Lucas WintherandClaude Opus 5.5
be04fab098
Captures the owner's requirements and decisions from the planning conversation, current branch/worktree state, open tasks 17-19, pending owner decisions and the controller's rulings so a new agent can resume. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.2 KiB
1.2 KiB
Task 4 report
Built packages/core/src/auth.ts (registerUser, login, getSessionUser, logout, createInvite, createAppToken, verifyAppToken, revokeAppToken, User) and packages/core/test/auth.test.ts (8 tests per dialect). TDD: RED = module not found (bun test packages/core/test/auth.test.ts). GREEN: SQLite 8 pass; Postgres 16 pass (both dialects); typecheck clean. Notes: invite is claimed after user insert inside the tx (used_by FK to users); claim is an atomic UPDATE ... where used_by is null and unexpired. Unknown/expired/used invite -> invite_required. Hashes are sha256 hex. Invite code = 16 random bytes base64url. Uses Uint8Array.toBase64 (Bun 1.3). Concerns: none. Login does no timing equalisation for unknown users.
Fix round 1
- registerUser takes pg_advisory_xact_lock(727401) on Postgres at tx start (SQLite already serialised); concurrent first sign-ups give one admin, other gets invite_required.
- Invite check now precedes username_taken. login verifies against a lazily computed dummy argon2id hash for unknown users.
- New tests: concurrent registration, no-invite+taken username, hashes differ from plaintext, cross-user revoke. SQLite 12 pass; Postgres 24 pass (both dialects); typecheck clean.