Prisma models per data-model.md: users (status enum, site-admin flag),
user_identities (password provider now, OIDC later — subject is the
stable user id), sessions (hashed ids), auth_tokens (hashed, single-
use), plus rate_limits and mail_outbox for the upcoming M1 stories.
UsersService creates accounts transactionally with Argon2id-hashed
password identities (OWASP parameters, rehash detection) and maps
uniqueness violations to field-level conflicts. Database-backed suites
run when TEST_DATABASE_URL is set — locally against the dev db, in CI
via a new postgres service container; shared auth schemas (username,
password policy incl. common-password blocklist) ship with tests.
Closes#10
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
pnpm/action-setup reads the version from package.json packageManager —
the explicit `version: 11` input made it fail on the mismatch. The
registry login now strips whitespace from the stored token before
docker login (the secret carried a trailing newline).
Part of #8
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
On every push to main: build both images once (SHA + moving `test`
tag), push to the Gitea registry, SSH-deploy the Test stage, wait for
readiness, run the new Playwright smoke suite (SPA shell, web
liveness, api healthz/readyz) against https://test.dorfteich.cloud,
and on green retag the identical SHA images as `int` and deploy Int.
The CI image-build job becomes PR-only to avoid double builds on main.
Part of #8
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Gitea Actions workflow running on every PR and push to main: pnpm
install with caching, workspace build, ESLint+Prettier, tsc, Vitest,
translation key parity, and docker builds of both images (build-only —
pushing is the CD workflow's job). Live verification of the red/green
PR gate follows once the act_runner from issue #9 is registered;
issue #7 stays open until then.
Part of #7
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
