steveandClaude Opus 4.8
0e41ccd95a
Implements pansy's local (email + password) authentication and the session layer that OIDC (#5) will also reuse. - store: users.go (create/get-by-id/get-by-email/count) and sessions.go (create/get/touch/delete/delete-expired), scanning the existing 0001 schema. - service: the business-logic seam. auth.go (Register/Login/session lifecycle/Providers) + password.go (argon2id, 64 MiB/1/4, PHC-encoded, constant-time verify) + service.go (Service, clock injection, token hashing). First user is admin; closed registration still allows the bootstrap user; unknown-email and wrong-password are indistinguishable (same error, same argon2 work via a dummy hash). - api: POST /auth/register|login|logout, GET /auth/me|providers, plus a requireAuth middleware that resolves the HttpOnly session cookie (SameSite=Lax, Secure under https) to the actor. Handlers stay thin. - main: wires the service and a periodic expired-session sweep; sessions are also dropped lazily on access. Sliding 30-day expiry. - tests: service (register/login/expiry/renewal/cleanup, password) and api (cookie flow, middleware, validation, providers). Verified end-to-end via curl: register -> me -> restart -> session persists -> logout -> 401. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
100 lines
4.0 KiB
Markdown
100 lines
4.0 KiB
Markdown
# pansy
|
|
|
|
Self-hostable garden planner: drag beds, bags, and containers onto a real-scale field, click into them to place freeform plops of plants, and zoom out to see what's planted where. Go backend + React frontend, one static binary.
|
|
|
|
See [DESIGN.md](DESIGN.md) for the architecture. Work is tracked in this repo's issues — start from the tracking epic.
|
|
|
|
## Quickstart
|
|
|
|
**Prerequisites:** Go 1.26+, Node 20+.
|
|
|
|
### Develop
|
|
|
|
Run the Go API and the Vite dev server together (Vite proxies `/api` → the API):
|
|
|
|
```sh
|
|
make dev
|
|
```
|
|
|
|
Then open http://localhost:5173. Or run the two halves in separate terminals for independent restarts:
|
|
|
|
```sh
|
|
make dev-api # Go API on :8080
|
|
make dev-web # Vite dev server on :5173
|
|
```
|
|
|
|
### Build & run
|
|
|
|
Produce the single static binary with the web build embedded, then run it:
|
|
|
|
```sh
|
|
make build
|
|
./pansy
|
|
```
|
|
|
|
Open http://localhost:8080 — one process serves both the JSON API and the app.
|
|
|
|
### Test
|
|
|
|
```sh
|
|
make test
|
|
```
|
|
|
|
## Configuration
|
|
|
|
All configuration is via environment variables; every value has a default, so `./pansy` runs with none set.
|
|
|
|
| Variable | Default | Description |
|
|
| ------------------------- | ------------------ | ------------------------------------------------------------------ |
|
|
| `PANSY_PORT` | `8080` | TCP port the HTTP server listens on. |
|
|
| `PANSY_DB` | `./pansy.db` | SQLite database file path (created if absent). |
|
|
| `PANSY_BASE_URL` | *(empty)* | Externally-visible base URL; used to derive the OIDC redirect URI. |
|
|
| `PANSY_REGISTRATION` | `open` | `open` or `closed` — gates local self-service signup. |
|
|
| `PANSY_LOCAL_AUTH` | `true` | Enable local password auth. Set `false` for pure-OIDC. |
|
|
| `PANSY_OIDC_ISSUER` | *(empty)* | OIDC issuer/discovery URL (Authentik). Enables SSO when set. |
|
|
| `PANSY_OIDC_CLIENT_ID` | *(empty)* | OIDC client ID. |
|
|
| `PANSY_OIDC_CLIENT_SECRET`| *(empty)* | OIDC client secret. |
|
|
| `PANSY_OIDC_BUTTON_LABEL` | `Sign in with SSO` | Label for the OIDC button on the login page. |
|
|
| `PANSY_TRUSTED_PROXIES` | *(none)* | Comma-separated proxy CIDRs/IPs to trust for client-IP resolution. |
|
|
|
|
Local email/password auth is live (`POST /api/v1/auth/register`, `/auth/login`, `/auth/logout`, `GET /auth/me`, `GET /auth/providers`); the session is an HttpOnly cookie (`Secure` when `PANSY_BASE_URL` is https). The first account registered becomes admin, and it may register even when `PANSY_REGISTRATION=closed` to bootstrap the instance. OIDC (`PANSY_OIDC_*`) lands in #5.
|
|
|
|
## Docker & deployment
|
|
|
|
CI (`.gitea/workflows/build-image.yml`) builds the single-binary image and pushes it to the Gitea registry on every branch push:
|
|
|
|
| Ref | Tag |
|
|
| --- | --- |
|
|
| `main` | `gitea.stevedudenhoeffer.com/steve/pansy:latest` |
|
|
| any other branch | `gitea.stevedudenhoeffer.com/steve/pansy:<branch-name>` |
|
|
| every build | `gitea.stevedudenhoeffer.com/steve/pansy:sha-<short>` (immutable; use to pin) |
|
|
|
|
The image runs as a non-root user, serves on `:8080`, and stores the SQLite database on the `/data` volume. Run it directly:
|
|
|
|
```sh
|
|
docker run -d --name pansy \
|
|
-p 8080:8080 \
|
|
-v pansy-data:/data \
|
|
gitea.stevedudenhoeffer.com/steve/pansy:latest
|
|
```
|
|
|
|
Or as a Komodo/Compose stack:
|
|
|
|
```yaml
|
|
services:
|
|
pansy:
|
|
image: gitea.stevedudenhoeffer.com/steve/pansy:${PANSY_TAG:-latest}
|
|
ports:
|
|
- "8080:8080"
|
|
volumes:
|
|
- pansy-data:/data
|
|
environment:
|
|
PANSY_BASE_URL: https://pansy.example.com
|
|
# PANSY_OIDC_ISSUER: ... # once auth (#5) lands
|
|
restart: unless-stopped
|
|
volumes:
|
|
pansy-data:
|
|
```
|
|
|
|
Pin `PANSY_TAG` to a `sha-<short>` tag for reproducible deploys, or leave it at `latest` to track `main`.
|