az/morz-infoboard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
morz-infoboard/server/backend
History
Jesko Anschütz cea393c1a0 Auth Phase 1 Review: Fix 3 critical bugs in auth foundation 
1. [SQL] Fix username uniqueness constraint
   - Changed from global unique to composite unique(tenant_id, username)
   - Multi-tenant apps need same usernames across tenants (e.g., each tenant can have 'admin')

2. [Go] Fix inconsistent error handling in scanSession
   - Now returns pgx.ErrNoRows when session not found (like scanUser)
   - Allows proper 404 vs 500 error distinction in handlers

3. [Go] Add missing VerifyPassword function
   - Implements bcrypt.CompareHashAndPassword for password verification
   - Enables login flow with proper error handling for missing users
   - Paired with existing GenerateFromPassword for secure password hashing

Security checks:
- SQL injection: All queries parameterized (no string interpolation)
- bcrypt: Cost factor 12 (production-recommended)
- Session tokens: PostgreSQL gen_random_uuid() (cryptographically secure)
- Password hashes: Protected with json:"-" tag (never exposed in responses)
- Error handling: Comprehensive, no silent failures

Build & Vet: All checks pass (go build ./..., go vet ./...)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-23 15:37:18 +01:00
..
cmd/api Lege Entwicklungsleitfaden und Go-Gerueste an 2026-03-22 13:42:00 +01:00
internal Auth Phase 1 Review: Fix 3 critical bugs in auth foundation 2026-03-23 15:37:18 +01:00
Dockerfile Bugfixes: JSON-Tags, Tenant-Lookup, Dockerfile Go-Version 2026-03-22 23:26:56 +01:00
go.mod MQTT-Playlist-Push: Änderungen erreichen Client binnen 5 Sekunden 2026-03-23 11:35:50 +01:00
go.sum MQTT-Playlist-Push: Änderungen erreichen Client binnen 5 Sekunden 2026-03-23 11:35:50 +01:00
README.md Baue Layout-Resolver und lokale Entwicklungsgerueste aus 2026-03-22 16:03:21 +01:00

README.md

Backend

Dieses Verzeichnis enthaelt das erste Geruest fuer das zentrale Backend.

Ziel fuer die erste Ausbaustufe:

  • HTTP-API in Go
  • Health-Endpunkt
  • saubere Projektstruktur fuer spaetere API-, Worker- und Datenbankmodule
  • erste serverseitige Aufloesungslogik fuer message_wall

Geplante Unterstruktur:

  • cmd/api/ fuer den API-Startpunkt
  • internal/app/ fuer App-Initialisierung
  • internal/campaigns/ fuer Kampagnen- und Template-Logik
  • internal/httpapi/ fuer HTTP-Routing und Handler
  • internal/config/ fuer Konfiguration

Aktuell vorhanden:

  • GET /healthz
  • GET /api/v1
  • GET /api/v1/meta
  • POST /api/v1/tools/message-wall/resolve als erste serverseitige Layout-Aufloesung fuer message_wall
  • einheitliches API-Fehlerformat im HTTP-Layer