Phil Skentelbery
d4f1bfb198
Implement complete authentication system following ADR-010 and Phase 3 design specs. This is a MINOR version increment (0.3.0 -> 0.4.0) as it adds new functionality. Authentication Features: - IndieLogin authentication flow via indielogin.com - Secure session management with SHA-256 token hashing - CSRF protection with single-use state tokens - Session lifecycle (create, verify, destroy) - require_auth decorator for protected routes - Automatic cleanup of expired sessions - IP address and user agent tracking Security Measures: - Cryptographically secure token generation (secrets module) - Token hashing for storage (never plaintext) - SQL injection prevention (prepared statements) - Single-use CSRF state tokens - 30-day session expiry with activity refresh - Comprehensive security logging Implementation Details: - starpunk/auth.py: 406 lines, 6 core functions, 4 helpers, 4 exceptions - tests/test_auth.py: 648 lines, 37 tests, 96% coverage - Database schema updates for sessions and auth_state tables - URL validation utility added to utils.py Test Coverage: - 37 authentication tests - 96% code coverage (exceeds 90% target) - All security features tested - Edge cases and error paths covered Documentation: - Implementation report in docs/reports/ - Updated CHANGELOG.md with detailed changes - Version incremented to 0.4.0 - ADR-010 and Phase 3 design docs included Follows project standards: - Black code formatting (88 char lines) - Flake8 linting (no errors) - Python coding standards - Type hints on all functions - Comprehensive docstrings 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
57 lines
1.3 KiB
Python
57 lines
1.3 KiB
Python
"""
|
|
StarPunk package initialization
|
|
Creates and configures the Flask application
|
|
"""
|
|
|
|
from flask import Flask
|
|
from pathlib import Path
|
|
|
|
|
|
def create_app(config=None):
|
|
"""
|
|
Application factory for StarPunk
|
|
|
|
Args:
|
|
config: Optional configuration dict to override defaults
|
|
|
|
Returns:
|
|
Configured Flask application instance
|
|
"""
|
|
app = Flask(
|
|
__name__,
|
|
static_folder='../static',
|
|
template_folder='../templates'
|
|
)
|
|
|
|
# Load configuration
|
|
from starpunk.config import load_config
|
|
load_config(app, config)
|
|
|
|
# Initialize database
|
|
from starpunk.database import init_db
|
|
init_db(app)
|
|
|
|
# Register blueprints
|
|
# TODO: Implement blueprints in separate modules
|
|
# from starpunk.routes import public, admin, api
|
|
# app.register_blueprint(public.bp)
|
|
# app.register_blueprint(admin.bp)
|
|
# app.register_blueprint(api.bp)
|
|
|
|
# Error handlers
|
|
@app.errorhandler(404)
|
|
def not_found(error):
|
|
return {'error': 'Not found'}, 404
|
|
|
|
@app.errorhandler(500)
|
|
def server_error(error):
|
|
return {'error': 'Internal server error'}, 500
|
|
|
|
return app
|
|
|
|
|
|
# Package version (Semantic Versioning 2.0.0)
|
|
# See docs/standards/versioning-strategy.md for details
|
|
__version__ = "0.4.0"
|
|
__version_info__ = (0, 4, 0)
|