arthur/xtablo-source
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 5
971 commits 4 branches 0 tags 23 MiB
Commit graph

971 commits

This branch
This branch
All branches
Author SHA1 Message Date
Arthur Belleville
43ddf25364
feat(03-02): tablos templates — dashboard, empty state, card, create form, OOB-clear 
- Create backend/templates/tablos.templ with TablosDashboard, TablosEmptyState,
  TabloCard, TabloCreateFormFragment, TabloCardWithOOBFormClear components
- Create backend/templates/tablos_forms.go declaring TabloCreateForm and
  TabloCreateErrors types (mirrors auth_forms.go pattern)
- Update layout.templ footer: "Phase 2 · Authentication" → "Phase 3 · Tablos"
- TabloCardWithOOBFormClear emits OOB div as top-level sibling (Pitfall 5)
- TabloCard guards description/color rendering with pgtype.Text null checks
- All UI-SPEC copywriting copy strings present; templ generate succeeds
 2026-05-15 00:17:56 +02:00
Arthur Belleville
2f22d68776
docs(03-01): complete Plan 01 — migration, test scaffold, button CSS 
- 03-01-SUMMARY.md: tablos schema foundation, RED test scaffold, button CSS variants
- STATE.md: decisions + metrics for 03-01; phase 3 status updated
- ROADMAP.md: phase 3 plan progress (1/3 complete)
- REQUIREMENTS.md: TABLO-01..06 marked complete
 2026-05-15 00:15:36 +02:00
Arthur Belleville
2c1b186fb7
feat(03-01): add ui-button-solid-danger-md and ui-button-soft-neutral-md CSS variants 
- Danger variant: #b91c1c bg, #991b1b hover, min-height 44px (WCAG 2.5.5)
- Neutral-soft variant: #f1f5f9 bg, #e2e8f0 hover, #334155 text, min-height 44px
- All pseudo-class selectors top-level (no CSS nesting per Phase 1 convention)
- static/tailwind.css updated via just generate (Pitfall 4: imported CSS passes through)
 2026-05-15 00:13:56 +02:00
Arthur Belleville
c8f44b1ad2
test(03-01): add TablosDeps stub and RED integration test scaffold for TABLO-01..06 
- handlers_tablos.go: TablosDeps stub type enabling test compilation
- handlers_tablos_test.go: 10 integration tests (RED baseline) for all TABLO-01..06 paths
  - TestTabloList, TestTabloList_Empty, TestTabloCreate, TestTabloCreate_Validation
  - TestTabloDetail_Owner, TestTabloDetail_NonOwner, TestTabloDetail_InvalidID
  - TestTabloUpdate, TestTabloDeleteConfirm, TestTabloDelete
- router.go: NewRouter accepts TablosDeps as second deps parameter
- handlers_auth_test.go, handlers_test.go, csrf_test.go: update NewRouter call sites
- cmd/web/main.go: construct and pass TablosDeps to NewRouter
 2026-05-15 00:13:31 +02:00
Arthur Belleville
f1b8d6e629
feat(03-01): add tablos migration and sqlc queries 
- 0003_tablos.sql: tablos table with user_id FK + ON DELETE CASCADE + tablos_user_id_idx
- tablos.sql: 5 named queries (ListTablosByUser, GetTabloByID, InsertTablo, UpdateTablo, DeleteTablo)
- UpdateTablo sets updated_at = now() explicitly (Pitfall 7)
- color not editable in UpdateTablo per Phase 3 scope
- sqlc generates Tablo struct with pgtype.Text for description/color (not committed per .gitignore convention)
 2026-05-15 00:10:40 +02:00
Arthur Belleville
f53b54637b
docs(03): plan phase 3 — Tablos CRUD (3 plans, 3 waves) 
Plans cover TABLO-01..06 via MVP vertical slices: foundation (migration
+ sqlc + test scaffold + button CSS), list+create (dashboard, inline
form, OOB swap), and detail+edit+delete (ownership 404, inline edit
fragments, inline confirm delete). Includes Nyquist VALIDATION.md and
PATTERNS.md with real analog excerpts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-15 00:08:08 +02:00
Arthur Belleville
dc7f5ac4e2
docs(03): research phase domain 2026-05-14 23:51:35 +02:00
