菜单
Technical decisions made for this project, with reasoning and rejected alternatives. Load when proposing architectural changes, evaluating alternatives, or asked why a choice was made. Topics: Adopt OAuth 2.0 authorization code flow with PKCE for the customer portal SPA.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Project coding conventions extracted from chat history. Load when writing new code, naming things, designing APIs, or reviewing PRs. Topics: Cursor pagination is mandatory for all paged GraphQL endpoints.
System architecture facts: components, data flow, integration boundaries. Load when implementing cross-component features, debugging integration issues, or onboarding to the codebase. Topics: Event sourcing for the billing audit log.
| name | ai-memory-decision-log |
| description | Technical decisions made for this project, with reasoning and rejected alternatives. Load when proposing architectural changes, evaluating alternatives, or asked why a choice was made. Topics: Adopt OAuth 2.0 authorization code flow with PKCE for the customer portal SPA. |
Auto-generated by ai-memory from AI chat history. Edit memories via
ai-memory list/extract/resolverather than this file — it is fully regenerated on everyai-memory rules --target skills.
Switch the SPA to OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange). Retire the implicit-flow client config. Require HTTPS-only redirect URIs. Migration is gated behind a feature flag; deprecate the old client_id by end of quarter.
Why: PKCE keeps the access token off the URL (auth code is the only thing exchanged via the front channel), and our existing oauth4webapi library supports PKCE out of the box. The migration is a few lines per auth provider plus an extra round-trip on first login — acceptable for the security gain.
Rejected: Stay on implicit flow ("works today") rejected: deprecated since 2019, security review will not sign off. Custom auth backend rejected: high cost, no incremental benefit over PKCE.
