Implement owner setup and browser authentication sessions
This commit is contained in:
parent
077cf7601a
commit
715423ab8e
21 changed files with 2185 additions and 14 deletions
|
|
@ -6,7 +6,7 @@ The approved product and architecture baseline is [`Drive_v2_final_plan.md`](Dri
|
|||
|
||||
## Repository status
|
||||
|
||||
Phase 0 established the repository, module boundaries, contracts, development environment, and CI. Phase 1 is underway with embedded forward-only migrations, the core persistence schema, generated PostgreSQL queries, database-backed readiness, and persistent setup status. Product endpoints are not implemented yet.
|
||||
Phase 0 established the repository, module boundaries, contracts, development environment, and CI. Phase 1 now includes embedded forward-only migrations, the core persistence schema, atomic single-owner setup, recovery-code generation, Argon2id password hashing, revocable browser sessions, CSRF-protected logout, database-backed readiness, and persistent setup status. File-product endpoints are not implemented yet.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
|
|
@ -25,6 +25,8 @@ Docker is the canonical environment when local toolchains are unavailable.
|
|||
|
||||
Do not expose an uninitialized production instance through Nginx Proxy Manager. The approved open setup flow must be completed first.
|
||||
|
||||
Browser authentication cookies are deliberately `Secure` and use the `__Host-` prefix. Setup and login therefore require HTTPS through Nginx Proxy Manager; direct HTTP remains suitable for health checks and the development shell only.
|
||||
|
||||
## Development
|
||||
|
||||
- `go test ./cmd/... ./internal/...` runs backend tests.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue