3 Commits

Include renames

Author	SHA1	Message	Date
steveandClaude Opus 4.8	8f736048b9	Address Gadfly review on #14: bounds trap, date order, count cap ... - UpdatePlanting: only re-check the object-bounds when the position is actually being moved. A plop orphaned outside its object by a later resize stays editable/removable instead of becoming a row you can't fix or delete. - finalizePlanting: reject removed_at before planted_at. - derivedCount: guard Inf (not just NaN) and cap the result at maxExplicitCount (1e6) — the same ceiling a manual override honors — so a huge radius / tiny spacing can't overflow a 32-bit int or return an absurd value. - Refresh stale docs that referenced #14 as not-yet-landed (FullGarden, ListActivePlantingsForGarden, ListReferencedPlants) and note the date-only layout beside timeLayout. Deliberately did NOT add a plantable re-check to Update/Delete: existing plops must stay editable/removable even if their object was later marked non-plantable (same trap as the bounds case). Tests: derived-count cap, removed-before-planted rejection, and edit/move of a plop orphaned by an object shrink. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi	2026-07-18 22:39:48 -04:00
steveandClaude Opus 4.8	02c928ac6d	Address Gadfly review on #4: TOCTOU, sliding cookie, CSRF, argon2 ... Fixes from the PR #23 adversarial review (graded 35 real / 1 false positive): Security / correctness - Race-free registration: is_admin and the registration gate are now computed atomically inside a single INSERT...SELECT, so concurrent first registrations can't both become admin or bypass closed registration (fixed the whole TOCTOU cluster). - Sliding session now reaches the browser: ResolveSession returns the current expiry and requireAuth re-sets the cookie, so active users aren't logged out 30 days after login regardless of activity. - Login CSRF: csrfGuard rejects state-changing requests whose Origin doesn't match PANSY_BASE_URL (no-op when unset, so the dev proxy is unaffected). SameSite=Lax alone didn't cover this. - argon2id tuned to RFC 9106's second recommended profile (t=3). - Timing equalizer can't fail open: the dummy hash is derived deterministically (fixed salt, no RNG) so it's always present. - Password length (<=1024) enforced in the service for both register and login, not just HTTP binding tags; login rejects over-long input before spending argon2 work. Error handling / robustness - Login logs a malformed stored hash instead of silently treating it as a wrong password. - Best-effort session writes (Touch/Delete during renewal, expiry, and corrupt-expiry cleanup) now log on failure. - index sessions.expires_at via new migration 0002 (0001 is immutable). Maintainability - Extract startSessionAndRespond and abortUnauthenticated; make writeServiceError a free function; consistent error handling in decodeHash; doc/comment fixes. Tests: over-long password, CSRF guard (cross-origin/same-origin/dev no-op), and cookie refresh on authenticated requests; migration-version assertions bumped to 2. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi	2026-07-18 17:04:35 -04:00
steveandClaude Opus 4.8	0e41ccd95a	Add local auth: users, sessions, register/login/logout/me (#4) ... Implements pansy's local (email + password) authentication and the session layer that OIDC (#5) will also reuse. - store: users.go (create/get-by-id/get-by-email/count) and sessions.go (create/get/touch/delete/delete-expired), scanning the existing 0001 schema. - service: the business-logic seam. auth.go (Register/Login/session lifecycle/Providers) + password.go (argon2id, 64 MiB/1/4, PHC-encoded, constant-time verify) + service.go (Service, clock injection, token hashing). First user is admin; closed registration still allows the bootstrap user; unknown-email and wrong-password are indistinguishable (same error, same argon2 work via a dummy hash). - api: POST /auth/register|login|logout, GET /auth/me|providers, plus a requireAuth middleware that resolves the HttpOnly session cookie (SameSite=Lax, Secure under https) to the actor. Handlers stay thin. - main: wires the service and a periodic expired-session sweep; sessions are also dropped lazily on access. Sliding 30-day expiry. - tests: service (register/login/expiry/renewal/cleanup, password) and api (cookie flow, middleware, validation, providers). Verified end-to-end via curl: register -> me -> restart -> session persists -> logout -> 401. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi	2026-07-18 16:38:03 -04:00