You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
28 lines
1.9 KiB
Markdown
28 lines
1.9 KiB
Markdown
---
|
|
# pages-zd46
|
|
title: GitHub OAuth, sessions, auth middleware
|
|
status: completed
|
|
type: feature
|
|
priority: normal
|
|
created_at: 2026-07-13T02:09:08Z
|
|
updated_at: 2026-07-13T16:29:44Z
|
|
parent: pages-77lk
|
|
blocked_by:
|
|
- pages-jgc4
|
|
---
|
|
|
|
Implement design doc §2.4 + §4.1 auth rows. src/auth.rs: pure helpers compiled on both targets — random 32-byte hex token gen (getrandom), sha256 hex (add sha2 crate, works on wasm), cookie header building/parsing (__Host-session HttpOnly Secure SameSite=Lax Path=/ Max-Age 30d; state cookie 10min), GitHub authorize URL builder — all native-tested. src/routes/auth.rs (wasm-only): GET /auth/login (state cookie + redirect), GET /auth/callback (verify state, exchange code via worker Fetch to github.com with Accept: application/json + User-Agent header, fetch /user, upsert user via db.rs, create session, redirect /), POST /auth/logout (delete session, clear cookie). Request extension/helper current_user(env, req) for other routes. Wire routes into lib.rs router.
|
|
|
|
- [x] auth.rs pure helpers + native tests (cookie parse/build, authorize URL, token/hash)
|
|
- [x] routes/auth.rs OAuth flow
|
|
- [x] current_user session resolution helper
|
|
- [x] full validation suite passes
|
|
|
|
## Summary of Changes
|
|
|
|
GitHub OAuth + sessions by a Sonnet agent (resumed once after a session-limit interruption; #[worker::send] fixed the axum Send bound). Opus security review: APPROVE.
|
|
- src/auth.rs: token gen (getrandom), sha256_hex, __Host- cookie build/parse (zero-alloc), authorize URL with hand-rolled percent-encoding, hand-implemented civil_from_days expiry formatting — 38 new unit tests + 9 doctests.
|
|
- src/routes/{mod,auth}.rs: login/callback/logout, state-cookie CSRF binding, hashed session storage, generic 502s (no secret leakage), current_user helper. AppState (Db + Config) via with_state.
|
|
- Review fix applied: admin login comparison now eq_ignore_ascii_case (GitHub logins are case-insensitive).
|
|
110 unit tests + 14 doctests green; both targets clippy-clean.
|