Implement owner setup and browser authentication sessions
Some checks failed
CI / Backend (push) Failing after 1s
CI / Frontend (push) Successful in 13s
CI / Contracts and repository policy (push) Failing after 3s
CI / Container (push) Has been skipped

This commit is contained in:
Elijah 2026-07-16 19:45:40 -07:00
parent 077cf7601a
commit 715423ab8e
21 changed files with 2185 additions and 14 deletions

View file

@ -6,7 +6,7 @@ The approved product and architecture baseline is [`Drive_v2_final_plan.md`](Dri
## Repository status
Phase 0 established the repository, module boundaries, contracts, development environment, and CI. Phase 1 is underway with embedded forward-only migrations, the core persistence schema, generated PostgreSQL queries, database-backed readiness, and persistent setup status. Product endpoints are not implemented yet.
Phase 0 established the repository, module boundaries, contracts, development environment, and CI. Phase 1 now includes embedded forward-only migrations, the core persistence schema, atomic single-owner setup, recovery-code generation, Argon2id password hashing, revocable browser sessions, CSRF-protected logout, database-backed readiness, and persistent setup status. File-product endpoints are not implemented yet.
## Prerequisites
@ -25,6 +25,8 @@ Docker is the canonical environment when local toolchains are unavailable.
Do not expose an uninitialized production instance through Nginx Proxy Manager. The approved open setup flow must be completed first.
Browser authentication cookies are deliberately `Secure` and use the `__Host-` prefix. Setup and login therefore require HTTPS through Nginx Proxy Manager; direct HTTP remains suitable for health checks and the development shell only.
## Development
- `go test ./cmd/... ./internal/...` runs backend tests.