diff --git a/AGENTS.md b/AGENTS.md index c3b8967..e0b3d85 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -46,6 +46,25 @@ Vollständiger Plan liegt als genehmigtem Plan zugrunde (siehe Abschnitt "Roadma Einstieg. Teilen/Beitreten erfordert aktive Server-Verbindung (App-gated). - **Self-Hosted Server-URL:** konfigurierbar in der App (Auth-Screen), umgesetzt via `DynamicBaseUrlInterceptor` (schreibt scheme/host/port pro Request um). + - **Server-getriebene Auth-Discovery:** Öffentlicher Endpoint `GET /api/config` + verrät der App vor dem Login die verfügbaren Methoden (`password_enabled`, + OIDC-Provider mit `display_name`, z.B. „Authentik"). `AUTH_PASSWORD_ENABLED=false` + → Register/Login per Passwort → 403 (OIDC-only-Enforcement). App-Login zeigt + nur noch die angebotenen Methoden (ConnectView → LoginView). + - **Profil + Settings-Screen:** `GET/PUT /api/me` (aktuell `display_name`), + `SettingsScreen` mit Account & Sync, Profil, Theme (System/Hell/Dunkel, + persistiert in SessionManager), „Lokale Daten zurücksetzen" (nur Room-Tabellen, + Serverdaten bleiben) und About. + - **Kritische Sync-/Datensicherheits-Fixes (Android):** SyncWorker pullt jetzt + **alle** getrackten Listen (nicht nur welche mit pending Outbox – vorher kamen + Remote-Änderungen stiller Listen nie an); lokale HLC tickt mit jedem eingehenden + Server-Op (`tick(op.hlcTs)` → LWW korrekt bei Uhr-Drift); `list_create` in + `applyServerOpProjection` ergänzt; Projektions-Write + op_log-Insert in einer + Room-Transaktion; `clientId`/`clientSeq` persistent in SessionManager; + **kein** `fallbackToDestructiveMigration` mehr (Source of Truth darf nie + gewispt werden); ProGuard-Keep-Rules für kotlinx.serialization/Retrofit + (R8-Releases crashten sonst); `network_security_config` (Cleartext nur für + localhost/10.0.2.2); WorkManager-Default-Initializer deaktiviert (Hilt). - **Authentik-OIDC:** läuft über den bestehenden Generic-OIDC-Provider (`provider: "generic"`); die App erlaubt manuelle id_token-Eingabe. - **MVP-Scope:** keine Echtzeit-Push (nur Periodic-Pull 15 min + Pull-on-Online); @@ -106,7 +125,7 @@ mitbringsl/ │ │ ├── auth/ # PHASE B – Password + Session + OIDC │ │ │ ├── password.go # Argon2id im PHC-Format (HashPassword/VerifyPassword) │ │ │ ├── password_test.go # PHC-Roundtrip-Tests -│ │ │ ├── user.go # UserStore: CreateUser/GetByEmail/GetByID/GetByOIDCSubject/CreateOIDCUser +│ │ │ ├── user.go # UserStore: CreateUser/GetByEmail/GetByID/GetByOIDCSubject/CreateOIDCUser/UpdateDisplayName │ │ │ ├── session.go # SessionStore: opaque Tokens, SHA-256-Hash, Create/Lookup/Revoke │ │ │ ├── oidc.go # OIDCService: id_token-Verifikation (JWKS/iss/aud/exp), Provider-Caching │ │ │ └── pgcode.go # isUniqueViolation (SQLSTATE 23505) @@ -126,7 +145,9 @@ mitbringsl/ │ │ ├── render.go # JSON-Render + Problem + Fehler-Sentinale + decodeJSON │ │ ├── middleware.go # requestID/logging/recover/cors + Chain │ │ ├── health.go # /healthz + /readyz -│ │ ├── auth.go # Register/Login/Logout/OIDC-Handler + RequireAuth-Middleware +│ │ ├── auth.go # Register/Login/Logout/OIDC-Handler + RequireAuth-Middleware (403 wenn Passwort-Login deaktiviert) +│ │ ├── config.go # GET /api/config (öffentlich): verfügbare Auth-Methoden für die App +│ │ ├── me.go # GET/PUT /api/me (eigenes Profil, display_name) │ │ ├── lists.go # GET/POST /api/lists, GET /api/lists/{id}, POST /invite, POST /join │ │ ├── ops.go # POST/GET /api/lists/{id}/ops (Push/Pull, Membership-Check) │ │ └── suggest.go # GET /api/suggestions?q= @@ -151,15 +172,16 @@ mitbringsl/ │ └── API.md # REST Specs (inkl. join/invite) └── android/ # Single-Module :app (Compose M3, Room, Hilt) └── app/src/main/java/com/example/mitbringsl/ - ├── data/auth/ # SessionManager (Local-User-Fallback, Server-URL) + ├── data/auth/ # SessionManager (Local-User-Fallback, Server-URL, clientId/clientSeq, Theme-Pref) ├── data/local/ # Room DB (lists, items, op_log), DAOs (LWW upsert) ├── data/remote/ # Retrofit-API, DTOs, DynamicBaseUrlInterceptor, AuthInterceptor ├── data/repository/ # ShoppingRepository, AuthRepository - ├── data/sync/ # HybridLogicalClock, SyncManager, SyncWorker + ├── data/sync/ # HybridLogicalClock, SyncManager, SyncWorker (pullt ALLE Listen, HLC-Tick pro Server-Op) ├── di/ # Hilt Modules - ├── ui/auth/ # AuthScreen (Login/Register/OIDC/Server-URL) - ├── ui/lists/ # ListsScreen/ViewModel (Join-Dialog, Offline-Banner) + ├── ui/auth/ # AuthScreen (ConnectView: Server-URL + /api/config-Discovery, dann LoginView) + ├── ui/lists/ # ListsScreen/ViewModel (Join-Dialog, Offline-Banner, Settings-Zahnrad) ├── ui/detail/ # ListDetailScreen/ViewModel (Share-Button, Autocomplete) + ├── ui/settings/ # SettingsScreen/ViewModel (Account, Profil, Theme, Reset, About) └── util/ # NetworkMonitor ``` @@ -215,6 +237,18 @@ Legende: ✅ erledigt · 🚧 in Arbeit · ⬜ offen (Fremde → 404 auf allen Listen-Endpoints), Cross-Member-Sync via op_log, 401-Gating aller geschützten Routen. Beide Dateien skippen ohne `TEST_DATABASE_URL` (Docker-Rezept im Dateikopf). +- ✅ **Post-MVP – Kritische Android-Fixes (Sync/Build/Data-Safety):** SyncWorker + pullt alle getrackten Listen, HLC-Tick pro Server-Op, Room-Transaktionen um + Projektion+Outbox, persistente clientId/clientSeq, kein destructive Migration, + ProGuard-Rules, Network-Security-Config, Hilt-WorkManager-Init. +- ✅ **Post-MVP – Auth-Discovery + OIDC-only:** `GET /api/config` (öffentlich), + `AUTH_PASSWORD_ENABLED` (403-Enforcement), `OIDC_GENERIC_DISPLAY_NAME`, + App-Connect-Flow (Server-URL → Methoden-Discovery → LoginView). +- ✅ **Post-MVP – Settings-Screen + Profil:** `GET/PUT /api/me` + (`UserStore.UpdateDisplayName`), `SettingsScreen`/`SettingsViewModel` + (Account&Sync, Profil, Theme, Reset, About), Theme-Pref in SessionManager. +- ✅ **Post-MVP – Build hinter restriktiven Proxies:** foojay-Resolver & + jvmToolchain auskommentiert, Gradle-Wrapper 9.6.1, `.ssl-work/` ignoriert. ### Wo genau weitermachen? **MVP + Post-MVP-Features sind abgeschlossen.** Das Backend ist feature-complete @@ -229,9 +263,12 @@ für den aktuellen Scope. Offene Punkte, geordnet nach Nutzen: 3. **Invite-Code-Optimierung:** Codes sind UUID-Präfixe (`uuid[:8]`), nicht kollisionsresistent geprüft (UNIQUE-Constraint fängt es, aber CreateList kann dann fehlschlagen). Besser: kryptografisches Alphabet ohne Verwechslungsbuchstaben. -4. **Echtzeit-Push (langfristig):** Periodic-Pull 15 min ist MVP; SSE/WebSocket +4. **Tests für neuere Endpoints:** `GET /api/config`, `GET/PUT /api/me` und das + `AUTH_PASSWORD_ENABLED=false`-Verhalten (403) haben noch keine Testabdeckung – + das Test-Setup dafür steht in `api_test.go` bereit. +5. **Echtzeit-Push (langfristig):** Periodic-Pull 15 min ist MVP; SSE/WebSocket für sofortige Updates wäre der nächste Schritt. -5. **Android-Tests:** UI/ViewModel-Tests fehlen fast komplett (nur 2 Stock-Tests). +6. **Android-Tests:** UI/ViewModel-Tests fehlen fast komplett (nur 2 Stock-Tests). --- diff --git a/README.md b/README.md index ff3ba47..75e101a 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,8 @@ Mitbringsl ist eine moderne, schnelle und werbefreie Einkaufslisten-App mit **Lo - 🔌 **Local-Only by Default**: Kein Account nötig — die App startet direkt ohne Login; Sync & Account sind optional (auch Self-Hosted, Server-URL in der App konfigurierbar). - 👥 **Geteilte Listen**: Listen per 8-Zeichen-Invite-Code teilen und gemeinsam bearbeiten; Membership wird serverseitig bei jedem Sync geprüft. - ⚡ **Local-First Sync Engine**: Hybrid Logical Clock (HLC), append-only `op_log`, Last-Write-Wins (LWW) Projektionen, Idempotente Push/Pull-Algorithmen. -- 🔐 **Datenschutz & Auth**: Argon2id Passwort-Hashing, opaque Session-Tokens, OIDC-Unterstützung (Google & eigene IdPs wie Authentik/Keycloak). +- 🔐 **Datenschutz & Auth**: Argon2id Passwort-Hashing, opaque Session-Tokens, OIDC-Unterstützung (Google & eigene IdPs wie