75293f39bc
- Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos - Migration 002_identity: identity_users + identity_sessions (token hash only) - Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL - Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax - LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown - Anti-enumeration: identical generic 401 + dummy-hash timing equalization - buildApp gains optional pool/cookieSecure; foundation-only app preserved - 47 unit + 14 integration tests; live smoke covers all acceptance criteria
38 lines
2.1 KiB
JSON
38 lines
2.1 KiB
JSON
{
|
|
"feature_id": "F-005",
|
|
"agent": "leader",
|
|
"verdict": "APPROVED",
|
|
"summary": "F-005 closed. First real business module: identity is hexagonal end-to-end, the server is the only authority for who calls the API, and brute force, enumeration and session theft are all handled server-side. All gates APPROVED, verify.sh exit 0.",
|
|
"gates": {
|
|
"reviewer": "APPROVED (reviewer.json)",
|
|
"security": "APPROVED (security.json)",
|
|
"qa": "APPROVED (qa.json)",
|
|
"verify_sh": "exit 0"
|
|
},
|
|
"deliverables": [
|
|
"migrations/002_identity.js (identity_users + identity_sessions, reversible, token_hash UNIQUE)",
|
|
"src/modules/identity hexagonal: domain ports, use cases (register/login/logout), argon2id hasher, pg repos, routes",
|
|
"Opaque 512-bit session tokens; DB persists only SHA-256 hashes; 7-day TTL enforced in SQL",
|
|
"LoginRateLimiter interface + in-memory impl: 10 failures -> 429 + Retry-After, 15-min cooldown, reset on success",
|
|
"Anti-enumeration: identical generic 401 + dummy-hash timing equalization",
|
|
"buildApp(pool, cookieSecure) wiring; foundation-only app preserved without pool",
|
|
"47 unit + 14 integration tests; live curl smoke for every acceptance criterion",
|
|
"README Authentication section, spec/tech.md dependency justification, .env.example COOKIE_SECURE"
|
|
],
|
|
"process_notes": [
|
|
"Review gate caught missing COOKIE_SECURE test coverage; bounced to build, fixed, re-verified — gate earned its keep.",
|
|
"Adding migration 002 broke the F-002 single-step rollback test by design; updated to full revert (count:0) asserting both module tables and baseline disappear."
|
|
],
|
|
"next_feature_hint": "F-006 users/profile/RBAC builds directly on identity_users and the session model -> recommended next",
|
|
"evidence": [
|
|
"work/artifacts/F-005/architect.md",
|
|
"work/artifacts/F-005/implementer.md",
|
|
"work/artifacts/F-005/reviewer.json",
|
|
"work/artifacts/F-005/security.json",
|
|
"work/artifacts/F-005/qa.json",
|
|
"work/artifacts/F-005/documenter.md",
|
|
"./scripts/verify.sh exit 0 at close"
|
|
],
|
|
"timestamp": "2026-08-14T21:15:00Z"
|
|
}
|