luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

style(13-03): apply Prettier formatting across repo

Browse Source 
Mechanical reformat — no logic changes. 398 files changed, 19125
insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc
(singleQuote:true, semi:true, tabWidth:2, trailingComma:all,
printWidth:100). Isolated per D-13-08 for reviewability.
This commit is contained in:
Lucas Berger
2026-06-11 20:35:18 -04:00
parent 4bc0445173
commit 982438dc10
398 changed files with 19050 additions and 16382 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/milestones/v1.0-phases/01-foundation-broker-spike/01-02-SUMMARY.md
+13 -12
View File
@@ -69,7 +69,7 @@ completed: "2026-06-04"
- **Task 1 (TDD):** Replaced 5 `it.todo` stubs in `tests/auth/user.test.ts` with 6 real tests covering: palette[0] first user, palette[1] second distinct user, idempotent re-upsert (no duplicate insert), identity keyed on iss+sub not email, full row shape. All GREEN.
- **Task 2:** Wired full OIDC vertical slice:
- `src/auth/middleware.ts` re-exports oidcAuthMiddleware/processOAuthCallback/getAuth from @hono/oidc-auth
- `src/index.ts` updated: /health (public) → /callback → /api/* guarded by oidcAuthMiddleware → /api/me mounted
- `src/index.ts` updated: /health (public) → /callback → /api/\* guarded by oidcAuthMiddleware → /api/me mounted
- `src/routes/me.ts` calls getAuth → upsertUser(iss, sub, email) → returns {user: {id, displayName, color}}
- `apps/pwa/src/api/client.ts` typed fetchMe() with credentials: 'include'
- `apps/pwa/src/App.tsx` renders MemberBadge (name + color swatch circle) via useQuery(['me'], fetchMe)
@@ -85,7 +85,7 @@ completed: "2026-06-04"
- `apps/api/src/auth/user.ts` — `upsertUser` + `COLOR_PALETTE` (6 hex hues)
- `apps/api/src/auth/middleware.ts` — `oidcAuthMiddleware`, `processOAuthCallback`, `getAuth` re-exports with env var documentation
- `apps/api/src/routes/me.ts` — `GET /` handler: getAuth → upsertUser → `{user: {id, displayName, color}}`
- `apps/api/src/index.ts` — updated mount order: /health → /callback → oidcAuthMiddleware on /api/* → /api/me
- `apps/api/src/index.ts` — updated mount order: /health → /callback → oidcAuthMiddleware on /api/\* → /api/me
- `apps/pwa/src/api/client.ts` — `fetchMe()` with typed response shape
- `apps/pwa/src/App.tsx` — `MemberBadge` component with `ColorSwatch`; useQuery(['me'], fetchMe); retains /health indicator
- `apps/api/tests/auth/user.test.ts` — 6 passing tests (was 5 it.todo stubs)
@@ -127,13 +127,13 @@ identity_providers:
**`.env` values to set before first run:**
| Variable | Value |
|----------|-------|
| `OIDC_AUTH_SECRET` | 32+ char random string (e.g. `openssl rand -base64 32`) |
| `OIDC_ISSUER` | Authelia base URL, e.g. `https://auth.yourdomain.com` |
| `OIDC_CLIENT_ID` | `familysync` |
| `OIDC_CLIENT_SECRET` | Plain text secret (same value used with `authelia crypto hash`) |
| `OIDC_REDIRECT_URI` | `https://familysync.yourdomain.com/callback` |
| Variable | Value |
| ------------------------ | ------------------------------------------------------------------------------- |
| `OIDC_AUTH_SECRET` | 32+ char random string (e.g. `openssl rand -base64 32`) |
| `OIDC_ISSUER` | Authelia base URL, e.g. `https://auth.yourdomain.com` |
| `OIDC_CLIENT_ID` | `familysync` |
| `OIDC_CLIENT_SECRET` | Plain text secret (same value used with `authelia crypto hash`) |
| `OIDC_REDIRECT_URI` | `https://familysync.yourdomain.com/callback` |
| `OIDC_AUTH_EXTERNAL_URL` | `https://familysync.yourdomain.com` — **mandatory** behind Pangolin (Pitfall 1) |
**Note:** `OIDC_AUTH_EXTERNAL_URL` is not optional behind Pangolin. Without it, `@hono/oidc-auth` constructs the redirect_uri from the internal container `Host` header, which won't match the registered URI in Authelia — login fails with "invalid redirect_uri".
@@ -154,7 +154,7 @@ All surfaces are within the planned threat model (Plan 02 STRIDE register):
- **T-02-02 (CSRF):** processOAuthCallback uses PKCE (state + code_verifier); Authelia configured with require_pkce: true, S256
- **T-02-03 (cookie tampering):** @hono/oidc-auth signs cookie with OIDC_AUTH_SECRET; httpOnly + Secure + SameSite enforced by library
- **T-02-04 (refresh token / client_secret):** backend-only (D-12); getAuth → upsertUser → returns {id, displayName, color} only — no token or credential data in /api/me response
- **T-02-05 (/api/* without auth):** oidcAuthMiddleware on /api/*; /health public-before-guard
- **T-02-05 (/api/\* without auth):** oidcAuthMiddleware on /api/\*; /health public-before-guard
- **T-02-06 (identity confusion):** upsertUser keyed exclusively on oidcIss + oidcSub; no email lookup anywhere in auth path
No new threat surface introduced beyond plan.
@@ -170,5 +170,6 @@ No new threat surface introduced beyond plan.
- 6 auth/user tests pass: PASSED
---
*Phase: 01-foundation-broker-spike*
*Completed: 2026-06-04*
_Phase: 01-foundation-broker-spike_
_Completed: 2026-06-04_