Phase 2: Built-in Authentication #1

New issue

Closed

opened 2026-02-02 19:58:44 +01:00 by qwc · 0 comments

qwc commented

2026-02-02 19:58:44 +01:00

Owner

Session management (DB-backed, cookie-based), user/session stores, bcrypt auth, login/logout handlers, session middleware, initial admin creation on first run, user info in navbar.

Tests needed:

Unit: bcrypt password hashing/verification, session token generation, session expiry logic
Unit: UserStore CRUD, SessionStore create/get/delete against SQLite
Unit: session middleware (valid cookie → user in context, expired/missing → redirect)
Integration: full login flow via httptest
Integration: protected route returns 302 to /login without session

Session management (DB-backed, cookie-based), user/session stores, bcrypt auth, login/logout handlers, session middleware, initial admin creation on first run, user info in navbar. **Tests needed:** - Unit: bcrypt password hashing/verification, session token generation, session expiry logic - Unit: UserStore CRUD, SessionStore create/get/delete against SQLite - Unit: session middleware (valid cookie → user in context, expired/missing → redirect) - Integration: full login flow via httptest - Integration: protected route returns 302 to /login without session

qwc referenced this issue from a commit

2026-02-02 20:01:50 +01:00

Phase 2: Built-in Authentication - comprehensive test coverage

qwc closed this issue

2026-02-02 20:01:50 +01:00

qwc referenced this issue from a commit

2026-05-18 15:47:09 +02:00

Add internal/validation; reject path-unsafe slugs, version tags, and Content-Disposition values

qwc referenced this issue

2026-05-18 15:47:23 +02:00

Validate slugs, version tags, and Content-Disposition at all boundaries (C-1, M-5, M-8) #96

qwc referenced this issue from a commit