OwnCord

mirror of https://github.com/J3vb/OwnCord.git synced 2026-09-03 03:50:00 +03:00

Files

T

jevb 7d03f59c2f feat: implement Phase 2 auth & security with TDD

- auth/session: 256-bit crypto-random tokens, SHA-256 hashing for storage
- auth/password: bcrypt cost 12, strength validation (8-72 chars)
- auth/ratelimit: sliding-window RateLimiter with lockout, thread-safe
- db/models: User, Session, Invite, Role types
- db/auth_queries: full user/session/invite CRUD with in-memory test coverage
- api/middleware: AuthMiddleware (Bearer token), RequirePermission (bitfield),
  RateLimitMiddleware (X-Real-IP, Retry-After header)
- api/auth_handler: POST register/login, POST logout, GET me
  - Generic errors — username existence never revealed
  - Rate limits: 3/min register, 5/min login, lockout after 10 failures
- api/invite_handler: create/list/revoke behind MANAGE_INVITES permission
- bluemonday sanitization on all user-supplied string fields

Test coverage: auth 90.9%, db 84.4%, api 80.9%

2026-03-14 20:52:11 +01:00

auth.go

feat: implement Phase 1 server skeleton with TDD

2026-03-14 20:34:37 +01:00

password_test.go

feat: implement Phase 2 auth & security with TDD

2026-03-14 20:52:11 +01:00

password.go

feat: implement Phase 2 auth & security with TDD

2026-03-14 20:52:11 +01:00

ratelimit_test.go

feat: implement Phase 2 auth & security with TDD