tapir

329 Commits 5 Branches 43 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
mathiasandClaude Opus 5.5	fd74140855	test(uploads): pin the deployed idle bound and its unavailable warning (#56 ) CI / Lint / Test / Vet (pull_request) Successful in 32s Details CI / Build & Import (pull_request) Skipped Details CI / Deploy via GitOps (pull_request) Skipped Details Gatekeeper review of PR #63 (comment 15139): - the 60 s default is what production runs (cmd/tapir never sets UploadIdleTimeout) and no test covered it; 1 ns, 60 ms or 24 h all left the suite green. Pinned via export_test.go, plus a socket test with the timeout unset that accepts a body with 100 ms gaps (60 ms mutant red). - the "upload idle bound unavailable" warning, the only signal that the control did not apply, is now asserted (removing it goes red). - the deadline clear on io.EOF was redundant (net/http resets the deadline before its background read) and is removed; ADR-033 text corrected (the part can end before the body, so "cleared on clean EOF" did not hold). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-04 23:10:51 +02:00
mathiasandClaude Opus 4.8	e7c2e575d3	refactor: remove Dex local-password invite provisioning (ADR-019) Authentik owns invites now (infra ADR-0001). Delete adapters/dex, the /invite set-password UI, the tapir invite CLI, the InvitationStore/ DexPasswordCreator ports + App wiring, the invite Templ pages, and the invite Taskfile target. New users are invited via Authentik, log in via OIDC, and hit the existing /register gate. invitations table (mig 009) left in place (append-only; harmless). task check green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-07 23:01:14 +02:00
mathiasandClaude Opus 4.8	dece5dec44	feat(web): public /invite/{token} set-password + account-creation flow The Stage-1 onboarding path: an invited user opens their emailed link, sets a password, and Tapir creates their Dex local-password account so they can log in. Mounted on root OUTSIDE Auth.Middleware — the visitor has no Dex session yet; the token in the path is the capability. handleInviteForm previews the token (no consume) and shows the form, or a clear "expired / already used" page. handleInviteSubmit validates the password BEFORE consuming the token (a typo is retryable), then claims the invite exactly once, bcrypt-hashes (cost 12), and creates the Dex account — mapping ErrPasswordExists -> "log in instead" and ErrForbidden -> "contact the administrator". Off-cluster (App.Dex nil) it degrades to a "deployed-only" message without burning the token. On success it sets an account_created flash and redirects to /auth/login. Welcome sub-text now states access is invite-only. Handlers depend on narrow ports (InvitationStore, DexPasswordCreator) so tests use fakes; cmdServe wires the store + an in-cluster dex.PasswordClient. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-03 23:19:22 +02:00

Author

SHA1

Message

Date

mathiasandClaude Opus 5.5

fd74140855

test(uploads): pin the deployed idle bound and its unavailable warning (#56 )

CI / Lint / Test / Vet (pull_request) Successful in 32s

Details

CI / Build & Import (pull_request) Skipped

Details

CI / Deploy via GitOps (pull_request) Skipped

Details

Gatekeeper review of PR #63 (comment 15139):
- the 60 s default is what production runs (cmd/tapir never sets
  UploadIdleTimeout) and no test covered it; 1 ns, 60 ms or 24 h all left
  the suite green. Pinned via export_test.go, plus a socket test with the
  timeout unset that accepts a body with 100 ms gaps (60 ms mutant red).
- the "upload idle bound unavailable" warning, the only signal that the
  control did not apply, is now asserted (removing it goes red).
- the deadline clear on io.EOF was redundant (net/http resets the
  deadline before its background read) and is removed; ADR-033 text
  corrected (the part can end before the body, so "cleared on clean
  EOF" did not hold).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-04 23:10:51 +02:00

mathiasandClaude Opus 4.8

e7c2e575d3

refactor: remove Dex local-password invite provisioning (ADR-019)

Authentik owns invites now (infra ADR-0001). Delete adapters/dex, the
/invite set-password UI, the tapir invite CLI, the InvitationStore/
DexPasswordCreator ports + App wiring, the invite Templ pages, and the
invite Taskfile target. New users are invited via Authentik, log in via
OIDC, and hit the existing /register gate. invitations table (mig 009)
left in place (append-only; harmless). task check green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-07 23:01:14 +02:00

mathiasandClaude Opus 4.8

dece5dec44

feat(web): public /invite/{token} set-password + account-creation flow

The Stage-1 onboarding path: an invited user opens their emailed link,
sets a password, and Tapir creates their Dex local-password account so
they can log in. Mounted on root OUTSIDE Auth.Middleware — the visitor
has no Dex session yet; the token in the path is the capability.

handleInviteForm previews the token (no consume) and shows the form, or
a clear "expired / already used" page. handleInviteSubmit validates the
password BEFORE consuming the token (a typo is retryable), then claims
the invite exactly once, bcrypt-hashes (cost 12), and creates the Dex
account — mapping ErrPasswordExists -> "log in instead" and ErrForbidden
-> "contact the administrator". Off-cluster (App.Dex nil) it degrades to
a "deployed-only" message without burning the token. On success it sets
an account_created flash and redirects to /auth/login.

Welcome sub-text now states access is invite-only. Handlers depend on
narrow ports (InvitationStore, DexPasswordCreator) so tests use fakes;
cmdServe wires the store + an in-cluster dex.PasswordClient.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-03 23:19:22 +02:00