Arthur Belleville
65cdfbc00f
docs(03): fix UI-SPEC checker blocks — copywriting labels and typography weight 
- Replace generic "Save"/"Cancel" with specific labels: "Save changes",
  "Discard changes", "Keep tablo" throughout spec, component inventory,
  interaction contracts, and HTMX reference table
- Remove 500 (medium) weight; form labels now use font-semibold (600),
  consistent with Button convention — 2 declared weights total

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
 2026-05-14 23:42:53 +02:00
Arthur Belleville
c779d2aee1
docs(03): UI design contract for Tablos CRUD phase 
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
 2026-05-14 23:39:48 +02:00
Arthur Belleville
ab5b58cd06
docs(state): record phase 3 context session 2026-05-14 23:36:00 +02:00
Arthur Belleville
5fe692aa93
docs(03): capture phase 3 context 2026-05-14 23:35:55 +02:00
Arthur Belleville
df78ed2832
docs(02): phase 2 verification PASSED — AUTH-01..07 complete 
All 7 plans executed and verified against the phase boundary.
 2026-05-14 23:06:31 +02:00
Arthur Belleville
efb3df51da
docs(02-07): complete gorilla/csrf integration plan (AUTH-06 closed) 
- SUMMARY.md: gorilla/csrf middleware, ui.CSRFField, env-driven key, all CSRF tests
- STATE.md: Phase 2 complete (7/7), decisions, commits, metrics recorded
- ROADMAP.md: Phase 2 Authentication marked complete

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 23:01:36 +02:00
Arthur Belleville
389e1bc8b4
feat(02-07): gorilla/csrf integration — mount middleware, wire all forms, env-driven key 
- auth.Mount(env, key) wraps csrf.Protect with locked D-14/D-24 options
- auth.LoadKeyFromEnv() reads SESSION_SECRET, hex-decodes, validates 32 bytes; fails fast on error
- ui.CSRFField(token) templ component renders hidden _csrf input
- Layout, LoginPage/Fragment, SignupPage/Fragment, Index all embed @ui.CSRFField(csrfToken)
- Handlers thread csrf.Token(r) into every page/fragment render call
- NewRouter mounts auth.Mount after ResolveSession, before all route groups (D-24)
- main.go calls auth.LoadKeyFromEnv(); logs.Fatalf on missing/invalid SESSION_SECRET
- SESSION_SECRET documented in .env.example with openssl rand -hex 32 instruction
- go.mod: gorilla/csrf v1.7.3 (direct); prior tests updated with getCSRFToken helper
- All Plan 04/05/06 tests updated to acquire and submit valid _csrf tokens
 2026-05-14 22:59:06 +02:00
Arthur Belleville
ae2d356f87
test(02-07): add failing CSRF tests (RED gate) 
- TestLoadCSRFKey_* in internal/auth for env key loading
- TestCSRF_*MissingToken / TestCSRF_*ValidToken for all three POST routes
- TestForms_ContainCSRFField for hidden _csrf input in rendered HTML
- TestRouter_CSRFMountedAfterResolveSession for middleware order (D-24)
- TestCSRF_HeaderFallback for X-CSRF-Token header support
- Add gorilla/csrf v1.7.3 dependency
 2026-05-14 22:45:36 +02:00
Arthur Belleville
00a9388c32
docs(02-06): complete logout + protected routes + layout plan 
- Create 02-06-SUMMARY.md with TDD gate compliance, router middleware snapshot
- Update STATE.md: plans 01-06 complete, plan 07 (CSRF) next
- Update ROADMAP.md: Phase 2 at 6/7 plans, 02-06 checked
- Mark AUTH-04 complete in REQUIREMENTS.md (AUTH-05 was already checked)
 2026-05-14 22:42:23 +02:00
Arthur Belleville
8b54ff4bec
feat(02-06): implement logout, protect GET /, and update layout with auth state 
- Add LogoutHandler: deletes session row (D-06), clears cookie, redirects to /login
- Protect GET / inside RequireAuth group; remove old top-level registration
- Add POST /logout inside same RequireAuth group (D-22: POST-only logout)
