arthur/xtablo-source
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 5
xtablo-source/backend/go.mod

63 lines
2.8 KiB
Modula-2
Raw Permalink Normal View History

feat(01-01): initialize Go module and pin runtime dependencies - module: backend (go 1.26.1) - chi v5.2.5, templ v0.3.1020, pgx/v5 v5.9.2, goose v3.27.1, uuid v1.6.0 - pinned via 'go get'; 'go mod tidy' deferred to Plan 01-03 where consumers exist (Codex concern #1)
2026-05-14 15:53:36 +00:00
module backend
go 1.26.1
feat(01-03): pgxpool wrapper, RequestID/slog middleware, slog handler switch - Remove //go:build red_gate tag from internal/web/handlers_test.go and internal/db/pool_test.go now that consumer symbols are about to exist - go mod tidy after real importers land (deferred from Plan 01-01 per Codex concern #1) — chi/v5, templ, pgx/v5, google/uuid now in require list - internal/db/pool.go: NewPool(ctx, dsn) builds a pgxpool.Pool with MaxConns=10, MinConns=1; no eager Ping (RESEARCH Pitfall 2) - internal/web/slog.go: NewSlogHandler returns JSON when env='production', text otherwise; pure helper, no slog.SetDefault side effect - internal/web/middleware.go: RequestIDMiddleware (UUIDv4 → ctx + X-Request-ID header), LoggerFromContext helper, SlogLoggerMiddleware factory using chi WrapResponseWriter; field allowlist per V7/T-01-09
2026-05-14 17:24:16 +00:00
require (
github.com/a-h/templ v0.3.1020
github.com/go-chi/chi/v5 v5.2.5
github.com/google/uuid v1.6.0
feat(02-07): gorilla/csrf integration — mount middleware, wire all forms, env-driven key - auth.Mount(env, key) wraps csrf.Protect with locked D-14/D-24 options - auth.LoadKeyFromEnv() reads SESSION_SECRET, hex-decodes, validates 32 bytes; fails fast on error - ui.CSRFField(token) templ component renders hidden _csrf input - Layout, LoginPage/Fragment, SignupPage/Fragment, Index all embed @ui.CSRFField(csrfToken) - Handlers thread csrf.Token(r) into every page/fragment render call - NewRouter mounts auth.Mount after ResolveSession, before all route groups (D-24) - main.go calls auth.LoadKeyFromEnv(); logs.Fatalf on missing/invalid SESSION_SECRET - SESSION_SECRET documented in .env.example with openssl rand -hex 32 instruction - go.mod: gorilla/csrf v1.7.3 (direct); prior tests updated with getCSRFToken helper - All Plan 04/05/06 tests updated to acquire and submit valid _csrf tokens
2026-05-14 20:59:06 +00:00
github.com/gorilla/csrf v1.7.3
feat(01-03): pgxpool wrapper, RequestID/slog middleware, slog handler switch - Remove //go:build red_gate tag from internal/web/handlers_test.go and internal/db/pool_test.go now that consumer symbols are about to exist - go mod tidy after real importers land (deferred from Plan 01-01 per Codex concern #1) — chi/v5, templ, pgx/v5, google/uuid now in require list - internal/db/pool.go: NewPool(ctx, dsn) builds a pgxpool.Pool with MaxConns=10, MinConns=1; no eager Ping (RESEARCH Pitfall 2) - internal/web/slog.go: NewSlogHandler returns JSON when env='production', text otherwise; pure helper, no slog.SetDefault side effect - internal/web/middleware.go: RequestIDMiddleware (UUIDv4 → ctx + X-Request-ID header), LoggerFromContext helper, SlogLoggerMiddleware factory using chi WrapResponseWriter; field allowlist per V7/T-01-09
2026-05-14 17:24:16 +00:00
github.com/jackc/pgx/v5 v5.9.2
feat(02-01): create internal/auth package skeleton, test DB harness, env docs - auth/doc.go: package comment explaining consolidated layout (Open Question 3 resolved) - auth/types.go: User + Session structs, SessionCookieName (D-12), SessionTTL (D-09), SessionExtendThreshold (D-09), ErrSessionNotFound, ErrInvalidHash, ErrIncompatibleVersion - auth/testdb_test.go: setupTestDB creates isolated per-test schema (test_<uuid>), runs goose Up with unique version table, drops schema on cleanup (D-26) TestSetupTestDB_Roundtrip smoke test verifies users table visible - go.mod: added github.com/pressly/goose/v3 v3.27.1 as direct dependency - .env.example: added TEST_DATABASE_URL and SESSION_SECRET with comments (D-14, D-26)
2026-05-14 19:56:45 +00:00
github.com/pressly/goose/v3 v3.27.1
