rikrdo/mercadodevida
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(identity): F-005 register/login/logout with argon2 sessions and rate limiting

Browse Source 
- Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos
- Migration 002_identity: identity_users + identity_sessions (token hash only)
- Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL
- Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax
- LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown
- Anti-enumeration: identical generic 401 + dummy-hash timing equalization
- buildApp gains optional pool/cookieSecure; foundation-only app preserved
- 47 unit + 14 integration tests; live smoke covers all acceptance criteria
This commit is contained in:
rikrdo
2026-08-14 22:58:32 +02:00
parent 4851692031
commit 75293f39bc
46 changed files with 1734 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
work/current.md
View File

@@ -1,17 +1,16 @@
# Sesión actual
# Current work
- Feature en curso: _ninguna_ (F-004 cerrada DONE el 2026-08-14)
- Inicio: —
- Orquestador: —
- Active feature: none (idle)
- Last closed: F-005 — Identity: register, login, sessions
- Next suggested: F-006 — Users: profile, addresses, RBAC (depends on F-005, satisfied)
- Runtime status: reset via scripts/agent_status.py
- verify.sh: green at close
## Plan
- Hechas: F-001, F-002, F-003, F-004.
- Desbloqueada: F-005 (identity & auth core) — depende de F-002+F-003, ambas done. Config/flags (F-004) ya listos para secrets y guards.
- Sugerencia de orden: F-005 ahora.
## Bitácora
- 2026-08-14: F-001..F-004 DONE; todos los gates APPROVED; verify.sh verde.
- Dev PostgreSQL + Redis siguen corriendo (mdv-dev-postgres, mdv-dev-redis).
## Próximo paso
- intake de F-005 (identity & auth core).
## F-005 closure notes
- Identity module hexagonal: domain/application/infrastructure/api under src/modules/identity
- Sessions server-side: cookie carries opaque 512-bit token; identity_sessions stores only SHA-256 hash
- argon2id (OWASP params) behind PasswordHasher port; timing equalized 401 (no enumeration)
- Rate limit: 10 consecutive failures per email -> 429 + Retry-After (15 min cooldown), in-memory behind interface
- Cookie: HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax
- Migration 002_identity reversible; integration suite updated for full revert (count:0)
- Gates: reviewer/security/qa APPROVED. Commits include specs, artifacts, code, docs.