66 lines
3.7 KiB
Markdown
66 lines
3.7 KiB
Markdown
# todo
|
|
|
|
## Scoring
|
|
|
|
`Score = 100 * V / (2**S + 8)`
|
|
|
|
`Bar = 1`
|
|
|
|
`Next ID = 72`
|
|
|
|
## Items
|
|
|
|
| ID | Release | Blocked by | Exempt | Item | L | E | I | R | S | Moves | Score |
|
|
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
| 19 | 0.6.0 | | question | **Run the documented Docker commands on macOS and fix whatever misbehaves.** | 2 | 2 | 1 | 3 | 3 | 1 by 3 | 3.3 |
|
|
| 16 | 0.6.0 | | question | **Decide whether the single Keto `Resource` namespace splits into per-domain namespaces.** | 3 | 2 | 3 | 6 | 6 | 7 by 2 | 0.5 |
|
|
| 65 | 0.6.0 | | | **Export `KetoError` from `@plainpages/plugin-api`, so a plugin can tell a Keto failure apart with `instanceof`.** | 1 | 2 | 1 | 2 | 1 | 7 by 3, 1 by 1 | 6.7 |
|
|
| 67 | 0.6.0 | | | **Group `src/auth`'s modules into one subfolder per concern, with `bootstrap.ts` staying at `src/auth/bootstrap.ts`.** | 3 | 1 | 2 | 4 | 6 | code health by 4 | 4.0 |
|
|
| 14 | 0.6.0 | | | **Drop a double-clicked duplicate submit, with no client-side JavaScript.** | 4 | 2 | 3 | 7 | 7 | 2 by 7, 1 by 4 | 1.4 |
|
|
|
|
## Renamed
|
|
|
|
- 0.4.21 renamed to 0.5.0
|
|
- 0.4.22 renamed to 0.5.0
|
|
|
|
## Details
|
|
|
|
### 19. Run the documented Docker commands on macOS and fix whatever misbehaves.
|
|
|
|
Needs a Mac. Two suspects, both from `--user "$(id -u):$(id -g)"`: a macOS `id -g` is `20`, which is
|
|
`dialout` inside the noble image, and Docker Desktop remaps bind-mount ownership in its VM.
|
|
|
|
### 16. Decide whether the single Keto `Resource` namespace splits into per-domain namespaces.
|
|
|
|
Ory's own examples model `Shift`, `Document` and so on. One global `Resource` bucket is the
|
|
project's "no catch-all names" rule applied to namespaces.
|
|
|
|
### 65. Export `KetoError` from `@plainpages/plugin-api`, so a plugin can tell a Keto failure apart with `instanceof`.
|
|
|
|
`src/plugin-host/plugin-api.ts` ~L47-48 exports `KratosError` and `HydraError`, but not `KetoError`
|
|
(`src/auth/keto-client.ts:43`), though `ctx.system.keto` throws it. The barrel is the contract
|
|
surface, so this adds to the plugin API: it ships in a minor, and `HOST_API_VERSION` must read
|
|
`0.6.0` when 0.6.0 is tagged (AGENTS.md → Rules). Adding is safe for installed plugins; removing it
|
|
later would take a major.
|
|
|
|
### 67. Group `src/auth`'s modules into one subfolder per concern, with `bootstrap.ts` staying at `src/auth/bootstrap.ts`.
|
|
|
|
`src/auth` holds 19 modules over several concerns: the per-request session path (`jwt*`, `jwks`,
|
|
`denylist`, `csrf`, `gate`, `guards`), the Ory clients (`kratos-*`, `keto-client`, `hydra-admin`,
|
|
`fetch-timeout`), the sign-in flows and their views (`routes`, `login`, `flow-view`), the OAuth2
|
|
provider (`oauth-*`), and the one-shot CLIs (`bootstrap`, `gen-jwks`). Pick folders a reader can
|
|
name, and update the folder list in `docs/decisions.md` → "`src/` is grouped by concern". Leave
|
|
`bootstrap.ts` in place, per "`bootstrap.ts` stays under `src/auth/`". Plugins import only the
|
|
barrel, so only `src/plugin-host/plugin-api.ts`'s paths change for them. Update the README file
|
|
map. Make `src/auth` easier to navigate, a place the seats found hard.
|
|
|
|
### 14. Drop a double-clicked duplicate submit, with no client-side JavaScript.
|
|
|
|
A second identical POST is expected from a non-technical user, and today creates two
|
|
users, mints two recovery codes, or registers two OAuth2 clients. It must not break a legitimately
|
|
repeatable action. Sketch: a CSS-only affordance so the second click has nothing to hit, plus the
|
|
host recognising a duplicate (same session, route and payload within a short window), logging and
|
|
dropping it. Open: what identifies "the same submission" (a one-time token minted into each form
|
|
beats hashing the payload), the window, where the record lives given the host is stateless, and how
|
|
a plugin declares a route repeatable.
|