Login, logout, and session guard #14

New Issue

fable-5 · 2026-07-04T14:52:02+02:00

fable-5 commented

2026-07-04 14:52:02 +02:00

Context

Server-side sessions with HttpOnly cookies are the only browser auth mechanism (ADR 0007).

Scope

Endpoints: POST /auth/login (username-or-email + password; verifies Argon2id; creates session row; sets opaque HttpOnly; Secure; SameSite=Lax cookie; sliding 30-day expiry), POST /auth/logout (deletes session), GET /auth/me (current user profile). Implement the global AuthGuard (attaches user to request; routes opt out via @Public()), login rate limiting (10/min/IP) and per-account backoff on repeated failures. CSRF: enforce Origin/Referer check on mutating requests.

Acceptance criteria

login sets the cookie; /auth/me returns the profile; logout invalidates immediately (subsequent request 401)
session ids are stored hashed; cookie value never appears in logs
wrong password and unknown user return the same generic localized error
backoff kicks in after repeated failures for one account (unit test with fake timer)
e2e: login → me → logout → 401

Technical notes

ADR 0007, security.md (CSRF, session rules).
Sliding expiry: refresh expires_at at most once per hour to avoid write storms.

Dependencies

Depends on #10, #11.

Size: ~1.5 days

Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add de and en), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.

## Context Server-side sessions with HttpOnly cookies are the only browser auth mechanism (ADR 0007). ## Scope Endpoints: `POST /auth/login` (username-or-email + password; verifies Argon2id; creates session row; sets opaque `HttpOnly; Secure; SameSite=Lax` cookie; sliding 30-day expiry), `POST /auth/logout` (deletes session), `GET /auth/me` (current user profile). Implement the global `AuthGuard` (attaches user to request; routes opt out via `@Public()`), login rate limiting (10/min/IP) and per-account backoff on repeated failures. CSRF: enforce Origin/Referer check on mutating requests. ## Acceptance criteria - [ ] login sets the cookie; `/auth/me` returns the profile; logout invalidates immediately (subsequent request 401) - [ ] session ids are stored hashed; cookie value never appears in logs - [ ] wrong password and unknown user return the same generic localized error - [ ] backoff kicks in after repeated failures for one account (unit test with fake timer) - [ ] e2e: login → me → logout → 401 ## Technical notes - ADR 0007, security.md (CSRF, session rules). - Sliding expiry: refresh `expires_at` at most once per hour to avoid write storms. ## Dependencies Depends on #10, #11. **Size**: ~1.5 days --- *Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add `de` **and** `en`), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.*

fable-5 added this to the M1 — Accounts & authentication milestone 2026-07-04 14:52:02 +02:00

fable-5 added the

auth

backend

labels 2026-07-04 14:52:02 +02:00

fable-5 referenced this issue

2026-07-04 14:52:03 +02:00

Password reset flow #15

fable-5 referenced this issue

2026-07-04 14:52:04 +02:00

Auth pages in the SPA (signup, verify, login, reset) #16

fable-5 referenced this issue