arthur/xtablo-source
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 5
xtablo-source/backend/go.mod

25 lines
680 B
Modula-2
Raw Normal View History

feat(01-01): initialize Go module and pin runtime dependencies - module: backend (go 1.26.1) - chi v5.2.5, templ v0.3.1020, pgx/v5 v5.9.2, goose v3.27.1, uuid v1.6.0 - pinned via 'go get'; 'go mod tidy' deferred to Plan 01-03 where consumers exist (Codex concern #1)
2026-05-14 15:53:36 +00:00
module backend
go 1.26.1
feat(01-03): pgxpool wrapper, RequestID/slog middleware, slog handler switch - Remove //go:build red_gate tag from internal/web/handlers_test.go and internal/db/pool_test.go now that consumer symbols are about to exist - go mod tidy after real importers land (deferred from Plan 01-01 per Codex concern #1) — chi/v5, templ, pgx/v5, google/uuid now in require list - internal/db/pool.go: NewPool(ctx, dsn) builds a pgxpool.Pool with MaxConns=10, MinConns=1; no eager Ping (RESEARCH Pitfall 2) - internal/web/slog.go: NewSlogHandler returns JSON when env='production', text otherwise; pure helper, no slog.SetDefault side effect - internal/web/middleware.go: RequestIDMiddleware (UUIDv4 → ctx + X-Request-ID header), LoggerFromContext helper, SlogLoggerMiddleware factory using chi WrapResponseWriter; field allowlist per V7/T-01-09
2026-05-14 17:24:16 +00:00
require (
github.com/a-h/templ v0.3.1020
github.com/go-chi/chi/v5 v5.2.5
github.com/google/uuid v1.6.0
github.com/jackc/pgx/v5 v5.9.2
feat(02-01): create internal/auth package skeleton, test DB harness, env docs - auth/doc.go: package comment explaining consolidated layout (Open Question 3 resolved) - auth/types.go: User + Session structs, SessionCookieName (D-12), SessionTTL (D-09), SessionExtendThreshold (D-09), ErrSessionNotFound, ErrInvalidHash, ErrIncompatibleVersion - auth/testdb_test.go: setupTestDB creates isolated per-test schema (test_<uuid>), runs goose Up with unique version table, drops schema on cleanup (D-26) TestSetupTestDB_Roundtrip smoke test verifies users table visible - go.mod: added github.com/pressly/goose/v3 v3.27.1 as direct dependency - .env.example: added TEST_DATABASE_URL and SESSION_SECRET with comments (D-14, D-26)
2026-05-14 19:56:45 +00:00
github.com/pressly/goose/v3 v3.27.1
feat(02): GREEN — argon2id Hash + Verify + self-test - Add Params struct with Memory/Iterations/Parallelism/SaltLength/KeyLength - DefaultParams: OWASP 2024 baseline (m=64KiB, t=1, p=4, salt=16B, key=32B) — D-08 - TestParams: reduced cost (m=8KiB) so go test stays under 5s — D-26/Pitfall 4 - Hash(): crypto/rand salt per call, argon2.IDKey, PHC format $argon2id$v=19$... - Verify(): PHC split/parse, ErrInvalidHash on malformed, ErrIncompatibleVersion on v!=19 - subtle.ConstantTimeCompare for timing-attack resistance (T-2-13) - init() self-test: hash/verify round-trip panics on regression (D-08/T-2-15) - Add golang.org/x/crypto v0.51.0 as direct dependency
2026-05-14 20:00:55 +00:00
golang.org/x/crypto v0.51.0
feat(01-03): pgxpool wrapper, RequestID/slog middleware, slog handler switch - Remove //go:build red_gate tag from internal/web/handlers_test.go and internal/db/pool_test.go now that consumer symbols are about to exist - go mod tidy after real importers land (deferred from Plan 01-01 per Codex concern #1) — chi/v5, templ, pgx/v5, google/uuid now in require list - internal/db/pool.go: NewPool(ctx, dsn) builds a pgxpool.Pool with MaxConns=10, MinConns=1; no eager Ping (RESEARCH Pitfall 2) - internal/web/slog.go: NewSlogHandler returns JSON when env='production', text otherwise; pure helper, no slog.SetDefault side effect - internal/web/middleware.go: RequestIDMiddleware (UUIDv4 → ctx + X-Request-ID header), LoggerFromContext helper, SlogLoggerMiddleware factory using chi WrapResponseWriter; field allowlist per V7/T-01-09
2026-05-14 17:24:16 +00:00
)
require (
github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
github.com/jackc/puddle/v2 v2.2.2 // indirect
feat(02-01): create internal/auth package skeleton, test DB harness, env docs - auth/doc.go: package comment explaining consolidated layout (Open Question 3 resolved) - auth/types.go: User + Session structs, SessionCookieName (D-12), SessionTTL (D-09), SessionExtendThreshold (D-09), ErrSessionNotFound, ErrInvalidHash, ErrIncompatibleVersion - auth/testdb_test.go: setupTestDB creates isolated per-test schema (test_<uuid>), runs goose Up with unique version table, drops schema on cleanup (D-26) TestSetupTestDB_Roundtrip smoke test verifies users table visible - go.mod: added github.com/pressly/goose/v3 v3.27.1 as direct dependency - .env.example: added TEST_DATABASE_URL and SESSION_SECRET with comments (D-14, D-26)
2026-05-14 19:56:45 +00:00
github.com/mfridman/interpolate v0.0.2 // indirect
github.com/sethvargo/go-retry v0.3.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/sync v0.20.0 // indirect
feat(02): GREEN — argon2id Hash + Verify + self-test - Add Params struct with Memory/Iterations/Parallelism/SaltLength/KeyLength - DefaultParams: OWASP 2024 baseline (m=64KiB, t=1, p=4, salt=16B, key=32B) — D-08 - TestParams: reduced cost (m=8KiB) so go test stays under 5s — D-26/Pitfall 4 - Hash(): crypto/rand salt per call, argon2.IDKey, PHC format $argon2id$v=19$... - Verify(): PHC split/parse, ErrInvalidHash on malformed, ErrIncompatibleVersion on v!=19 - subtle.ConstantTimeCompare for timing-attack resistance (T-2-13) - init() self-test: hash/verify round-trip panics on regression (D-08/T-2-15) - Add golang.org/x/crypto v0.51.0 as direct dependency
2026-05-14 20:00:55 +00:00
golang.org/x/sys v0.44.0 // indirect
golang.org/x/text v0.37.0 // indirect
feat(01-03): pgxpool wrapper, RequestID/slog middleware, slog handler switch - Remove //go:build red_gate tag from internal/web/handlers_test.go and internal/db/pool_test.go now that consumer symbols are about to exist - go mod tidy after real importers land (deferred from Plan 01-01 per Codex concern #1) — chi/v5, templ, pgx/v5, google/uuid now in require list - internal/db/pool.go: NewPool(ctx, dsn) builds a pgxpool.Pool with MaxConns=10, MinConns=1; no eager Ping (RESEARCH Pitfall 2) - internal/web/slog.go: NewSlogHandler returns JSON when env='production', text otherwise; pure helper, no slog.SetDefault side effect - internal/web/middleware.go: RequestIDMiddleware (UUIDv4 → ctx + X-Request-ID header), LoggerFromContext helper, SlogLoggerMiddleware factory using chi WrapResponseWriter; field allowlist per V7/T-01-09
2026-05-14 17:24:16 +00:00
)
Reference in a new issue Copy permalink