Tronax/mitbringsl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
2 commits 1 branch 0 tags 1 MiB
Find a file
Tronax 7b1c18590e
Backend Phase B (1/2): password auth + sessions 
Argon2id password hashing (PHC format, self-encoded/decoded without an
external lib) with constant-time verification, UserStore (create/get by
email and id) and SessionStore (opaque crypto/rand tokens, SHA-256 hashed
in DB, create/lookup/revoke, last_seen_at bump on lookup).

HTTP layer: Register/Login/Logout handlers + RequireAuth middleware.
Login uses a dummy-hash path so unknown-email and wrong-password yield the
same timing/shape, narrowing user enumeration. Tokens accepted via Bearer
header (native clients) or session cookie (HttpOnly, SameSite=Lax).

Routes wired in api.go: POST /auth/register, /auth/login, /auth/logout.
Verified with go test, go vet and an end-to-end smoke test against a real
PostgreSQL container (register/login/logout/duplicate/short-pw/wrong-pw).

OIDC (Phase B part 2) follows next; the issueSession helper is reused.
2026-08-05 19:05:07 +02:00
backend Backend Phase B (1/2): password auth + sessions 2026-08-05 19:05:07 +02:00
deploy Backend Phase A: foundation, migrations, Docker setup 2026-08-05 15:14:37 +02:00
.gitignore Backend Phase A: foundation, migrations, Docker setup 2026-08-05 15:14:37 +02:00
AGENTS.md Backend Phase B (1/2): password auth + sessions 2026-08-05 19:05:07 +02:00
README.md Backend Phase A: foundation, migrations, Docker setup 2026-08-05 15:14:37 +02:00

README.md

Mitbringsl

Eine Local-First Einkaufslisten-App – eine schlanke, werbefreie Bring-Alternative. Android-App (Kotlin + Jetpack Compose) mit eigenem Go-Backend (PostgreSQL, Docker), OIDC-Login (Google + Generic) und verlustfreiem Sync.

Status: Work in Progress / MVP.

Was das Projekt kann (Ziel)

  • 📝 Einkaufslisten anlegen, Items verwalten, an-/abhaken
  • 🔄 Local-First: voll funktionsfähig offline, automatischer Sync ohne Datenverluste (Append-only Operations-Log + Hybrid Logical Clocks + Tombstones)
  • 👤 Anmeldung mit eigenen Usern (E-Mail/Passwort, Argon2id) oder OIDC (Google + beliebiger Generic-OIDC-Provider wie Keycloak/Authentik)
  • 🔍 Autocomplete beim Tippen – Vorschläge aus den aggregierten Item-Namen aller User
  • 🚫 Keine Werbung – cleanes Material-3-Design
  • 🐳 Self-hosted als Docker-Container, automatisches HTTPS via Caddy

Repository-Aufbau

mitbringsl/
├── backend/   # Go-API (net/http, pgx, sqlc, golang-migrate, go-oidc)
├── android/   # Android-App (Kotlin, Jetpack Compose, Room, Hilt, WorkManager)
├── deploy/    # docker-compose.yml, Caddyfile, .env.example
└── docs/      # Architektur-, Sync- und API-Doku

Schnellstart

Backend (Docker)

cd deploy
cp .env.example .env          # Werte anpassen (v.a. Secrets/URLs)
docker compose up -d --build
# API unter https://<deine-domain> (oder http://localhost:8080 ohne Caddy)

App bauen

Siehe android/README.md (folgt).

Detaillierte Doku:

Lizenz

Privatprojekt – alle Rechte vorbehalten.