4 Commits

Include renames

Author	SHA1	Message	Date
mathiasandClaude Opus 5.5	b1887e7594	test(uploads): pin the idle bound an unset App resolves to (#56) ... Round-2 gatekeeper finding: production never sets UploadIdleTimeout, so it always runs the zero-means-default branch, and nothing asserted what that branch resolved to (`idle = time.Hour` kept the suite green). Extract the resolution into App.uploadIdleTimeout(), expose it via export_test.go, and assert (&web.App{}) resolves to exactly 60s, a negative value too, and a set value is honoured. Verified red against the time.Hour mutant before implementing. Rename the socket test to what it observes: ...AnUnsetIdleTimeoutDoesNotCutABodyWithSubSecondGaps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 06:55:04 +02:00
mathiasandClaude Opus 5.5	fd74140855	test(uploads): pin the deployed idle bound and its unavailable warning (#56) ... Gatekeeper review of PR #63 (comment 15139): - the 60 s default is what production runs (cmd/tapir never sets UploadIdleTimeout) and no test covered it; 1 ns, 60 ms or 24 h all left the suite green. Pinned via export_test.go, plus a socket test with the timeout unset that accepts a body with 100 ms gaps (60 ms mutant red). - the "upload idle bound unavailable" warning, the only signal that the control did not apply, is now asserted (removing it goes red). - the deadline clear on io.EOF was redundant (net/http resets the deadline before its background read) and is removed; ADR-033 text corrected (the part can end before the body, so "cleared on clean EOF" did not hold). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-04 23:10:51 +02:00
mathiasandClaude Opus 4.8	e7c2e575d3	refactor: remove Dex local-password invite provisioning (ADR-019) ... Authentik owns invites now (infra ADR-0001). Delete adapters/dex, the /invite set-password UI, the tapir invite CLI, the InvitationStore/ DexPasswordCreator ports + App wiring, the invite Templ pages, and the invite Taskfile target. New users are invited via Authentik, log in via OIDC, and hit the existing /register gate. invitations table (mig 009) left in place (append-only; harmless). task check green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-07 23:01:14 +02:00
mathiasandClaude Opus 4.8	dece5dec44	feat(web): public /invite/{token} set-password + account-creation flow ... The Stage-1 onboarding path: an invited user opens their emailed link, sets a password, and Tapir creates their Dex local-password account so they can log in. Mounted on root OUTSIDE Auth.Middleware — the visitor has no Dex session yet; the token in the path is the capability. handleInviteForm previews the token (no consume) and shows the form, or a clear "expired / already used" page. handleInviteSubmit validates the password BEFORE consuming the token (a typo is retryable), then claims the invite exactly once, bcrypt-hashes (cost 12), and creates the Dex account — mapping ErrPasswordExists -> "log in instead" and ErrForbidden -> "contact the administrator". Off-cluster (App.Dex nil) it degrades to a "deployed-only" message without burning the token. On success it sets an account_created flash and redirects to /auth/login. Welcome sub-text now states access is invite-only. Handlers depend on narrow ports (InvitationStore, DexPasswordCreator) so tests use fakes; cmdServe wires the store + an in-cluster dex.PasswordClient. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-03 23:19:22 +02:00