2 Commits

Author	SHA1	Message	Date
etalon	34bf5b5ac2	feat: base UI shell with themes, auth pages, profile, and role navigation (phase 4) ... - embedded Go templates + vanilla ES-module JS + hand-written CSS, no build step - exact §10 beige light / dark design tokens, square edges (radius 2px), system font stack, visible focus rings - theme toggle persisted to localStorage and the user profile - login/register/change-password pages wired to the auth API - profile page: avatar upload (image-sniffed, old file cleanup), bio, contacts, arbitrary extra key/value fields, optimistic-concurrency 409 - role-based top navigation with placeholders for later-phase areas - GET /files/{id} with scope-based access (session) or signed token (§5.1) - security headers incl. CSP without unsafe-inline scripts Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 18:39:38 +02:00
etalon	c1cc781279	feat: authentication with local accounts, sessions, CSRF, RBAC, and OIDC PKCE (phase 3) ... - argon2id (t=3, m=64MiB, p=2) PHC hashing honoring embedded params - token-bucket rate limiting (10/15min per IP+email) on login/register - opaque 32B session tokens in Mongo, 30-day sliding expiry, logout-all - CSRF double-submit cookie/header on authenticated mutations - bootstrap admin from env with forced first-login password change - requireAuth/requireRole middleware with disabled-account enforcement - OIDC code flow with PKCE: lazy discovery, account linking only on verified email, auto-created developer accounts - unit tests (RBAC matrix, CSRF, password, rate limiter) + integration suite covering the full auth matrix incl. an in-test fake IdP Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 18:31:25 +02:00