- Update Layout signature to accept *auth.User; render logout form + email when authed
- Update Index template to accept *auth.User and show "Signed in as {email}"
- Update SignupPage/LoginPage to pass nil to Layout (auth pages are unauthed)
- Update IndexHandler to pull user from auth.Authed(ctx) and pass to template
- Update TestIndex_RendersHxGet -> TestIndex_UnauthRedirects (GET / now protected)
- AUTH-04 (logout) and AUTH-05 (protected /) are now closed
 2026-05-14 22:40:10 +02:00
Arthur Belleville
b5c3fc4d48
test(02-06): add failing tests for logout, protected routes, and layout auth 
- TestLogout_Success: POST /logout with valid cookie -> 303, cookie cleared, session deleted
- TestLogout_UnauthRedirectsToLogin: POST /logout without cookie -> 303 from RequireAuth
- TestLogout_HXRedirect: HTMX logout -> 200 + HX-Redirect: /login
- TestLogout_AfterLogoutSubsequentRequestUnauth: stale cookie blocked after logout
- TestProtected_HomeUnauthRedirects: GET / without session -> 303 /login
- TestProtected_HomeUnauthHXRedirect: HTMX GET / without session -> 200 + HX-Redirect
- TestProtected_HomeAuthRendersUserEmail: authed GET / -> 200 with user email
- TestLayout_LogoutFormVisibleWhenAuthed: Layout with user shows logout form
- TestLayout_LogoutFormHiddenWhenUnauthed: Layout with nil user hides logout form
 2026-05-14 22:32:33 +02:00
Arthur Belleville
977dafa31d
docs(02-05): complete login + rate limit plan 
- SUMMARY.md: login vertical slice, rate limiter design decisions, 12 test results
- STATE.md: advance to 5/7 plans, add decisions, metrics row
- ROADMAP.md: mark 02-05 complete (5/7 plans)
- REQUIREMENTS.md: mark AUTH-07 complete (rate limit delivered)
 2026-05-14 22:30:00 +02:00
Arthur Belleville
7d8c498980
feat(02-05): login vertical slice with rate limiting 
- auth_login.templ: LoginPage + LoginFormFragment (mirrors signup shape)
- LoginForm + LoginErrors types added to templates/auth_forms.go
- LoginPageHandler + LoginPostHandler in handlers_auth.go
  - Rate-limit check before user lookup (D-16, T-2-14)
  - Single errInvalidCreds constant for D-20 enumeration defense
  - Session rotation via Store.Rotate on success (D-10, T-2-04)
  - HTMX-aware redirect and fragment responses (D-19, D-21)
- AuthDeps extended with Limiter *auth.LimiterStore field
- router.go: GET /login in RedirectIfAuthed group (D-23)
- main.go: LimiterStore created with janitor goroutine (D-16)
- Export NewLimiterStoreWithClock + SetLimiterClock for cross-package tests
- 12 TestLogin_* integration tests all pass with real DB
 2026-05-14 22:27:54 +02:00
Arthur Belleville
b5c20c7892
feat(02-05): implement LimiterStore with injectable clock and janitor 
- Token-bucket rate limiter keyed per (email+IP) using golang.org/x/time/rate
- rate.Every(12s), burst=5, idleTTL=10min (D-16)
- AllowN(t, 1) with injectable clock for deterministic tests (Pattern 8)
- Janitor goroutine evicts entries idle > 10min via cleanupNow()
- No .Allow() without args (Pitfall 8 avoided)
- Five tests pass with -race: burst, refill, isolation, janitor, concurrent
- golang.org/x/time v0.15.0 added to go.mod
 2026-05-14 22:22:24 +02:00
Arthur Belleville
f6a453ff1f
docs(02-04): complete signup vertical slice plan 
- Add 02-04-SUMMARY.md: signup form + handler + integration tests
- Update STATE.md: plan 04 complete (4/7 in phase 2), plan 05 next
- Update ROADMAP.md: 02-04 checked off, phase 2 progress 4/7
 2026-05-14 22:20:09 +02:00
Arthur Belleville
efdc16babe
feat(02-04): signup handler, router wiring, and integration tests 
