Thirdshop/Kazier
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(api): identité user-first — login/password, ownership user, fin du token device

Browse Source 
- 000006 : users.username/username_normalized/password_hash/is_admin, index
  unique partiel sur username_normalized, DROP idx_users_email (unicité V1 =
  username, jamais email) ; 000007 destructif : resources.owner_id→user_id
  (FK→users, reset base dev), l'unicité racine devient par user
- pkg/passwd : argon2id (t=1,m=64MiB,p=4,k=32), comparaison constant-time,
  VerifyTimedEqual (délai égalisé dummy-hash) ; pkg/auth : subject=user_id +
  claim device_id, TTL 7 j sans refresh
- repository : Users (count/get/resolve-exact/create/update-password/
  mark-deleted), Devices.MarkUser (user_id INFORMATIF uniquement)
- handlers : POST /devices sans token, POST /auth/login (401 indistinguable
  user inconnu/mauvais mdp, device requis), PATCH /users/me/password
  (current_password, tokens non révoqués — limite V1), GET /users/resolve
  (exact lowercase, jamais email/is_admin) ; middleware RequireAuth
  (user authorisant, device porté) ; tout le scoping ressources passe user
- bootstrap admin : users vide + ADMIN_* absents → refus de démarrer ;
  .env.example ; docs/api-v1.md §2/§3/§7/§8
- tests : migrations 000006/000007 (up/down), pkg/auth Identity, handlers
  login/password/resolve, helpers refactorés registerAndLogin, repo tests
  scopés user — suite backend verte
This commit is contained in:
m
2026-09-10 21:21:36 +02:00
parent 197c7db8a9
commit c2c7dddba6
34 changed files with 1237 additions and 223 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/handlers/sync_test.go
+9 -9
View File
@@ -26,9 +26,9 @@ func op(operationID int64, resourceID, operation, resourceType string, payload m
}
func TestSyncOpsApplySequential(t *testing.T) {
r, _, _ := setup(t)
r, _, repo := setup(t)
device := repository.NewID()
token := registerDevice(t, r, device)
token, _ := registerAndLogin(t, r, repo, testUserUsername(device, "sa"), "sync-test-password", device)
folderID := repository.NewID()
fileID := repository.NewID()
@@ -78,9 +78,9 @@ func TestSyncOpsApplySequential(t *testing.T) {
}
func TestSyncOpsStopsAtFirstNonIdempotentFailure(t *testing.T) {
r, _, _ := setup(t)
r, _, repo := setup(t)
device := repository.NewID()
token := registerDevice(t, r, device)
token, _ := registerAndLogin(t, r, repo, testUserUsername(device, "sb"), "sync-test-password", device)
folderID := repository.NewID()
dupeID := repository.NewID()
@@ -126,10 +126,10 @@ func TestSyncOpsStopsAtFirstNonIdempotentFailure(t *testing.T) {
func TestSyncOpsDeleteIdempotent(t *testing.T) {
r, _, repo := setup(t)
device := repository.NewID()
token := registerDevice(t, r, device)
token, user := registerAndLogin(t, r, repo, testUserUsername(device, "sc"), "sync-test-password", device)
fileID := repository.NewID()
if err := repo.Resources.InsertFile(device, fileID, "x.txt", "", 1, nil, nil); err != nil {
if err := repo.Resources.InsertFile(user, fileID, "x.txt", "", 1, nil, nil); err != nil {
t.Fatalf("insert: %v", err)
}
@@ -155,10 +155,10 @@ func TestSyncOpsDeleteIdempotent(t *testing.T) {
func TestSnapshotPermissions(t *testing.T) {
r, _, repo := setup(t)
device := repository.NewID()
token := registerDevice(t, r, device)
token, user := registerAndLogin(t, r, repo, testUserUsername(device, "sd"), "sync-test-password", device)
folderID := repository.NewID()
if err := repo.Resources.InsertFolder(device, folderID, "Docs", ""); err != nil {
if err := repo.Resources.InsertFolder(user, folderID, "Docs", ""); err != nil {
t.Fatalf("insert folder: %v", err)
}
@@ -174,7 +174,7 @@ func TestSnapshotPermissions(t *testing.T) {
if err := json.Unmarshal(env.Data, &perms); err != nil {
t.Fatalf("snapshot: unmarshal: %v", err)
}
if len(perms) != 1 || perms[0].ResourceID != folderID || perms[0].EffectiveAccess != "owner" || perms[0].OwnerID != device {
if len(perms) != 1 || perms[0].ResourceID != folderID || perms[0].EffectiveAccess != "owner" || perms[0].OwnerID != user {
t.Errorf("snapshot: %+v", perms)
}
if perms[0].CachedAt == 0 {