feat(02): GREEN — argon2id Hash + Verify + self-test - Add Params struct with Memory/Iterations/Parallelism/SaltLength/KeyLength - DefaultParams: OWASP 2024 baseline (m=64KiB, t=1, p=4, salt=16B, key=32B) — D-08 - TestParams: reduced cost (m=8KiB) so go test stays under 5s — D-26/Pitfall 4 - Hash(): crypto/rand salt per call, argon2.IDKey, PHC format $argon2id$v=19$... - Verify(): PHC split/parse, ErrInvalidHash on malformed, ErrIncompatibleVersion on v!=19 - subtle.ConstantTimeCompare for timing-attack resistance (T-2-13) - init() self-test: hash/verify round-trip panics on regression (D-08/T-2-15) - Add golang.org/x/crypto v0.51.0 as direct dependency
2026-05-14 20:00:55 +00:00
golang.org/x/crypto v0.51.0
feat(02-07): gorilla/csrf integration — mount middleware, wire all forms, env-driven key - auth.Mount(env, key) wraps csrf.Protect with locked D-14/D-24 options - auth.LoadKeyFromEnv() reads SESSION_SECRET, hex-decodes, validates 32 bytes; fails fast on error - ui.CSRFField(token) templ component renders hidden _csrf input - Layout, LoginPage/Fragment, SignupPage/Fragment, Index all embed @ui.CSRFField(csrfToken) - Handlers thread csrf.Token(r) into every page/fragment render call - NewRouter mounts auth.Mount after ResolveSession, before all route groups (D-24) - main.go calls auth.LoadKeyFromEnv(); logs.Fatalf on missing/invalid SESSION_SECRET - SESSION_SECRET documented in .env.example with openssl rand -hex 32 instruction - go.mod: gorilla/csrf v1.7.3 (direct); prior tests updated with getCSRFToken helper - All Plan 04/05/06 tests updated to acquire and submit valid _csrf tokens
2026-05-14 20:59:06 +00:00
golang.org/x/time v0.15.0
feat(01-03): pgxpool wrapper, RequestID/slog middleware, slog handler switch - Remove //go:build red_gate tag from internal/web/handlers_test.go and internal/db/pool_test.go now that consumer symbols are about to exist - go mod tidy after real importers land (deferred from Plan 01-01 per Codex concern #1) — chi/v5, templ, pgx/v5, google/uuid now in require list - internal/db/pool.go: NewPool(ctx, dsn) builds a pgxpool.Pool with MaxConns=10, MinConns=1; no eager Ping (RESEARCH Pitfall 2) - internal/web/slog.go: NewSlogHandler returns JSON when env='production', text otherwise; pure helper, no slog.SetDefault side effect - internal/web/middleware.go: RequestIDMiddleware (UUIDv4 → ctx + X-Request-ID header), LoggerFromContext helper, SlogLoggerMiddleware factory using chi WrapResponseWriter; field allowlist per V7/T-01-09
2026-05-14 17:24:16 +00:00
)
require (
feat(05-01): add aws-sdk-go-v2 modules, 0005_files migration, sqlc queries, and files.Store - Add four aws-sdk-go-v2 modules: core, config, credentials, service/s3 - Write 0005_files.sql migration (tablo_files table with ON DELETE CASCADE) - Write internal/db/queries/files.sql with InsertTabloFile, ListFilesByTablo, GetTabloFileByID, DeleteTabloFile - Implement internal/files/store.go: FileStorer interface, Store struct, NewStore (UsePathStyle for MinIO), Upload (sniff+stream+bytecount), Delete, PresignDownload - sqlc generate produces files.sql.go + TabloFile model (gitignored, regeneratable)
2026-05-15 10:18:16 +00:00
github.com/aws/aws-sdk-go-v2 v1.41.7 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 // indirect
github.com/aws/aws-sdk-go-v2/config v1.32.17 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.19.16 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23 // indirect
github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 // indirect
github.com/aws/smithy-go v1.25.1 // indirect
feat(08-02): add google social sign-in flow
2026-05-15 19:03:30 +00:00
github.com/coreos/go-oidc/v3 v3.18.0 // indirect
feat(06-01): add river dependency and ListOrphanFiles sqlc query - go get github.com/riverqueue/river@v0.37.0 + riverpgxv5@v0.37.0 - append ListOrphanFiles :many query to files.sql (orphan tablo_files rows) - regenerate sqlc: ListOrphanFilesRow{ID, TabloID, S3Key} exported - go build ./... exits 0
2026-05-15 14:32:48 +00:00
github.com/davecgh/go-spew v1.1.1 // indirect