- Add handlers_auth.go: SignupPageHandler + SignupPostHandler (validate -> hash -> insert -> session -> redirect)
- Add AuthDeps struct; wire argon2id hash, InsertUser, Store.Create, SetSessionCookie
- Update router.go: NewRouter accepts AuthDeps; mount ResolveSession (D-24); wire /signup routes behind RedirectIfAuthed
- Update cmd/web/main.go: build AuthDeps (sqlc.Queries + auth.Store + secure flag) and pass to NewRouter
- Add nil-Store guard to auth.ResolveSession for Phase 1 unit-test compatibility
- Update handlers_test.go: pass AuthDeps{} zero value to NewRouter (Phase 1 routes unaffected)
- Add testdb_test.go: isolated-schema test helper for web package integration tests
- Add handlers_auth_test.go: 8 TestSignup_* integration tests (all pass against real Postgres)
 2026-05-14 22:17:50 +02:00
Arthur Belleville
73935ed11c
feat(02-04): signup templates (full page + HTMX fragment) with render tests 
- Create auth_form_errors.templ: FieldError and GeneralError primitives
- Create auth_signup.templ: SignupPage (full) and SignupFormFragment (HTMX swap target)
- Define SignupForm and SignupErrors types in templates/auth_forms.go
- Add three smoke tests: renders form, renders errors, does not echo password
 2026-05-14 22:14:28 +02:00
Arthur Belleville
38596ac41e
docs(02-03): complete session store + middleware plan 
- Create 02-03-SUMMARY.md: SHA-256 token hashing, sliding TTL, HTMX-aware chi middleware
- STATE.md: advance to plan 03 complete, plan 04 (signup) next
- ROADMAP.md: Phase 2 progress 3/7 plans
- REQUIREMENTS.md: mark AUTH-02, AUTH-03, AUTH-05 complete
 2026-05-14 22:11:58 +02:00
Arthur Belleville
1d07830954
feat(02-03): ResolveSession + RequireAuth + RedirectIfAuthed middleware 
- ResolveSession: reads cookie, SHA-256 lookup, MaybeExtend best-effort, attaches Session+User to ctx
- RequireAuth: 303 /login for plain requests; HX-Redirect: /login for HTMX (D-23, Pattern 5)
- RedirectIfAuthed: bounces authed users to / from login/signup pages
- Authed(ctx): typed context accessor for session + user
- redirect helper centralizes 303 vs HX-Redirect logic (Pitfall 9: no 302)
- 9 tests: 3 real-DB (ResolveSession) + 6 pure ctx/routing (RequireAuth, RedirectIfAuthed)
 2026-05-14 22:09:58 +02:00
Arthur Belleville
fd2301decf
feat(02-03): session store + cookie helpers (real-DB TDD) 
- Store.Create: 32-byte crypto/rand token, SHA-256 hex as DB id (D-05)
- Store.Lookup: hashes cookie, maps pgx.ErrNoRows to ErrSessionNotFound (D-07)
- Store.Delete: hard-deletes session row (D-06)
- Store.Rotate: deletes old row before creating new one (D-10, T-2-04)
- Store.MaybeExtend: extends only when remaining < 7 days (D-09)
- SetSessionCookie: HttpOnly + Secure (env-gated) + SameSite=Lax (D-12)
- ClearSessionCookie: MaxAge=-1 not 0 (RESEARCH Pattern 3 / D-06)
- 10 tests: 7 real-DB (skip without TEST_DATABASE_URL) + 3 cookie unit tests
 2026-05-14 22:08:04 +02:00
Arthur Belleville
648ce143a2
docs(02-02): complete argon2id password TDD plan 
- Add 02-02-SUMMARY.md: argon2id Hash+Verify, DefaultParams (OWASP 2024), TestParams, init self-test
- Update STATE.md: plan 02 complete, plan count 7, decision logged
- Update ROADMAP.md: phase 2 now shows 2/7 plans complete
 2026-05-14 22:02:25 +02:00
Arthur Belleville
ee36a5c78b
feat(02): GREEN — argon2id Hash + Verify + self-test 
- Add Params struct with Memory/Iterations/Parallelism/SaltLength/KeyLength
- DefaultParams: OWASP 2024 baseline (m=64KiB, t=1, p=4, salt=16B, key=32B) — D-08
- TestParams: reduced cost (m=8KiB) so go test stays under 5s — D-26/Pitfall 4
- Hash(): crypto/rand salt per call, argon2.IDKey, PHC format $argon2id$v=19$...
