User, identity, and session data model #10

New Issue

fable-5 · 2026-07-04T14:52:00+02:00

fable-5 commented

2026-07-04 14:52:00 +02:00

Context

Foundation for all authentication stories: accounts are separated from login methods to stay OIDC-ready (ADR 0007).

Scope

Add Prisma models + migration for users, user_identities, sessions, auth_tokens exactly as specified in data-model.md, plus a UsersModule with an internal service layer (create user with Argon2id-hashed password identity, find by username/email, update profile). No HTTP endpoints yet.

Acceptance criteria

migration applies cleanly on a database containing M0 state
unit tests cover: unique username/email enforcement, Argon2id hash+verify roundtrip, identity uniqueness per (provider, subject)
Argon2id parameters are named constants with a comment explaining the chosen cost

Technical notes

ADR 0007, data-model.md §Identity.
Use the argon2 npm package; never log or return hashes.

Dependencies

Depends on #3.

Size: ~1 day

Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add de and en), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.

## Context Foundation for all authentication stories: accounts are separated from login methods to stay OIDC-ready (ADR 0007). ## Scope Add Prisma models + migration for `users`, `user_identities`, `sessions`, `auth_tokens` exactly as specified in data-model.md, plus a `UsersModule` with an internal service layer (create user with Argon2id-hashed password identity, find by username/email, update profile). No HTTP endpoints yet. ## Acceptance criteria - [ ] migration applies cleanly on a database containing M0 state - [ ] unit tests cover: unique username/email enforcement, Argon2id hash+verify roundtrip, identity uniqueness per (provider, subject) - [ ] Argon2id parameters are named constants with a comment explaining the chosen cost ## Technical notes - ADR 0007, data-model.md §Identity. - Use the `argon2` npm package; never log or return hashes. ## Dependencies Depends on #3. **Size**: ~1 day --- *Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add `de` **and** `en`), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.*

fable-5 added this to the M1 — Accounts & authentication milestone 2026-07-04 14:52:00 +02:00

fable-5 added the

auth

backend

labels 2026-07-04 14:52:00 +02:00

fable-5 referenced this issue

2026-07-04 14:52:02 +02:00

Signup endpoint with e-mail verification flow #13

fable-5 referenced this issue

2026-07-04 14:52:02 +02:00

Login, logout, and session guard #14

fable-5 referenced this issue from a commit