Michael Czechowski
d9f3574913
internal/auth/ provides: - TokenStore: 32-byte cryptographically random one-time tokens. Only the SHA-256 hash is persisted (so a DB leak doesn't grant active sessions). Comparison uses subtle.ConstantTimeCompare. Single-use is enforced via UPDATE ... WHERE used_at IS NULL. - Signer: HS256 JWTs with 24h lifetime, jwt.WithValidMethods to reject alg=none and other downgrade attacks. - LogMailer (dev) and SMTPMailer (prod via net/smtp) behind a Mailer interface. - RateLimiter: DB-backed fixed window per email; default 5 per 15 min for the magic-link flow. - Service: orchestrates RequestLogin (auto-creates user on first login, generates token, emails magic link) and Verify (consumes token, updates last_login, issues JWT). - Handlers: POST /auth/login and GET/POST /auth/verify. HandleLogin returns 202 even on validation failure to avoid account enumeration; rate-limit hits surface as 429. Schema additions: magic_tokens (with FK + cascade) and login_attempts. UserStore.SetStoragePath added for completeness. Tests cover: token issue/consume, single-use, expiry, rate limit, JWT round-trip, alg=none rejection, signature tampering, purge, HTTP handlers (login + verify, missing/invalid token paths). Closes #9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
31 lines
1.0 KiB
Modula-2
31 lines
1.0 KiB
Modula-2
module git.librete.ch/public/librenotes
|
|
|
|
go 1.25.0
|
|
|
|
require (
|
|
github.com/google/uuid v1.6.0
|
|
github.com/junegunn/fzf v0.58.0
|
|
modernc.org/sqlite v1.50.0
|
|
)
|
|
|
|
require (
|
|
github.com/charlievieth/fastwalk v1.0.9 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/gdamore/encoding v1.0.1 // indirect
|
|
github.com/gdamore/tcell/v2 v2.8.1 // indirect
|
|
github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
|
|
github.com/junegunn/go-shellwords v0.0.0-20240813092932-a62c48c52e97 // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-runewidth v0.0.16 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
golang.org/x/sys v0.42.0 // indirect
|
|
golang.org/x/term v0.28.0 // indirect
|
|
golang.org/x/text v0.21.0 // indirect
|
|
modernc.org/libc v1.72.0 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
)
|