b90cbd2a9f
3 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Claude
|
b90cbd2a9f
|
One front door: the members area owns its own logins
Three complaints, one cause. Logging out could not finish because the session belonged to another server, whose logout is POST-only and unreachable from here. "Ese usuario ya está en uso" for somebody absent from Miembros, because erase_member deleted our row and left the git account standing — two stores of users, one of them showing. And the hand-off to a differently-designed domain, with a Forgot password that could never work. All three followed from delegating identity, so it is no longer delegated. Members now sign in at /comunidad/login against a scrypt hash in our own database, via werkzeug.security, which arrives with Flask. They have no account on the git server at all, which makes the collision impossible rather than fixed. Logout is one click. This removes more than it adds: the OAuth round trip, the client registration, tokens.py with its refresh-before-expiry logic, the gitea_tokens table, and the logged-out page that existed to apologise for a logout that did not log you out. The editor keeps per-writer attribution without per-writer tokens: one CONTENT_TOKEN commits, and each commit names its author, which Gitea's contents API supports and a test now asserts. CONTENT_TOKEN falls back to GITEA_ADMIN_TOKEN so nothing breaks on deploy, but it only needs write access to one repository, while the admin token can modify every account on the instance — and now has no remaining job. The refusals are the interesting part. Unknown name, wrong password, suspended member and invited-but-never-arrived all answer identically, asserted by comparing the rendered bytes. The hash check runs against a decoy even when there is no such member, so an unknown name does not answer faster. Attempts are rate limited, counted inside SQLite for the reason invites.py documents. A NULL hash never matches anything. Migration 2 adds password_hash and drops the dead OAuth tokens. Everyone starts NULL, including the owner, so scripts/set-password.sh exists and was tested before this could ship: it prompts without echo, never takes the password as an argument where ps would show it, and refuses a short one or an unknown member. Rehearsed against a rebuilt copy of the server's database: starts, keeps the photo, drops the tokens table, serves a login form with no redirect, signs in, signs out, stays out. 223 tests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NizVpJ2dwzCbjCrTLCjeHn |
||
|
Claude
|
73ad25a15a
|
Fix the start-up crash Phase C shipped, and test for it
The board would not start against any existing database, so Caddy had nothing to proxy to and answered 502. Reproduced by rebuilding the server's database from the previous schema and starting the app the way gunicorn does. The cause is one line of schema.sql: CREATE INDEX IF NOT EXISTS attachments_message ON attachments(message_id) IF NOT EXISTS guards the index NAME, not the column. On a database whose attachments table predates message_id, executescript dies with "no such column" — before any migration could add it, because init_db runs the schema first by design. Every index on a column a migration introduces belongs in the migration, after the column exists. It now lives there, outside the rebuild branch so a freshly created database gets it too. Second bug, latent and worse: the rebuild set PRAGMA foreign_keys = OFF inside the transaction, where it is documented to be a no-op. It looked applied and did nothing. Moved outside BEGIN. The test fixture had been passing for the wrong reason — it left foreign keys at SQLite's default, which is off — and now turns them on as connect() does. Both are the same mistake in different clothes: the tests exercised migrations.apply directly, so nothing ever ran init_db against a database from before the change. That test exists now. It builds the previous schema, inserts the row the server actually has, starts the app, and asserts the photo survived and a restart is a no-op. Verified by reinstating the bad line and watching it fail with the same error the server gave. 230 tests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NizVpJ2dwzCbjCrTLCjeHn |
||
|
Claude
|
5ab9e3cab5
|
Phase C: private messages, with blocking and photos
An inbox between two members — conversations, per-person unread marks,
photos, blocking. Not live chat: that needs a connection held open per
signed-in member, which the sync workers cannot do.
Membership of the conversation is the whole access rule and is checked on
every hit, answering 404 rather than 403 so a member cannot tell a
conversation that is not theirs from one that does not exist. A picture
in a private message is checked the same way: on the board being signed
in is enough, here it is nowhere near.
Blocking is symmetric. One row stops both directions, and you can only
lift your own. A block that silenced only the blocked person would leave
the blocker writing freely, which is a megaphone rather than a safety
feature. Enforced in the handlers, with a test that posts from a page
held open from before the block.
Erasing a member deletes their private messages, both sides, and their
pictures off disk. A thread outlives its author because other people
replied; a two-party exchange has no remainder, and keeping half of
erased correspondence is what erasure exists to prevent. The guard added
in
|