mitbringsl

Tronax/mitbringsl

Fork 0

Commit graph

Author	SHA1	Message	Date
Tronax	729865be78	Feature: Settings screen with account, theme, profile, reset + credits Backend: - New GET/PUT /api/me endpoint to read and update the authenticated user's profile (currently display_name). UserStore.UpdateDisplayName. - Wired into the authed router. App: - New SettingsScreen + SettingsViewModel with five sections: * Account & Sync: login status, email, server URL, logout, connect. * Profile: edit display name (pushed to PUT /api/me when logged in). * Appearance: System / Light / Dark theme switch, persisted in SessionManager and applied via MitbringslTheme(sessionManager). * Data: 'Reset local data' wipes Room tables (server data kept). * About: version, 'Developed by Janik Dietz', and credits to GLM-5.2 + Gemini 3.6 Flash. - Theme.kt now reads the user's theme preference (StateFlow) instead of only the system default; MainActivity passes SessionManager in. - Navigation: new SettingsNavKey; settings gear icon in ListsScreen top bar; Settings links back to the Sync/Account screen. - DTOs/API: UpdateMeRequestDto + getMe()/updateMe() for /api/me.	2026-08-06 10:39:12 +02:00
Tronax	a5ef8cf3ba	Backend Phase B (2/2): OIDC auth + config validation - internal/auth/oidc.go: OIDCService mit go-oidc v3 - id_token-Verifikation via JWKS (Signatur, iss, aud, exp) - Provider-Caching (sync.Map, lazy init per Issuer-URL) - Unterstützt Google + Generic OIDC - internal/auth/user.go: GetByOIDCSubject + CreateOIDCUser (find-or-create via (oidc_issuer, oidc_subject)) - internal/httpapi/auth.go: POST /auth/oidc Handler (id_token verifiziern → find-or-create User → issueSession) - internal/httpapi/api.go: /auth/oidc Route verdrahtet - internal/config/config.go: OIDC-Validierung (enabled → client_id + issuer Pflicht) - go.mod/go.sum: go-oidc/v3 + oauth2 Abhängigkeiten - AGENTS.md: Phase B vollständig als erledigt markiert Verifiziert: E2E gegen lokalen Mock-IdP (Discovery → JWKS → signiertes id_token → User angelegt → 2. Login gleicher User → tampered Token → 401). Alle Fehlerpfade geprüft. go build ./... && go vet ./... && go test ./internal/auth/... ✅	2026-08-05 19:45:00 +02:00
Tronax	7b1c18590e	Backend Phase B (1/2): password auth + sessions Argon2id password hashing (PHC format, self-encoded/decoded without an external lib) with constant-time verification, UserStore (create/get by email and id) and SessionStore (opaque crypto/rand tokens, SHA-256 hashed in DB, create/lookup/revoke, last_seen_at bump on lookup). HTTP layer: Register/Login/Logout handlers + RequireAuth middleware. Login uses a dummy-hash path so unknown-email and wrong-password yield the same timing/shape, narrowing user enumeration. Tokens accepted via Bearer header (native clients) or session cookie (HttpOnly, SameSite=Lax). Routes wired in api.go: POST /auth/register, /auth/login, /auth/logout. Verified with go test, go vet and an end-to-end smoke test against a real PostgreSQL container (register/login/logout/duplicate/short-pw/wrong-pw). OIDC (Phase B part 2) follows next; the issueSession helper is reused.	2026-08-05 19:05:07 +02:00

Author

SHA1

Message

Date

Tronax

729865be78

Feature: Settings screen with account, theme, profile, reset + credits

Backend:
- New GET/PUT /api/me endpoint to read and update the authenticated
  user's profile (currently display_name). UserStore.UpdateDisplayName.
- Wired into the authed router.

App:
- New SettingsScreen + SettingsViewModel with five sections:
  * Account & Sync: login status, email, server URL, logout, connect.
  * Profile: edit display name (pushed to PUT /api/me when logged in).
  * Appearance: System / Light / Dark theme switch, persisted in
    SessionManager and applied via MitbringslTheme(sessionManager).
  * Data: 'Reset local data' wipes Room tables (server data kept).
  * About: version, 'Developed by Janik Dietz', and credits to
    GLM-5.2 + Gemini 3.6 Flash.
- Theme.kt now reads the user's theme preference (StateFlow) instead
  of only the system default; MainActivity passes SessionManager in.
- Navigation: new SettingsNavKey; settings gear icon in ListsScreen
  top bar; Settings links back to the Sync/Account screen.
- DTOs/API: UpdateMeRequestDto + getMe()/updateMe() for /api/me.

2026-08-06 10:39:12 +02:00

Tronax

a5ef8cf3ba

Backend Phase B (2/2): OIDC auth + config validation

- internal/auth/oidc.go: OIDCService mit go-oidc v3
  - id_token-Verifikation via JWKS (Signatur, iss, aud, exp)
  - Provider-Caching (sync.Map, lazy init per Issuer-URL)
  - Unterstützt Google + Generic OIDC
- internal/auth/user.go: GetByOIDCSubject + CreateOIDCUser
  (find-or-create via (oidc_issuer, oidc_subject))
- internal/httpapi/auth.go: POST /auth/oidc Handler
  (id_token verifiziern → find-or-create User → issueSession)
- internal/httpapi/api.go: /auth/oidc Route verdrahtet
- internal/config/config.go: OIDC-Validierung
  (enabled → client_id + issuer Pflicht)
- go.mod/go.sum: go-oidc/v3 + oauth2 Abhängigkeiten
- AGENTS.md: Phase B vollständig als erledigt markiert

Verifiziert: E2E gegen lokalen Mock-IdP (Discovery → JWKS →
signiertes id_token → User angelegt → 2. Login gleicher User →
tampered Token → 401). Alle Fehlerpfade geprüft.

go build ./... && go vet ./... && go test ./internal/auth/... ✅

2026-08-05 19:45:00 +02:00

Tronax

7b1c18590e

Backend Phase B (1/2): password auth + sessions

Argon2id password hashing (PHC format, self-encoded/decoded without an
external lib) with constant-time verification, UserStore (create/get by
email and id) and SessionStore (opaque crypto/rand tokens, SHA-256 hashed
in DB, create/lookup/revoke, last_seen_at bump on lookup).

HTTP layer: Register/Login/Logout handlers + RequireAuth middleware.
Login uses a dummy-hash path so unknown-email and wrong-password yield the
same timing/shape, narrowing user enumeration. Tokens accepted via Bearer
header (native clients) or session cookie (HttpOnly, SameSite=Lax).

Routes wired in api.go: POST /auth/register, /auth/login, /auth/logout.
Verified with go test, go vet and an end-to-end smoke test against a real
PostgreSQL container (register/login/logout/duplicate/short-pw/wrong-pw).

OIDC (Phase B part 2) follows next; the issueSession helper is reused.

2026-08-05 19:05:07 +02:00

3 commits