From 7fa6eee9a90aae91a5b72f8929cd845091015699 Mon Sep 17 00:00:00 2001 From: wtclaude Date: Sun, 19 Jul 2026 04:10:12 -0500 Subject: [PATCH] docs(android): mark the password-reset prerequisite done in PLAN MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit §8 item 2 (password reset — the "build FIRST before app work" prerequisite) shipped in RunicGateway/website#75 + docs#8. Mark it done, note the shipped design (opaque token stored as a sha256 hash in password_resets, mirroring user_invites, rather than a signed JWT), and record which §8 items remain open. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr --- android/PLAN.md | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/android/PLAN.md b/android/PLAN.md index b015519..e51a29c 100644 --- a/android/PLAN.md +++ b/android/PLAN.md @@ -1,11 +1,16 @@ # Android App — Plan -Status: **planning only, no code yet.** This document is the design contract for the -`RunicGateway/Android-app` repo. It is written before implementation so the API changes it -depends on can be landed in `website/` and `docs/` first. When we start coding, the authoritative -API reference is the committed OpenAPI spec at +Status: **planning; no app code yet — website prerequisites in progress.** This document is the +design contract for the `RunicGateway/Android-app` repo. It is written before implementation so the +API changes it depends on can be landed in `website/` and `docs/` first. When we start coding, the +authoritative API reference is the committed OpenAPI spec at `website/server/swagger/swagger-output.json` (regenerated via `npm run swagger`). +**Prerequisite progress (§8):** ✅ **Password reset** — the "build FIRST, before app work" prerequisite +(§8 item 2) is **done** (RunicGateway/website#75 + docs#8, 2026-07-19). The remaining §8 items are still +open: role-agnostic `/auth/me/*` self surface (item 1), version/health for first-run (item 4), branding +confirmation (item 6); push (item 3) is post-v1. + The workspace already holds `website/`, `link/`, `servuo-plugins/`, and `docs/`. `android-app/` is the fifth repo. It is **purely an API client of the website backend** — it never talks to the `link/` sidecar or the shard directly, and it ships none of the shard/sidecar wiring. @@ -296,11 +301,15 @@ maintenance cost. Reserve v2 for a real breaking re-shape if one ever arises. - `GET /auth/me/account/identities`, `DELETE /auth/me/account/identities/:provider`. - Regenerate Swagger; add `#swagger` annotations for each. 2. **Password reset — build on backend + web front end FIRST (a prerequisite, not app scope).** - No reset route exists anywhere today. Build the full platform flow in `website/` **before** app work - starts: request-reset (email a signed, single-use, expiring token) → reset page + endpoint (verify → - set password → revoke sessions), reusing the mail sender + `secretBox`/hashing. The app then just - links users to that website page (§4.2) — **no mobile reset endpoint.** Regenerate Swagger; document - in `BACKEND_DESIGN.md`. + ✅ **DONE (2026-07-19, RunicGateway/website#75 + docs#8).** Full platform flow shipped in `website/`: + request-reset (`POST /auth/password/forgot`, always a generic 200 — no account enumeration) emails a + single-use, ~1h link → reset page + endpoints (`GET|POST /auth/password/reset/:token`) that verify, + set the password, and revoke every session (web cutoff + mobile refresh tokens). The token is an + opaque random value stored as a **sha256 hash** in a new `password_resets` table (mirroring + `user_invites` — chosen over a signed JWT to match the house pattern; functionally equivalent). It + also serves SSO-only accounts (null hash) as their set-initial-password path. Swagger regenerated; + documented in `BACKEND_DESIGN.md`. The app just links users to the web page (§4.2) — **no mobile reset + endpoint.** - No mobile SSO/invite/register endpoints are needed: SSO, registration, and invite acceptance all stay website-handled and the app hands off to them (§4.2). This is a deliberate scope reduction. 3. **Push notifications** — see §11. Additive v1 endpoints under `/auth/me/devices*` and