etalon
c1cc781279
- argon2id (t=3, m=64MiB, p=2) PHC hashing honoring embedded params - token-bucket rate limiting (10/15min per IP+email) on login/register - opaque 32B session tokens in Mongo, 30-day sliding expiry, logout-all - CSRF double-submit cookie/header on authenticated mutations - bootstrap admin from env with forced first-login password change - requireAuth/requireRole middleware with disabled-account enforcement - OIDC code flow with PKCE: lazy discovery, account linking only on verified email, auto-created developer accounts - unit tests (RBAC matrix, CSRF, password, rate limiter) + integration suite covering the full auth matrix incl. an in-test fake IdP Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
68 lines
1.3 KiB
Go
68 lines
1.3 KiB
Go
// Command app is the Bounty Board main service.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"log/slog"
|
|
"os"
|
|
"os/signal"
|
|
"syscall"
|
|
"time"
|
|
|
|
"bountyboard/internal/auth"
|
|
"bountyboard/internal/config"
|
|
httpx "bountyboard/internal/http"
|
|
"bountyboard/internal/metrics"
|
|
"bountyboard/internal/store"
|
|
)
|
|
|
|
func main() {
|
|
if err := run(); err != nil {
|
|
fmt.Fprintln(os.Stderr, "fatal:", err)
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
|
|
func run() error {
|
|
if err := config.LoadDotEnv(".env"); err != nil {
|
|
return fmt.Errorf("load .env: %w", err)
|
|
}
|
|
cfg, err := config.Load()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
log := slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
|
|
slog.SetDefault(log)
|
|
|
|
ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
|
|
defer stop()
|
|
|
|
st, err := store.Connect(ctx, cfg, log)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer func() {
|
|
closeCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
if err := st.Close(closeCtx); err != nil {
|
|
log.Error("close mongo", "err", err)
|
|
}
|
|
}()
|
|
|
|
if err := auth.EnsureBootstrapAdmin(ctx, st, cfg, log); err != nil {
|
|
return err
|
|
}
|
|
|
|
reg := metrics.NewRegistry()
|
|
srv := httpx.New(cfg, log, reg, st)
|
|
srv.AddReadinessCheck(httpx.ReadinessCheck{
|
|
Name: "mongo",
|
|
Required: true,
|
|
Probe: st.Ping,
|
|
})
|
|
|
|
return srv.Run(ctx)
|
|
}
|