-event-write-back-pwa-install/03-GATE2-RESULTS.md
|
||||
autonomous: false
|
||||
requirements: [CAL-04, CAL-05, CAL-06, PWA-01, PWA-02]
|
||||
user_setup:
|
||||
- service: authelia
|
||||
why: "Gate 2 verifies real Authelia OIDC login over the public Pangolin URL including the iOS standalone-PWA flow (success criterion 6, D-14)"
|
||||
why: 'Gate 2 verifies real Authelia OIDC login over the public Pangolin URL including the iOS standalone-PWA flow (success criterion 6, D-14)'
|
||||
env_vars:
|
||||
- name: OIDC_AUTH_EXTERNAL_URL
|
||||
source: "Set to the public familysync URL (e.g. https://familysync.<domain>) so redirect_uri is correct behind Pangolin"
|
||||
source: 'Set to the public familysync URL (e.g. https://familysync.<domain>) so redirect_uri is correct behind Pangolin'
|
||||
dashboard_config:
|
||||
- task: "Register FamilySync as an OIDC confidential client (code flow + PKCE S256, client_secret_basic) and ensure the redirect_uri matches the public URL"
|
||||
location: "Authelia configuration"
|
||||
- task: "Expose familysync through Pangolin/Newt (Mode A local test rig is sufficient — Unraid prod optional until go-live, D-15)"
|
||||
location: "Pangolin / Newt connector"
|
||||
- task: 'Register FamilySync as an OIDC confidential client (code flow + PKCE S256, client_secret_basic) and ensure the redirect_uri matches the public URL'
|
||||
location: 'Authelia configuration'
|
||||
- task: 'Expose familysync through Pangolin/Newt (Mode A local test rig is sufficient — Unraid prod optional until go-live, D-15)'
|
||||
location: 'Pangolin / Newt connector'
|
||||
|
||||
must_haves:
|
||||
truths:
|
||||
- "A real member completes Authelia OIDC login over the public Pangolin URL in a desktop browser; the session persists across a browser restart"
|
||||
- "On iPhone, the member installs FamilySync to the Home Screen and completes login WITHOUT the redirect breaking out of standalone mode"
|
||||
- "Each member shows a distinct, stable color (AUTH-03) in the live deploy"
|
||||
- "Create, edit, and delete an event end-to-end through the live deploy; the change appears in the native Fastmail app on the next sync (CAL-04/05/06)"
|
||||
- "The installed PWA opens full-screen with no browser chrome on iOS and Android (PWA-01/02)"
|
||||
- 'A real member completes Authelia OIDC login over the public Pangolin URL in a desktop browser; the session persists across a browser restart'
|
||||
- 'On iPhone, the member installs FamilySync to the Home Screen and completes login WITHOUT the redirect breaking out of standalone mode'
|
||||
- 'Each member shows a distinct, stable color (AUTH-03) in the live deploy'
|
||||
- 'Create, edit, and delete an event end-to-end through the live deploy; the change appears in the native Fastmail app on the next sync (CAL-04/05/06)'
|
||||
- 'The installed PWA opens full-screen with no browser chrome on iOS and Android (PWA-01/02)'
|
||||
artifacts:
|
||||
- path: ".planning/phases/03-event-write-back-pwa-install/03-GATE2-RESULTS.md"
|
||||
provides: "Recorded Gate 2 verification results (pass/fail per checklist row)"
|
||||
- path: '.planning/phases/03-event-write-back-pwa-install/03-GATE2-RESULTS.md'
|
||||
provides: 'Recorded Gate 2 verification results (pass/fail per checklist row)'
|
||||
key_links:
|
||||
- from: "live deploy"
|
||||
to: "docs/deployment.md Gate 2 checklist"
|
||||
via: "operator executes each row"
|
||||
pattern: "Gate 2"
|
||||
- from: 'live deploy'
|
||||
to: 'docs/deployment.md Gate 2 checklist'
|
||||
via: 'operator executes each row'
|
||||
pattern: 'Gate 2'
|
||||
---
|
||||
|
||||
<objective>
|
||||
@@ -135,19 +135,21 @@ Output: 03-GATE2-RESULTS.md with a pass/fail line per Gate 2 checklist row.
|
||||
</tasks>
|
||||
|
||||
<threat_model>
|
||||
|
||||
## Trust Boundaries
|
||||
|
||||
| Boundary | Description |
|
||||
|----------|-------------|
|
||||
| Boundary | Description |
|
||||
| -------------------------------- | ----------------------------------------------------- |
|
||||
| public internet → Pangolin → app | First real external exposure of the auth + write path |
|
||||
|
||||
## STRIDE Threat Register
|
||||
|
||||
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|
||||
|-----------|----------|-----------|-------------|-----------------|
|
||||
| T-03-23 | Spoofing | dev-auth bypass accidentally active in the live deploy | mitigate | Production build sets NODE_ENV=production → bypass forced OFF, OIDC unconditionally mounted (index.ts); verify the login is real Authelia, not the dev user |
|
||||
| T-03-24 | Information Disclosure | OIDC redirect_uri mismatch leaking codes or failing login | mitigate | OIDC_AUTH_EXTERNAL_URL set to the public URL; Authelia client redirect_uri matches (deployment.md) |
|
||||
| T-03-25 | Tampering | SW intercepting /callback in the live build | mitigate | Plan 07 denylist verified against the production build; Gate 2 row 4 confirms standalone login end-to-end |
|
||||
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|
||||
| --------- | ---------------------- | --------------------------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| T-03-23 | Spoofing | dev-auth bypass accidentally active in the live deploy | mitigate | Production build sets NODE_ENV=production → bypass forced OFF, OIDC unconditionally mounted (index.ts); verify the login is real Authelia, not the dev user |
|
||||
| T-03-24 | Information Disclosure | OIDC redirect_uri mismatch leaking codes or failing login | mitigate | OIDC_AUTH_EXTERNAL_URL set to the public URL; Authelia client redirect_uri matches (deployment.md) |
|
||||
| T-03-25 | Tampering | SW intercepting /callback in the live build | mitigate | Plan 07 denylist verified against the production build; Gate 2 row 4 confirms standalone login end-to-end |
|
||||
|
||||
</threat_model>
|
||||
|
||||
<verification>
|
||||
@@ -156,9 +158,10 @@ Output: 03-GATE2-RESULTS.md with a pass/fail line per Gate 2 checklist row.
|
||||
</verification>
|
||||
|
||||
<success_criteria>
|
||||
|
||||
- Success criterion 6 satisfied: live Authelia OIDC over Pangolin works including iOS standalone-PWA login; sessions persist; distinct stable colors.
|
||||
- Success criteria 1-5 confirmed live: create/edit/delete round-trip to Fastmail; installable + full-screen on iOS and Android.
|
||||
</success_criteria>
|
||||
</success_criteria>
|
||||
|
||||
<output>
|
||||
Create `.planning/phases/03-event-write-back-pwa-install/03-08-SUMMARY.md` when done.
|
||||
|
||||
Reference in New Issue
Block a user