etalon
c1cc781279
- argon2id (t=3, m=64MiB, p=2) PHC hashing honoring embedded params - token-bucket rate limiting (10/15min per IP+email) on login/register - opaque 32B session tokens in Mongo, 30-day sliding expiry, logout-all - CSRF double-submit cookie/header on authenticated mutations - bootstrap admin from env with forced first-login password change - requireAuth/requireRole middleware with disabled-account enforcement - OIDC code flow with PKCE: lazy discovery, account linking only on verified email, auto-created developer accounts - unit tests (RBAC matrix, CSRF, password, rate limiter) + integration suite covering the full auth matrix incl. an in-test fake IdP Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
23 lines
617 B
Modula-2
23 lines
617 B
Modula-2
module bountyboard
|
|
|
|
go 1.26
|
|
|
|
require (
|
|
github.com/coreos/go-oidc/v3 v3.18.0
|
|
go.mongodb.org/mongo-driver/v2 v2.6.0
|
|
golang.org/x/crypto v0.53.0
|
|
golang.org/x/oauth2 v0.36.0
|
|
)
|
|
|
|
require (
|
|
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
|
|
github.com/klauspost/compress v1.17.6 // indirect
|
|
github.com/xdg-go/pbkdf2 v1.0.0 // indirect
|
|
github.com/xdg-go/scram v1.2.0 // indirect
|
|
github.com/xdg-go/stringprep v1.0.4 // indirect
|
|
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
|
|
golang.org/x/sync v0.21.0 // indirect
|
|
golang.org/x/sys v0.46.0 // indirect
|
|
golang.org/x/text v0.38.0 // indirect
|
|
)
|