- Verify(): PHC split/parse, ErrInvalidHash on malformed, ErrIncompatibleVersion on v!=19
- subtle.ConstantTimeCompare for timing-attack resistance (T-2-13)
- init() self-test: hash/verify round-trip panics on regression (D-08/T-2-15)
- Add golang.org/x/crypto v0.51.0 as direct dependency
 2026-05-14 22:00:55 +02:00
Arthur Belleville
3bb3828cdc
test(02): RED — failing argon2id password tests 
- Six tests: HashVerify, VerifyWrong, VerifyMalformed, VerifyVersion, DistinctSaltsPerCall, DefaultParamsShape
- Tests use auth.TestParams for fast wall time (Pitfall 4 guard)
- Guards ErrInvalidHash + ErrIncompatibleVersion sentinel errors
- All tests fail with undefined: auth.Hash / auth.TestParams / auth.Verify (implementation missing)
 2026-05-14 21:59:38 +02:00
Arthur Belleville
fb9aac30ba
docs(02-01): complete auth-substrate plan 2026-05-14 21:58:23 +02:00
Arthur Belleville
2c84f4275b
feat(02-01): create internal/auth package skeleton, test DB harness, env docs 
- auth/doc.go: package comment explaining consolidated layout (Open Question 3 resolved)
- auth/types.go: User + Session structs, SessionCookieName (D-12), SessionTTL (D-09),
  SessionExtendThreshold (D-09), ErrSessionNotFound, ErrInvalidHash, ErrIncompatibleVersion
- auth/testdb_test.go: setupTestDB creates isolated per-test schema (test_<uuid>),
  runs goose Up with unique version table, drops schema on cleanup (D-26)
  TestSetupTestDB_Roundtrip smoke test verifies users table visible
- go.mod: added github.com/pressly/goose/v3 v3.27.1 as direct dependency
- .env.example: added TEST_DATABASE_URL and SESSION_SECRET with comments (D-14, D-26)
 2026-05-14 21:56:45 +02:00
Arthur Belleville
799c26099e
feat(02-01): add sqlc queries + citext/uuid overrides; generate bindings 
- sqlc.yaml: overrides citext→string and uuid→uuid.UUID (Pattern 10, Pitfall 3)
- users.sql: InsertUser :one and GetUserByEmail :one
- sessions.sql: InsertSession :exec, GetSessionWithUser :one (expires_at > now() per D-07),
  DeleteSession :exec, DeleteSessionsByUser :exec, ExtendSession :exec
- sqlc generate produces Email string (not pgtype.Text) and uuid.UUID in bindings
- go build ./internal/db/... exits 0
 2026-05-14 21:52:48 +02:00
Arthur Belleville
513044de58
feat(02-01): add 0002_auth.sql migration with users + sessions tables 
- citext extension + pgcrypto for gen_random_uuid()
- users: id uuid PK, email citext UNIQUE, password_hash, created_at, updated_at (D-01)
- sessions: id text PK (SHA-256 hex), user_id FK ON DELETE CASCADE, created_at, expires_at (D-04)
- indexes on sessions(user_id) and sessions(expires_at)
- no deleted_at, email_verified_at, user_agent, ip_address columns (D-02, D-03, D-04)
- goose Up/Down round-trip verified against compose Postgres
 2026-05-14 21:51:37 +02:00
Arthur Belleville
032e020fe3
