Branch feature/webcore-adoption already cut over errors, crypto, and the UI components to webcore. Auth is the remaining high-value cutover and the most security-sensitive.
Approach: wrapper, not replacement
Auth is deeply woven: 182 HasPermission, 64 GetUserFromContext (returns concrete *models.User), 41 GetUserPermissions. Do NOT rewrite those. Instead:
- gearbox keeps its entire RBAC + context surface (all call sites untouched;
GetUserFromContext still returns *models.User).
- gearbox's
auth.Manager delegates ONLY the security-critical mechanics to an embedded webcore/core/auth.Manager: session-token, Login, Logout, GetUser, CSRF, ChangePassword/SetPassword, password reset, dev loopback bypass (~500 lines deleted from gearbox auth.go).
Steps
models.User implements webcore auth.AuthUser (ID() string, Email(), PasswordHash(), IsLocked(), StatusError(), MustChangePassword()).- Implement webcore
auth.UserStore over database.DB (wrap existing GetUserByEmail/ByID/SetUserSessionToken/ValidateSessionToken/ClearUserSessionToken/UpdateUserPassword/SetPasswordResetToken/GetUserByResetToken/RecordLoginAttempt to return AuthUser; return untyped-nil on not-found).
- Implement webcore
auth.AuditLogger from gearbox's logAudit.
- Rewire gearbox
Manager to delegate to webcore Manager; GetUser type-asserts AuthUser -> *models.User. Set DevBypassEnvVar=GEARBOX_DEV_AUTO_LOGIN. Seed dev user app-side (already done).
- crypto: already on
NewFromHashedKey (compat) — no change.
Definition of done
go build ./... && go test ./... green.- Manual smoke test (REQUIRED — security path): form login, logout, wrong-password, locked-account, CSRF reject on bad token, password change invalidates session,
-tags dev loopback bypass, passkey login.
See webcore docs/PROGRESS.md -> cutover playbook.
Branch
feature/webcore-adoptionalready cut over errors, crypto, and the UI components to webcore. Auth is the remaining high-value cutover and the most security-sensitive.Approach: wrapper, not replacement
Auth is deeply woven: 182
HasPermission, 64GetUserFromContext(returns concrete*models.User), 41GetUserPermissions. Do NOT rewrite those. Instead:GetUserFromContextstill returns*models.User).auth.Managerdelegates ONLY the security-critical mechanics to an embeddedwebcore/core/auth.Manager: session-token, Login, Logout, GetUser, CSRF, ChangePassword/SetPassword, password reset, dev loopback bypass (~500 lines deleted from gearboxauth.go).Steps
models.Userimplements webcoreauth.AuthUser(ID() string,Email(),PasswordHash(),IsLocked(),StatusError(),MustChangePassword()).auth.UserStoreoverdatabase.DB(wrap existing GetUserByEmail/ByID/SetUserSessionToken/ValidateSessionToken/ClearUserSessionToken/UpdateUserPassword/SetPasswordResetToken/GetUserByResetToken/RecordLoginAttempt to returnAuthUser; return untyped-nil on not-found).auth.AuditLoggerfrom gearbox'slogAudit.Managerto delegate to webcore Manager;GetUsertype-assertsAuthUser->*models.User. SetDevBypassEnvVar=GEARBOX_DEV_AUTO_LOGIN. Seed dev user app-side (already done).NewFromHashedKey(compat) — no change.Definition of done
go build ./... && go test ./...green.-tags devloopback bypass, passkey login.See webcore
docs/PROGRESS.md-> cutover playbook.