133 lines
5.4 KiB
Markdown
133 lines
5.4 KiB
Markdown
# BDD Implementation Plan for dance-lessons-coach
|
|
|
|
## Current Status
|
|
- **Total Scenarios**: 54
|
|
- **Passing**: 30 (55%)
|
|
- **Pending**: 24 (44%)
|
|
- **Undefined**: 0 (0%)
|
|
- **Total Steps**: 361
|
|
- **Passing Steps**: 183
|
|
- **Pending Steps**: 24
|
|
- **Skipped Steps**: 154
|
|
|
|
## Priority Order for Step Function Implementation
|
|
|
|
### 🔴 CRITICAL PRIORITY (Blockers for core functionality)
|
|
1. **JWT Secret Management**
|
|
- `theServerIsRunningWithMultipleJWTSecrets()` - Setup multiple secrets
|
|
- `iShouldReceiveAValidJWTTokenSignedWithThePrimarySecret()` - Primary secret validation
|
|
- `iValidateAJWTTokenSignedWithTheSecondarySecret()` - Secondary secret validation
|
|
- `iAddANewSecondaryJWTSecretToTheServer()` - Secret addition
|
|
- `iAddANewSecondaryJWTSecretAndRotateToIt()` - Secret rotation
|
|
|
|
### 🟡 HIGH PRIORITY (Core JWT functionality)
|
|
2. **JWT Retention & Cleanup**
|
|
- `theDefaultJWTTTLIsHours()` - TTL configuration
|
|
- `theRetentionFactorIs()` - Retention factor setup
|
|
- `theMaximumRetentionIsHours()` - Max retention limits
|
|
- `iAddASecondaryJWTSecretWithHourExpiration()` - Expiring secrets
|
|
- `iWaitForTheRetentionPeriodToElapse()` - Time simulation
|
|
- `theExpiredSecondarySecretShouldBeAutomaticallyRemoved()` - Auto-cleanup
|
|
- `thePrimarySecretShouldRemainActive()` - Primary secret protection
|
|
|
|
3. **JWT Validation & Authentication**
|
|
- `aUserExistsWithPassword()` - User setup
|
|
- `iAuthenticateWithUsernameAndPassword()` - Login functionality
|
|
- `theAuthenticationShouldBeSuccessful()` - Success validation
|
|
- `iShouldReceiveAValidJWTToken()` - Token generation
|
|
- `iValidateTheReceivedJWTToken()` - Token validation
|
|
- `theTokenShouldBeValid()` - Token verification
|
|
- `itShouldContainTheCorrectUserID()` - Claims validation
|
|
|
|
### 🟢 MEDIUM PRIORITY (Extended functionality)
|
|
4. **User Management**
|
|
- `iRegisterANewUserWithPassword()` - User registration
|
|
- `theRegistrationShouldBeSuccessful()` - Registration validation
|
|
- `iShouldBeAbleToAuthenticateWithTheNewCredentials()` - Post-registration auth
|
|
- `iAuthenticateAsAdminWithMasterPassword()` - Admin access
|
|
- `theTokenShouldContainAdminClaims()` - Admin privileges
|
|
|
|
5. **Password Reset**
|
|
- `iAmAuthenticatedAsAdmin()` - Admin context
|
|
- `iRequestPasswordResetForUser()` - Reset initiation
|
|
- `thePasswordResetShouldBeAllowed()` - Reset authorization
|
|
- `theUserShouldBeFlaggedForPasswordReset()` - Reset state
|
|
- `iCompletePasswordResetForWithNewPassword()` - Reset completion
|
|
- `iShouldBeAbleToAuthenticateWithTheNewPassword()` - Post-reset validation
|
|
|
|
### 🔵 LOW PRIORITY (Edge cases & monitoring)
|
|
6. **Configuration & Validation**
|
|
- `iSetRetentionFactorTo()` - Dynamic configuration
|
|
- `iTryToStartTheServer()` - Server validation
|
|
- `iShouldReceiveConfigurationValidationError()` - Error handling
|
|
- `theErrorShouldMention()` - Error message validation
|
|
|
|
7. **Monitoring & Metrics**
|
|
- `iHaveEnabledPrometheusMetrics()` - Metrics setup
|
|
- `iShouldSeeMetricIncrement()` - Metric validation
|
|
- `iShouldSeeMetricDecrease()` - Metric changes
|
|
- `iShouldSeeHistogramUpdate()` - Histogram metrics
|
|
|
|
8. **Security & Logging**
|
|
- `iAddANewJWTSecret()` - Secret addition with masking
|
|
- `theLogsShouldShowMaskedSecret()` - Log validation
|
|
- `theLogsShouldNotExposeTheFullSecret()` - Security validation
|
|
|
|
9. **Performance & Scalability**
|
|
- `iHaveJWTSecrets()` - Bulk secret management
|
|
- `ofThemAreExpired()` - Expiration tracking
|
|
- `itShouldCompleteWithinMilliseconds()` - Performance validation
|
|
- `andNotImpactServerPerformance()` - Performance monitoring
|
|
|
|
10. **Advanced Features**
|
|
- `iEnableAuditLogging()` - Audit trail setup
|
|
- `iShouldSeeAuditLogEntryWithEventType()` - Audit validation
|
|
- `iAuthenticateAndReceiveTokenA()` - Token tracking
|
|
- `iRefreshMyTokenDuringRetentionPeriod()` - Token refresh
|
|
- `iShouldReceiveNewTokenB()` - New token validation
|
|
- `andTokenAShouldStillBeValidUntilRetentionExpires()` - Concurrent validation
|
|
- `givenASecurityIncidentRequiresImmediateRotation()` - Emergency rotation
|
|
- `iRotateToANewPrimarySecret()` - Emergency secret rotation
|
|
- `oldTokensShouldBeInvalidatedImmediately()` - Emergency invalidation
|
|
- `andNewTokensShouldUseTheEmergencySecret()` - Emergency token generation
|
|
- `andCleanupShouldRemoveCompromisedSecrets()` - Emergency cleanup
|
|
|
|
## Implementation Strategy
|
|
|
|
### Phase 1: Core JWT Infrastructure (2-3 days)
|
|
- Implement JWT secret management and rotation
|
|
- Add retention policy and cleanup functionality
|
|
- Create basic authentication endpoints
|
|
- Implement core step definitions
|
|
|
|
### Phase 2: User Management (1-2 days)
|
|
- Implement user registration and authentication
|
|
- Add password reset functionality
|
|
- Implement admin authentication
|
|
- Add user-related step definitions
|
|
|
|
### Phase 3: Monitoring & Security (1 day)
|
|
- Add Prometheus metrics integration
|
|
- Implement log masking for security
|
|
- Add audit logging
|
|
- Implement monitoring step definitions
|
|
|
|
### Phase 4: Edge Cases & Testing (1 day)
|
|
- Implement remaining edge case handlers
|
|
- Add performance validation
|
|
- Complete all step definitions
|
|
- Run full test suite validation
|
|
|
|
## Estimation
|
|
- **Total Effort**: 5-7 days
|
|
- **Critical Path**: 2-3 days (JWT core functionality)
|
|
- **Full Completion**: 1 week
|
|
|
|
## Success Criteria
|
|
- All 54 scenarios passing
|
|
- 0 undefined steps
|
|
- 0 pending steps
|
|
- Full test coverage of JWT secret rotation and retention
|
|
- Complete user authentication workflow
|
|
- Comprehensive monitoring and security features
|