Refactor auth phased - #1
Merged
Merged
Conversation
Changes made in this commit: - Added: docs/plans/auth-refactor.md Key changes: - Define target session model with opaque refresh and DB sessions - Document API contract, role matrix, and two-cookie policy - List phased migration steps with file lists and acceptance criteria
Changes made in this commit: - Modified: cmd/piplos/main.go, internal/config/config.go, internal/handlers/auth.go, internal/handlers/users.go, internal/middleware/middleware.go, internal/models/models.go, internal/server/routes.go, internal/server/routes_auth_test.go, internal/services/auth/auth.go - Added: internal/auth/permissions.go, internal/handlers/auth_test.go, internal/middleware/middleware_test.go, internal/middleware/session_checker.go, internal/repository/sessions.go, internal/services/auth/auth_test.go, migrations/012_refresh_sessions.sql - Deleted: internal/middleware/user_lookup.go Key changes: - Store opaque refresh tokens in refresh_sessions with rotation - Link access JWT claims to session sid for revocation checks - Add POST /auth/logout and shared permissions matrix - Validate sessions in middleware without per-request user lookups
Changes made in this commit: - Modified: web/admin/src/app.d.ts, web/admin/src/hooks.server.ts, web/admin/src/lib/api.server.ts, web/admin/src/lib/auth.server.ts, web/admin/src/routes/(auth)/+layout.server.ts, web/admin/src/routes/(auth)/+layout.svelte, web/admin/src/routes/login/+page.server.ts, web/admin/src/routes/logout/+page.server.ts - Added: web/admin/src/lib/permissions.ts Key changes: - Remove admin_user cookie and load profile via /v1/auth/me - Centralize token refresh in ensureValidSession - Align route guards with backend permissions matrix
Changes made in this commit: - Modified: internal/handlers/auth_test.go, internal/server/routes_auth_test.go, internal/services/auth/auth_test.go, web/admin/package.json - Added: internal/auth/permissions_test.go, web/admin/package-lock.json, web/admin/src/lib/api.server.test.ts, web/admin/src/lib/auth.server.test.ts, web/admin/src/lib/permissions.test.ts, web/admin/vitest.config.ts Key changes: - Cover login, refresh, inactive user, and full auth flow in route tests - Add permissions matrix drift tests on backend - Add vitest suite for ensureValidSession, token expiry, and UI guards
Changes made in this commit: - Modified: web/admin/package.json, web/admin/bun.lock Key changes: - Add @internationalized/date required by bits-ui at dev server startup
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.