Adopt webcore auth via wrapper Manager - #156
Open
sarg3nt wants to merge 1 commit into
Open
Conversation
The security-critical auth mechanics now live in webcore/core/auth; gearbox's Manager is a thin wrapper with an unchanged public API, so all 60+ handler call sites, main.go wiring, and templates compile untouched. - adapter.go: authUser adapts *models.User to webcore's AuthUser (adapter struct because User.ID the field collides with ID() the method), preserving gearbox's historical status messages; userStore maps webcore's UserStore onto database.DB; auditLogger writes webcore's audit actions (string values identical to gearbox's AuditAction*) to the audit_logs table. - auth.go: 827 lines -> 216. Login/Logout/GetUser/CSRF/ExtendSession/ ChangePassword/SetPassword/reset flows delegate to webcore; gearbox keeps SetPasswordAndEmail (atomic combined update), permissions/RBAC, GetDB, LogAudit. Same cookie name, session keys, and secret — existing sessions survive the cutover. - middleware.go: RequireAuth delegates to webcore (which owns the login redirect + dev bypass) and re-maps the user into gearbox's context as a concrete *models.User; RequirePasswordChange/RequireCSRF delegate. RequireAdmin + all gear/box context helpers stay. - password.go/security.go: re-exports of webcore's policy + token helpers (identical constants). - dev_bypass_on/off.go: bypass logic moved to webcore (-tags dev only); gearbox keeps seeding (unusable random-password hash) and the banner. - WebAuthn deliberately untouched: gearbox encodes credential IDs as []byte(user.ID); webcore's adapter uses uint64 BE — switching would invalidate every registered passkey. - Tests: the absolute-timeout, legacy-anchoring, and cookie-MaxAge tests moved to webcore/core/auth with the internals they poke; SetSecure is now asserted behaviorally via the Set-Cookie attribute. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #148. Stacked on #155 (retargets to main automatically when that merges).
The security-critical auth mechanics (DB-validated session tokens, constant-time login, CSRF, password change/reset, the
-tags devloopback bypass) now come from webcore/core/auth. Gearbox'sauth.Manageris a thin wrapper with an unchanged public API — all 60+GetUserFromContextcall sites, handlers, templates, and main.go compile untouched. Net −1131 lines.adapter.go:authUseradapts*models.Userto webcore'sAuthUser(adapter struct because theIDfield collides with the interface'sID()method), preserving gearbox's historical status messages;userStore/auditLoggermap webcore's interfaces ontodatabase.DB(audit action strings are identical — no mapping).RequireAdmin, andSetPasswordAndEmailstay gearbox-side.[]byte(user.ID); webcore's adapter uses uint64 BE — switching would invalidate every registered passkey.cf94647).Verification
go build+go testgreen on both default and-tags dev. Full E2E smoke suite against a live server + real SQLite store:/,gearbox-sessionset?error=Invalid+CSRF+token/loginlocked_untilset → correct password rejected, no sessionPasskey ceremony not smoke-tested (needs an authenticator); the WebAuthn code path is byte-identical to main and
CreateSessionForUserdelegation is covered by webcore's unit suite.🤖 Generated with Claude Code