MichilisandClaude Opus 5
733d2459df
Replace the hand-rolled JWT auth with Better Auth 1.6.25 httpOnly cookie sessions, validated against the database on every request so revocation, bans and role changes take effect immediately. Backend: - betterAuth.ts wires the Drizzle adapter, magic links, Google sign-in and the admin plugin; auth-schema.ts maps Better Auth's models onto the existing `users` table so user IDs and their foreign keys survive intact. - routes/auth.ts is gone; Better Auth serves the standard endpoints and authExt.ts carries the flows it doesn't cover. - auth.ts shrinks to session resolution and helpers; sessions/revocation in dashboard.ts now read and delete `auth_sessions` rows directly. - Schema adds the Better Auth core + admin columns (email_verified, image, banned, ban_reason, ban_expires), with migrations and tests. - rateLimit.ts resolves client IPs spoof-resistantly: proxy headers are only honoured from loopback/RFC1918 peers plus TRUSTED_PROXIES. - passwordPolicy.ts centralises password validation. - Bump drizzle-orm, drizzle-kit and better-sqlite3 to versions compatible with Better Auth. Frontend: - auth-client.ts plus a reworked AuthContext and api/client.ts move to cookie-based sessions; no more bearer tokens in requests or middleware. photo-api: - Validate Better Auth session cookies against the shared auth_sessions table instead of verifying JWTs; JWT_SECRET is no longer needed for user auth, and PHOTO_VIEW_SECRET now signs gallery view tokens. BETTER_AUTH_SECRET and BETTER_AUTH_URL are required in production; the deprecated JWT_SECRET stays only as the photo-api view-token fallback. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
46 lines
2.0 KiB
AMPL
46 lines
2.0 KiB
AMPL
module git.azzamo.net/Michilis/Spanglish/photo-api
|
|
|
|
go 1.26
|
|
|
|
require (
|
|
github.com/aws/aws-sdk-go-v2 v1.43.0
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.31
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.30
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.106.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/jackc/pgx/v5 v5.10.0
|
|
github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd
|
|
golang.org/x/image v0.44.0
|
|
modernc.org/sqlite v1.54.0
|
|
)
|
|
|
|
require (
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.31 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.31 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.31 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.32 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.24 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.31 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.32 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.5.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.33.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.45.0 // indirect
|
|
github.com/aws/smithy-go v1.27.3 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
golang.org/x/sync v0.22.0 // indirect
|
|
golang.org/x/sys v0.46.0 // indirect
|
|
golang.org/x/text v0.40.0 // indirect
|
|
modernc.org/libc v1.74.1 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
)
|