Phase D

docs/IMPLEMENTATION_STATUS.md

@@ -2,7 +2,42 @@
 
 Last updated: 2026-06-26
 
-## Current phase: Phase 9 — WHMCS integration and production hardening ✅
+## Current phase: WHMCS Phase D — SSO ✅
+
+### WHMCS Phase D completed
+
+| Area | Status | Notes |
+|------|--------|-------|
+| `SsoTicket` model | Done | Hashed token, 60s TTL, single use |
+| Impersonation sessions | Done | `UserSession.isImpersonation` + audit |
+| API create SSO | Done | `POST .../services/:id/sso` |
+| API consume SSO | Done | `POST /auth/sso/consume` → session cookie |
+| Path allowlist | Done | Server panel routes only |
+| Web SSO page | Done | `/auth/sso?ticket=` + impersonation banner |
+| WHMCS PHP SSO | Done | `ServiceSingleSignOn`, `AdminSingleSignOn` |
+| Docs | Done | `docs/integrations/whmcs/sso.md` |
+
+### Abnahmekriterium Phase D
+
+- [x] WHMCS „Server verwalten“ erzeugt einmaliges SSO-Ticket
+- [x] Ticket-Einlösung setzt Session-Cookie und leitet auf Server-Panel weiter
+- [x] Admin-SSO markiert Impersonation-Session sichtbar im Panel
+- [x] Gesperrte/beendete Services erhalten kein SSO-Ticket
+- [ ] Manual E2E: WHMCS client area → panel → server detail
+
+### Local SSO test
+
+1. `pnpm db:migrate && pnpm db:seed` (includes `local-dev-whmcs`)
+2. Provision a service via WHMCS API (`PUT .../clients/1`, `POST .../services`)
+3. `POST /api/v1/integrations/whmcs/services/{externalServiceId}/sso` (signed)
+4. Open `{APP_URL}/auth/sso?ticket={token}` → redirects to `/servers/{id}`
+5. Admin SSO: same flow with `kind=admin` → impersonation banner visible
+
+See [docs/integrations/whmcs/sso.md](integrations/whmcs/sso.md).
+
+---
+
+## Phase 9 — WHMCS integration and production hardening ✅
 
 ### Phase 9 completed
 
@@ -156,4 +191,4 @@ Server entry fields:
 
 ### Next phase: Post-MVP hardening
 
-- Stripe webhooks, SSO (WHMCS Phase D), reconciliation dashboard, penetration test
+- WHMCS Phase E (reconciliation), Phase F (usage billing), Stripe webhooks, penetration test