Authentik/Keycloak) — Login-Methoden werden serverseitig per `/api/config` entdeckt, Passwort-Login lässt sich per `AUTH_PASSWORD_ENABLED=false` komplett abschalten. +- ⚙️ **Settings & Themes**: Account-/Profil-Verwaltung (`/api/me`), Theme-Umschalter (System/Hell/Dunkel), lokaler Daten-Reset — alles direkt in der App. - 🚀 **Go Backend**: Stdlib `net/http` Routing (Go 1.26), PostgreSQL 16 (`pgxpool`), `pg_trgm` Fuzzy Autocomplete. - 🛡️ **Deployment**: Multi-Stage Docker Container, Caddy Reverse Proxy mit automatischem HTTPS / Standalone & Behind-Proxy Modi. diff --git a/docs/API.md b/docs/API.md index 28e279c..a8efb9a 100644 --- a/docs/API.md +++ b/docs/API.md @@ -33,6 +33,8 @@ Create a new email/password account. "user": { "id": "", "email": "user@example.com", "display_name": "Max" } } ``` +- **403 Forbidden**: The server runs with `AUTH_PASSWORD_ENABLED=false` + (OIDC-only); use `POST /auth/oidc` instead. Check `GET /api/config` first. ### `POST /auth/login` Authenticate with email/password. @@ -41,6 +43,7 @@ Authenticate with email/password. { "email": "user@example.com", "password": "secretpassword" } ``` - **Response (200 OK)**: Same shape as register. +- **403 Forbidden**: Password login disabled (see register). ### `POST /auth/oidc` Authenticate via Google or custom OpenID Connect provider. @@ -55,6 +58,45 @@ Revoke active session token. Returns `204 No Content`. --- +## Server Config (`/api/config`) + +### `GET /api/config` +Public (no auth). Returns the auth methods this server offers so the app can +render the right login form before connecting. Driven by `AUTH_PASSWORD_ENABLED` +and the `OIDC_*` env vars; `display_name` for the generic provider comes from +`OIDC_GENERIC_DISPLAY_NAME` (e.g. "Authentik", "Keycloak"). +- **Response (200 OK)**: + ```json + { + "auth": { + "password_enabled": true, + "oidc": { + "google": { "enabled": false, "display_name": "Google" }, + "generic": { "enabled": true, "issuer": "https://idp.example.com", "display_name": "Authentik" } + } + } + } + ``` + +--- + +## Profile (`/api/me`) + +### `GET /api/me` +Returns the authenticated user's own profile. +- **Response (200 OK)**: + ```json + { "id": "", "email": "user@example.com", "display_name": "Max" } + ``` + +### `PUT /api/me` +Updates editable profile fields (currently `display_name`). +- **Request**: `{ "display_name": "Max Mustermann" }` + - Omitted field → unchanged; empty string `""` → clears the field. +- **Response (200 OK)**: the updated profile (same shape as GET). + +--- + ## Lists (`/api/lists`) All list endpoints return `404 Not Found` when the authenticated user is neither diff --git a/docs/SYNC.md b/docs/SYNC.md index d926e9a..710a7d8 100644 --- a/docs/SYNC.md +++ b/docs/SYNC.md @@ -56,6 +56,17 @@ All state modifications are represented as structured operations: Each operation carries a `(client_id, client_seq)` tuple enforced by a `UNIQUE` constraint in Postgres (`op_log`). Re-sent requests return previous `(seq, hlc_ts)` assignments without duplicating side effects. - **Cursor Pull (`GET /api/lists/{id}/ops?since={seq}`)**: Clients track `max(server_seq)` locally. Incremental sync fetches ops where `seq > cursor`, sorted by monotonic server sequence `seq ASC`. +- **Client pull loop**: + The `SyncWorker` pulls for **every** tracked list on each run (not only lists with pending outbox ops), so remote edits on "quiet" (e.g. shared/joined) lists arrive reliably. Old synced `op_log` rows are pruned locally to bound growth. + +### Client HLC discipline + +On every incoming server op the client advances its local HLC with +`tick(op.hlc_ts)`. This is essential for LWW correctness across devices with +skewed clocks: without it, a fast-clock device would permanently win conflicts +while a slow-clock device's own edits would be silently rejected by the +`hlc_ts <` projection guard. The same rule applies on the server (`opstore` +ticks the server HLC per incoming op). ---