feat(08-02): add google social sign-in flow
2026-05-15 19:03:30 +00:00
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
test(02-07): add failing CSRF tests (RED gate) - TestLoadCSRFKey_* in internal/auth for env key loading - TestCSRF_*MissingToken / TestCSRF_*ValidToken for all three POST routes - TestForms_ContainCSRFField for hidden _csrf input in rendered HTML - TestRouter_CSRFMountedAfterResolveSession for middleware order (D-24) - TestCSRF_HeaderFallback for X-CSRF-Token header support - Add gorilla/csrf v1.7.3 dependency
2026-05-14 20:45:36 +00:00
github.com/gorilla/securecookie v1.1.2 // indirect
feat(01-03): pgxpool wrapper, RequestID/slog middleware, slog handler switch - Remove //go:build red_gate tag from internal/web/handlers_test.go and internal/db/pool_test.go now that consumer symbols are about to exist - go mod tidy after real importers land (deferred from Plan 01-01 per Codex concern #1) — chi/v5, templ, pgx/v5, google/uuid now in require list - internal/db/pool.go: NewPool(ctx, dsn) builds a pgxpool.Pool with MaxConns=10, MinConns=1; no eager Ping (RESEARCH Pitfall 2) - internal/web/slog.go: NewSlogHandler returns JSON when env='production', text otherwise; pure helper, no slog.SetDefault side effect - internal/web/middleware.go: RequestIDMiddleware (UUIDv4 → ctx + X-Request-ID header), LoggerFromContext helper, SlogLoggerMiddleware factory using chi WrapResponseWriter; field allowlist per V7/T-01-09
2026-05-14 17:24:16 +00:00
github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
github.com/jackc/puddle/v2 v2.2.2 // indirect
feat(02-01): create internal/auth package skeleton, test DB harness, env docs - auth/doc.go: package comment explaining consolidated layout (Open Question 3 resolved) - auth/types.go: User + Session structs, SessionCookieName (D-12), SessionTTL (D-09), SessionExtendThreshold (D-09), ErrSessionNotFound, ErrInvalidHash, ErrIncompatibleVersion - auth/testdb_test.go: setupTestDB creates isolated per-test schema (test_<uuid>), runs goose Up with unique version table, drops schema on cleanup (D-26) TestSetupTestDB_Roundtrip smoke test verifies users table visible - go.mod: added github.com/pressly/goose/v3 v3.27.1 as direct dependency - .env.example: added TEST_DATABASE_URL and SESSION_SECRET with comments (D-14, D-26)
2026-05-14 19:56:45 +00:00
github.com/mfridman/interpolate v0.0.2 // indirect
feat(06-01): add river dependency and ListOrphanFiles sqlc query - go get github.com/riverqueue/river@v0.37.0 + riverpgxv5@v0.37.0 - append ListOrphanFiles :many query to files.sql (orphan tablo_files rows) - regenerate sqlc: ListOrphanFilesRow{ID, TabloID, S3Key} exported - go build ./... exits 0
2026-05-15 14:32:48 +00:00
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/riverqueue/river v0.37.0 // indirect
github.com/riverqueue/river/riverdriver v0.37.0 // indirect
github.com/riverqueue/river/riverdriver/riverpgxv5 v0.37.0 // indirect
github.com/riverqueue/river/rivershared v0.37.0 // indirect
github.com/riverqueue/river/rivertype v0.37.0 // indirect
feat(02-01): create internal/auth package skeleton, test DB harness, env docs - auth/doc.go: package comment explaining consolidated layout (Open Question 3 resolved) - auth/types.go: User + Session structs, SessionCookieName (D-12), SessionTTL (D-09), SessionExtendThreshold (D-09), ErrSessionNotFound, ErrInvalidHash, ErrIncompatibleVersion - auth/testdb_test.go: setupTestDB creates isolated per-test schema (test_<uuid>), runs goose Up with unique version table, drops schema on cleanup (D-26) TestSetupTestDB_Roundtrip smoke test verifies users table visible - go.mod: added github.com/pressly/goose/v3 v3.27.1 as direct dependency - .env.example: added TEST_DATABASE_URL and SESSION_SECRET with comments (D-14, D-26)
2026-05-14 19:56:45 +00:00
github.com/sethvargo/go-retry v0.3.0 // indirect
feat(06-01): add river dependency and ListOrphanFiles sqlc query - go get github.com/riverqueue/river@v0.37.0 + riverpgxv5@v0.37.0 - append ListOrphanFiles :many query to files.sql (orphan tablo_files rows) - regenerate sqlc: ListOrphanFilesRow{ID, TabloID, S3Key} exported - go build ./... exits 0
