65 lines
2.0 KiB
Markdown
65 lines
2.0 KiB
Markdown
# MCIAS Progress
|
|
|
|
Source of truth for current development state.
|
|
|
|
---
|
|
|
|
## Current Status: Phase 0 — Repository Bootstrap
|
|
|
|
### Completed
|
|
|
|
- [x] CLAUDE.md — project conventions and constraints
|
|
- [x] .golangci.yaml — linter configuration
|
|
- [x] PROJECT.md — project specifications
|
|
- [x] ARCHITECTURE.md — technical design document (token lifecycle, session
|
|
management, multi-app trust boundaries, database schema)
|
|
- [x] PROJECT_PLAN.md — discrete implementation steps with acceptance criteria
|
|
- [x] PROGRESS.md — this file
|
|
|
|
### In Progress
|
|
|
|
- [ ] Step 0.1: Go module and dependency setup (`go.mod`, `go get`)
|
|
- [ ] Step 0.2: `.gitignore`
|
|
|
|
### Up Next
|
|
|
|
- Phase 1: Foundational packages (`internal/model`, `internal/config`,
|
|
`internal/crypto`, `internal/db`)
|
|
|
|
---
|
|
|
|
## Implementation Log
|
|
|
|
### 2026-03-11
|
|
|
|
- Wrote ARCHITECTURE.md covering:
|
|
- Security model and threat model
|
|
- Cryptographic primitive choices with rationale
|
|
- Account model (human + system accounts, roles, lifecycle)
|
|
- Token lifecycle (issuance, validation, renewal, revocation flows)
|
|
- Session management approach (stateless JWT + revocation table)
|
|
- Multi-app trust boundaries
|
|
- REST API design (all endpoints)
|
|
- Database schema (SQLite, all tables with indexes)
|
|
- TLS configuration
|
|
- TOML configuration format
|
|
- Package/directory structure
|
|
- Error handling and logging conventions
|
|
- Audit event catalog
|
|
- Operational considerations
|
|
|
|
- Wrote PROJECT_PLAN.md with 5 phases, 12 steps, each with specific
|
|
acceptance criteria.
|
|
|
|
---
|
|
|
|
## Notes / Decisions
|
|
|
|
- SQLite driver: using `modernc.org/sqlite` (pure Go, no CGo dependency).
|
|
This simplifies cross-compilation and removes the need for a C toolchain.
|
|
- JWT library: `github.com/golang-jwt/jwt/v5`. The `alg` header validation
|
|
is implemented manually before delegating to the library to ensure the
|
|
library's own algorithm dispatch cannot be bypassed.
|
|
- No ORM. All database access via the standard `database/sql` interface with
|
|
prepared statements.
|