codegirl007
59513ab75e
Replace username-based admin bootstrap with a one-time setup secret, rate-limit login/register, equalize login bcrypt timing, cap passwords at 72 bytes, destroy sessions on logout, and require Secure cookies when PORT is set.
31 lines
1.7 KiB
Markdown
31 lines
1.7 KiB
Markdown
# Plumber — follow-ups
|
|
|
|
From the project review. Priority order within each section.
|
|
|
|
## Done recently
|
|
|
|
- [x] **Persist sessions** — Custom sqlc-backed `SessionStore` (scs API kept; no `postgresstore`).
|
|
- [x] **Drop Dockerfile** — DigitalOcean App Platform buildpack from `go.mod`.
|
|
- [x] **Rune-safe truncation** — Form fields truncate by runes.
|
|
- [x] **Admin bootstrap** — One-time `ADMIN_SETUP_SECRET` on register (not username alone); `/admin/users` for promote/demote.
|
|
- [x] **Graceful shutdown** — Signal-aware `http.Server.Shutdown` with timeouts.
|
|
- [x] **Handler tests** — Vote HTMX, answer/hide, CSRF, session rotation via in-memory `Store` (no Postgres for web suite).
|
|
- [x] **App Platform listen port** — Prefers `PORT`, then `LISTEN`, then `:8080`.
|
|
- [x] **Prod DB = PlanetScale Postgres** — Required `DATABASE_URL`; DSN cleanup for PlanetScale/libpq-only params.
|
|
- [x] **Auth hardening** — Rate limits, timing-safe login, password ≤72 bytes, logout destroys session, Secure cookies required when `PORT` is set.
|
|
|
|
## Docs & ops
|
|
|
|
- [ ] **README** — How to run locally, env vars (from `.env.example`), admin bootstrap, PlanetScale `DATABASE_URL`, App Platform notes (`PORT`, `SECURE_COOKIE=1`).
|
|
- [ ] **Migrations story** — Schema is applied on boot from `schema.sql`. OK for v1; plan real migrations before schema drifts.
|
|
|
|
## Smaller / later
|
|
|
|
- [ ] Cursor pagination UI when hunt/profile lists hit their row limits.
|
|
- [ ] Optional Postgres integration tests (`TEST_DATABASE_URL`) for sqlc SessionStore / advisory locks.
|
|
|
|
## Suggested order of attack
|
|
|
|
1. Short README (run, env, admin setup secret, App Platform + PlanetScale).
|
|
2. Migrations plan before the next schema change.
|