phil/StarPunk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
32 Commits 2 Branches 12 Tags
v0.9.1
Commit Graph

4 Commits

Author SHA1 Message Date
Phil Skentelbery
9a805ec316 Implement automatic database migration system 
Following design in ADR-020, implementation guidance, and quick reference.

Phase 1: Migration System Core (starpunk/migrations.py)
- Create migration runner with fresh database detection
- Implement is_schema_current() heuristic for fresh DB detection
- Add helper functions (table_exists, column_exists, index_exists)
- Complete error handling with MigrationError exception
- 315 lines of production code

Phase 2: Database Integration (starpunk/database.py)
- Modify init_db() to call run_migrations()
- Add logger parameter handling
- 5 lines changed for integration

Phase 3: Comprehensive Testing (tests/test_migrations.py)
- 26 tests covering all scenarios (100% pass rate)
- Tests for fresh DB, legacy DB, helpers, error handling
- Integration test with actual migration file
- 560 lines of test code

Phase 4: Version and Documentation
- Bump version to 0.9.0 (MINOR increment per versioning strategy)
- Update CHANGELOG.md with comprehensive v0.9.0 entry
- Create implementation report documenting all details

Features:
- Fresh database detection prevents unnecessary migrations
- Legacy database detection applies pending migrations automatically
- Migration tracking table records all applied migrations
- Idempotent execution safe for multiple runs
- Fail-safe: app won't start if migrations fail
- Container deployments now fully automatic

Testing:
- All 26 migration tests passing (100%)
- Fresh database scenario verified (auto-skip)
- Legacy database scenario verified (migrations applied)
- Idempotent behavior confirmed

Documentation:
- Implementation report in docs/reports/
- CHANGELOG.md updated with v0.9.0 entry
- All architecture decisions from ADR-020 implemented

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-11-19 16:08:33 -07:00
Phil Skentelbery
5e50330bdf feat: Implement PKCE authentication for IndieLogin.com 
This fixes critical IndieAuth authentication by implementing PKCE (Proof Key
for Code Exchange) as required by IndieLogin.com API specification.

Added:
- PKCE code_verifier and code_challenge generation (RFC 7636)
- Database column: auth_state.code_verifier for PKCE support
- Issuer validation for authentication callbacks
- Comprehensive PKCE unit tests (6 tests, all passing)
- Database migration script for code_verifier column

Changed:
- Corrected IndieLogin.com API endpoints (/authorize and /token)
- State token validation now returns code_verifier for token exchange
- Authentication flow follows IndieLogin.com API specification exactly
- Enhanced logging with code_verifier redaction

Removed:
- OAuth metadata endpoint (/.well-known/oauth-authorization-server)
  Added in v0.7.0 but not required by IndieLogin.com
- h-app microformats markup from templates
  Modified in v0.7.1 but not used by IndieLogin.com
- indieauth-metadata link from HTML head

Security:
- PKCE prevents authorization code interception attacks
- Issuer validation prevents token substitution attacks
- Code verifier securely stored, redacted in logs, and single-use

Documentation:
- Version: 0.8.0
- CHANGELOG updated with v0.8.0 entry and v0.7.x notes
- ADR-016 and ADR-017 marked as superseded by ADR-019
- Implementation report created in docs/reports/
- Test update guide created in TODO_TEST_UPDATES.md

Breaking Changes:
- Users mid-authentication will need to restart login after upgrade
- Database migration required before deployment

Related: ADR-019

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-11-19 15:43:38 -07:00
Phil Skentelbery
d4f1bfb198 feat: Implement Phase 3 authentication module with IndieLogin support 
Implement complete authentication system following ADR-010 and Phase 3 design specs.
This is a MINOR version increment (0.3.0 -> 0.4.0) as it adds new functionality.

Authentication Features:
- IndieLogin authentication flow via indielogin.com
- Secure session management with SHA-256 token hashing
- CSRF protection with single-use state tokens
- Session lifecycle (create, verify, destroy)
- require_auth decorator for protected routes
- Automatic cleanup of expired sessions
- IP address and user agent tracking

Security Measures:
- Cryptographically secure token generation (secrets module)
- Token hashing for storage (never plaintext)
- SQL injection prevention (prepared statements)
- Single-use CSRF state tokens
- 30-day session expiry with activity refresh
- Comprehensive security logging

Implementation Details:
- starpunk/auth.py: 406 lines, 6 core functions, 4 helpers, 4 exceptions
- tests/test_auth.py: 648 lines, 37 tests, 96% coverage
- Database schema updates for sessions and auth_state tables
- URL validation utility added to utils.py

Test Coverage:
- 37 authentication tests
- 96% code coverage (exceeds 90% target)
- All security features tested
- Edge cases and error paths covered

Documentation:
- Implementation report in docs/reports/
- Updated CHANGELOG.md with detailed changes
- Version incremented to 0.4.0
- ADR-010 and Phase 3 design docs included

Follows project standards:
- Black code formatting (88 char lines)
- Flake8 linting (no errors)
- Python coding standards
- Type hints on all functions
- Comprehensive docstrings

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-11-18 20:35:36 -07:00
Phil Skentelbery
a68fd570c7 that initial commit 2025-11-18 19:21:31 -07:00