75293f39bc
- Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos - Migration 002_identity: identity_users + identity_sessions (token hash only) - Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL - Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax - LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown - Anti-enumeration: identical generic 401 + dummy-hash timing equalization - buildApp gains optional pool/cookieSecure; foundation-only app preserved - 47 unit + 14 integration tests; live smoke covers all acceptance criteria
23 lines
1.0 KiB
Markdown
23 lines
1.0 KiB
Markdown
# Documenter — F-005 Identity: register, login, sessions
|
|
|
|
done -> work/artifacts/F-005/documenter.md
|
|
|
|
## Docs updated
|
|
- `project/README.md`:
|
|
- Configuration: `COOKIE_SECURE` documented (default true).
|
|
- HTTP contract: auth error codes (`INVALID_CREDENTIALS` 401,
|
|
`EMAIL_ALREADY_REGISTERED` 409, `TOO_MANY_ATTEMPTS` 429 + Retry-After).
|
|
- New "Authentication (identity module)" section: endpoints table, argon2id,
|
|
opaque-token sessions (DB stores only SHA-256 hash), cookie flags,
|
|
anti-enumeration + rate-limit behavior, pool-gated wiring.
|
|
- Layout: modules list now shows health/flags/identity; infrastructure mentions
|
|
db pool + config + logging; shared mentions input parsing.
|
|
- `spec/tech.md`: argon2 + @fastify/cookie justified (F-005 row).
|
|
- `project/.env.example`: `COOKIE_SECURE=false` with local-dev comment.
|
|
|
|
## Specs (source of truth for this ticket)
|
|
- specs/F-005-identity/SPEC.md, DESIGN.md, TASKS.md, TESTS.md
|
|
|
|
## Evidence trail
|
|
- work/artifacts/F-005/: architect.md, implementer.md, reviewer.json, security.json, qa.json
|