2026-05-15 14:32:48 +00:00
github.com/stretchr/testify v1.11.1 // indirect
github.com/tidwall/gjson v1.19.0 // indirect
github.com/tidwall/match v1.2.0 // indirect
github.com/tidwall/pretty v1.2.1 // indirect
github.com/tidwall/sjson v1.2.5 // indirect
go.uber.org/goleak v1.3.0 // indirect
feat(02-01): create internal/auth package skeleton, test DB harness, env docs - auth/doc.go: package comment explaining consolidated layout (Open Question 3 resolved) - auth/types.go: User + Session structs, SessionCookieName (D-12), SessionTTL (D-09), SessionExtendThreshold (D-09), ErrSessionNotFound, ErrInvalidHash, ErrIncompatibleVersion - auth/testdb_test.go: setupTestDB creates isolated per-test schema (test_<uuid>), runs goose Up with unique version table, drops schema on cleanup (D-26) TestSetupTestDB_Roundtrip smoke test verifies users table visible - go.mod: added github.com/pressly/goose/v3 v3.27.1 as direct dependency - .env.example: added TEST_DATABASE_URL and SESSION_SECRET with comments (D-14, D-26)
2026-05-14 19:56:45 +00:00
go.uber.org/multierr v1.11.0 // indirect
feat(08-02): add google social sign-in flow
2026-05-15 19:03:30 +00:00
golang.org/x/oauth2 v0.36.0 // indirect
feat(02-01): create internal/auth package skeleton, test DB harness, env docs - auth/doc.go: package comment explaining consolidated layout (Open Question 3 resolved) - auth/types.go: User + Session structs, SessionCookieName (D-12), SessionTTL (D-09), SessionExtendThreshold (D-09), ErrSessionNotFound, ErrInvalidHash, ErrIncompatibleVersion - auth/testdb_test.go: setupTestDB creates isolated per-test schema (test_<uuid>), runs goose Up with unique version table, drops schema on cleanup (D-26) TestSetupTestDB_Roundtrip smoke test verifies users table visible - go.mod: added github.com/pressly/goose/v3 v3.27.1 as direct dependency - .env.example: added TEST_DATABASE_URL and SESSION_SECRET with comments (D-14, D-26)
2026-05-14 19:56:45 +00:00
golang.org/x/sync v0.20.0 // indirect
feat(02): GREEN — argon2id Hash + Verify + self-test - Add Params struct with Memory/Iterations/Parallelism/SaltLength/KeyLength - DefaultParams: OWASP 2024 baseline (m=64KiB, t=1, p=4, salt=16B, key=32B) — D-08 - TestParams: reduced cost (m=8KiB) so go test stays under 5s — D-26/Pitfall 4 - Hash(): crypto/rand salt per call, argon2.IDKey, PHC format $argon2id$v=19$... - Verify(): PHC split/parse, ErrInvalidHash on malformed, ErrIncompatibleVersion on v!=19 - subtle.ConstantTimeCompare for timing-attack resistance (T-2-13) - init() self-test: hash/verify round-trip panics on regression (D-08/T-2-15) - Add golang.org/x/crypto v0.51.0 as direct dependency
2026-05-14 20:00:55 +00:00
golang.org/x/sys v0.44.0 // indirect
golang.org/x/text v0.37.0 // indirect
feat(06-01): add river dependency and ListOrphanFiles sqlc query - go get github.com/riverqueue/river@v0.37.0 + riverpgxv5@v0.37.0 - append ListOrphanFiles :many query to files.sql (orphan tablo_files rows) - regenerate sqlc: ListOrphanFilesRow{ID, TabloID, S3Key} exported - go build ./... exits 0
2026-05-15 14:32:48 +00:00
gopkg.in/yaml.v3 v3.0.1 // indirect
feat(01-03): pgxpool wrapper, RequestID/slog middleware, slog handler switch - Remove //go:build red_gate tag from internal/web/handlers_test.go and internal/db/pool_test.go now that consumer symbols are about to exist - go mod tidy after real importers land (deferred from Plan 01-01 per Codex concern #1) — chi/v5, templ, pgx/v5, google/uuid now in require list - internal/db/pool.go: NewPool(ctx, dsn) builds a pgxpool.Pool with MaxConns=10, MinConns=1; no eager Ping (RESEARCH Pitfall 2) - internal/web/slog.go: NewSlogHandler returns JSON when env='production', text otherwise; pure helper, no slog.SetDefault side effect - internal/web/middleware.go: RequestIDMiddleware (UUIDv4 → ctx + X-Request-ID header), LoggerFromContext helper, SlogLoggerMiddleware factory using chi WrapResponseWriter; field allowlist per V7/T-01-09
2026-05-14 17:24:16 +00:00
)
Reference in a new issue Copy permalink