2 Commits

Include renames

Author	SHA1	Message	Date
Lucas Berger	c437f408bb	feat(19-03): implement POST /api/auth/local/login (rate-limit + lockout) + logout ... - Rate-limit: per-IP in-memory Map; 5 failures → 429, 10 → 423 (lockedOut) - Counter increments even on 429 so brute-force accumulates toward lockout - Timing-safe: DUMMY_HASH ensures verifyPassword runs for unknown usernames (T-19-12) - noEchoHook: Zod errors never echo submitted values (T-19-14) - Same 401 body for wrong-password and unknown-username (no enumeration) - POST+GET /local/logout clear the local-session cookie	2026-06-17 16:49:59 -04:00
Lucas Berger	be7a0aec90	feat(19-03): implement localAuthMiddleware, GET /api/auth/mode, and pre-auth route mounts ... - localAuthMiddleware: cookie→c.set('user') with Pitfall-1 guard (no-set on no-cookie path) - authMode: GET /api/auth/mode pre-auth endpoint (localEnabled:true, oidcEnabled from env+config) - localAuth: POST /api/auth/local/login (rate-limit + timing-safe), logout routes - index.ts: mount authModeRouter + localAuthRouter pre-auth; localAuthMiddleware after devAuthBypass; OIDC guard wrapped skip-when-user-set	2026-06-17 16:48:17 -04:00