rikrdo/mercadodevida
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
22ad15325f7a601dc37a775a3faa1ecb9ad6da82
mercadodevida/work/artifacts/F-005/documenter.md
rikrdo 75293f39bc feat(identity): F-005 register/login/logout with argon2 sessions and rate limiting 
- Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos
- Migration 002_identity: identity_users + identity_sessions (token hash only)
- Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL
- Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax
- LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown
- Anti-enumeration: identical generic 401 + dummy-hash timing equalization
- buildApp gains optional pool/cookieSecure; foundation-only app preserved
- 47 unit + 14 integration tests; live smoke covers all acceptance criteria
2026-08-14 22:58:32 +02:00

1.0 KiB
Raw Blame History

Documenter — F-005 Identity: register, login, sessions

done -> work/artifacts/F-005/documenter.md

Docs updated

  • project/README.md:
    • Configuration: COOKIE_SECURE documented (default true).
    • HTTP contract: auth error codes (INVALID_CREDENTIALS 401, EMAIL_ALREADY_REGISTERED 409, TOO_MANY_ATTEMPTS 429 + Retry-After).
    • New "Authentication (identity module)" section: endpoints table, argon2id, opaque-token sessions (DB stores only SHA-256 hash), cookie flags, anti-enumeration + rate-limit behavior, pool-gated wiring.
    • Layout: modules list now shows health/flags/identity; infrastructure mentions db pool + config + logging; shared mentions input parsing.
  • spec/tech.md: argon2 + @fastify/cookie justified (F-005 row).
  • project/.env.example: COOKIE_SECURE=false with local-dev comment.

Specs (source of truth for this ticket)

  • specs/F-005-identity/SPEC.md, DESIGN.md, TASKS.md, TESTS.md

Evidence trail

  • work/artifacts/F-005/: architect.md, implementer.md, reviewer.json, security.json, qa.json