75293f39bc
- Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos - Migration 002_identity: identity_users + identity_sessions (token hash only) - Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL - Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax - LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown - Anti-enumeration: identical generic 401 + dummy-hash timing equalization - buildApp gains optional pool/cookieSecure; foundation-only app preserved - 47 unit + 14 integration tests; live smoke covers all acceptance criteria
957 B
957 B
TASKS — F-005 Identity: register, login, sessions
- TASK-001 deps: argon2 + @fastify/cookie; justify in spec/tech.md
- TASK-002 migrations/002_identity.js (identity_users + identity_sessions, reversible)
- TASK-003 domain: user.ts, session.ts, errors.ts, ports.ts
- TASK-004 application: register-user.ts, login.ts, logout.ts, login-rate-limiter.ts
- TASK-005 infrastructure: argon2 hasher, pg repos, session-token
- TASK-006 api: identity.routes.ts (zod via parseJson, error mapping, cookie)
- TASK-007 index.ts public API
- TASK-008 foundation wiring: pool.createPool(connectionString), config COOKIE_SECURE, buildApp(pool, cookieSecure), server.ts pool creation
- TASK-009 unit tests: rate limiter + session token (module-scoped)
- TASK-010 integration tests: full flows against real PostgreSQL (app-scoped itest)
- TASK-011 run lint + boundaries + typecheck + build + test + test:integration + verify.sh