75293f39bc
- Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos - Migration 002_identity: identity_users + identity_sessions (token hash only) - Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL - Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax - LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown - Anti-enumeration: identical generic 401 + dummy-hash timing equalization - buildApp gains optional pool/cookieSecure; foundation-only app preserved - 47 unit + 14 integration tests; live smoke covers all acceptance criteria
1.4 KiB
1.4 KiB
TESTS — F-005 Identity: register, login, sessions
Unit — src/modules/identity/tests/login-rate-limiter.test.ts
- Allows attempts below threshold; records failures
- Blocks with retryAfterMs after 10 consecutive failures (AC4 logic)
- Success resets the counter
- Cooldown expiry re-allows attempts
Unit — src/modules/identity/tests/session-token.test.ts
- Tokens are unique and URL-safe
- hashSessionToken is deterministic sha256 hex and never equals the raw token
Integration — src/app/tests/identity.itest.ts (real PostgreSQL, fresh DB per run)
- register: 201 + body {id, email, createdAt}; DB row stores
argon2idhash; plaintext password appears nowhere in the row (AC3) - register duplicate email: 409 EMAIL_ALREADY_REGISTERED
- register invalid payload: 400 VALIDATION_ERROR
- login valid: 200 + mdv_session cookie with HttpOnly; SameSite=Lax; Secure; Max-Age (AC1, AC5)
- login wrong password: 401 INVALID_CREDENTIALS; unknown email returns byte-identical error body (AC2)
- rate limit: 10 failed logins then next attempt -> 429 TOO_MANY_ATTEMPTS + Retry-After header (AC4)
- logout: 204 + cookie cleared; session row revoked; second logout still 204 (idempotent)
- buildApp without pool: /auth/login is 404 (foundation-only app preserved)
QA live
- register/login/logout over HTTP with curl; cookie flags visible in Set-Cookie
- verify.sh green (AC6)