Lucas WintherandClaude Opus 5.5
be04fab098
Captures the owner's requirements and decisions from the planning conversation, current branch/worktree state, open tasks 17-19, pending owner decisions and the controller's rulings so a new agent can resume. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
11 lines
1.2 KiB
Markdown
11 lines
1.2 KiB
Markdown
# Task 4 report
|
|
Built packages/core/src/auth.ts (registerUser, login, getSessionUser, logout, createInvite, createAppToken, verifyAppToken, revokeAppToken, User) and packages/core/test/auth.test.ts (8 tests per dialect).
|
|
TDD: RED = module not found (bun test packages/core/test/auth.test.ts). GREEN: SQLite 8 pass; Postgres 16 pass (both dialects); typecheck clean.
|
|
Notes: invite is claimed after user insert inside the tx (used_by FK to users); claim is an atomic UPDATE ... where used_by is null and unexpired. Unknown/expired/used invite -> invite_required. Hashes are sha256 hex. Invite code = 16 random bytes base64url. Uses Uint8Array.toBase64 (Bun 1.3).
|
|
Concerns: none. Login does no timing equalisation for unknown users.
|
|
|
|
## Fix round 1
|
|
- registerUser takes pg_advisory_xact_lock(727401) on Postgres at tx start (SQLite already serialised); concurrent first sign-ups give one admin, other gets invite_required.
|
|
- Invite check now precedes username_taken. login verifies against a lazily computed dummy argon2id hash for unknown users.
|
|
- New tests: concurrent registration, no-invite+taken username, hashes differ from plaintext, cross-user revoke. SQLite 12 pass; Postgres 24 pass (both dialects); typecheck clean.
|