docs(02): create phase plan (7 plans, 6 waves) 
7 vertical-slice plans covering AUTH-01..07: schema+sqlc skeleton →
password (TDD) || session+middleware → signup → login+ratelimit →
logout+protect → CSRF. All 26 CONTEXT.md decisions cited; threat
model covers T-2-01..T-2-10.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 21:44:08 +02:00
Arthur Belleville
194072bd9a
docs(02-authentication): add CSRF integration plan (Plan 07) for AUTH-06 2026-05-14 21:36:06 +02:00
Arthur Belleville
284251083b
docs(02): add phase research 2026-05-14 21:20:13 +02:00
Arthur Belleville
0d62b9988d
docs(phase-2): add validation strategy 2026-05-14 21:19:41 +02:00
Arthur Belleville
d2af5d227b
docs(state): record phase 2 context session 2026-05-14 20:55:27 +02:00
Arthur Belleville
63672731f7
docs(02): capture phase context 2026-05-14 20:55:22 +02:00
Arthur Belleville
8d0f7a5a9c
docs(phase-01): evolve PROJECT.md after phase completion 2026-05-14 20:12:25 +02:00
Arthur Belleville
e1a1169e3e
test(01): user-approved human UAT items; close phase 2026-05-14 20:11:54 +02:00
Arthur Belleville
dd615a0195
fix(01): guard sqlc on empty queries and correct tailwind paths 2026-05-14 20:09:39 +02:00
Arthur Belleville
5eada7f480
test(01): persist human verification items as UAT 2026-05-14 19:35:41 +02:00
Arthur Belleville
d032162cc0
docs(phase-01): update tracking after wave 4 2026-05-14 19:32:14 +02:00
Arthur Belleville
5d17594356
chore: merge executor worktree (worktree-agent-a1c29b6bd03c33a2b) [plan 01-04] 2026-05-14 19:32:12 +02:00
Arthur Belleville
9149399578
docs(01-04): complete README quickstart plan 
Adds 01-04-SUMMARY.md documenting the README onboarding doc that closes
FOUND-05 and completes Phase 1 foundation requirements.
 2026-05-14 19:31:56 +02:00
Arthur Belleville
88f3706cd5
docs(01-04): add backend/README.md quickstart (closes FOUND-05) 
- Five-minute clone-to-page onboarding doc covering prereqs, bootstrap,
  two-terminal dev workflow, common commands, and troubleshooting.
- Documents docker compose fallback for contributors not on podman (D-11).
- Documents two-terminal workflow: just dev + just styles-watch (D-14).
- Every `just <recipe>` referenced is a real recipe in backend/justfile.
- Uses 'bootstrap-downloaded' wording (not 'vendored') for tailwindcss
  and htmx.min.js per Codex review concern #4.
- Clarifies HTMX runtime no-CDN policy; the unpkg URL in justfile is the
  single authoritative version pin (D-10 / Codex concern #5).
- Top 3 pitfalls from RESEARCH surfaced in Troubleshooting.
- 195 lines, no emoji, no marketing voice.
 2026-05-14 19:31:19 +02:00
Arthur Belleville
709aa5cff3
docs(phase-01): update tracking after wave 3 2026-05-14 19:28:44 +02:00
Arthur Belleville
cc204463ad
chore: merge executor worktree (worktree-agent-a69c8b0de96868f99) [plan 01-03] 2026-05-14 19:28:34 +02:00