mathiasandClaude Opus 4.8
dece5dec44
The Stage-1 onboarding path: an invited user opens their emailed link, sets a password, and Tapir creates their Dex local-password account so they can log in. Mounted on root OUTSIDE Auth.Middleware — the visitor has no Dex session yet; the token in the path is the capability. handleInviteForm previews the token (no consume) and shows the form, or a clear "expired / already used" page. handleInviteSubmit validates the password BEFORE consuming the token (a typo is retryable), then claims the invite exactly once, bcrypt-hashes (cost 12), and creates the Dex account — mapping ErrPasswordExists -> "log in instead" and ErrForbidden -> "contact the administrator". Off-cluster (App.Dex nil) it degrades to a "deployed-only" message without burning the token. On success it sets an account_created flash and redirects to /auth/login. Welcome sub-text now states access is invite-only. Handlers depend on narrow ports (InvitationStore, DexPasswordCreator) so tests use fakes; cmdServe wires the store + an in-cluster dex.PasswordClient. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
31 lines
1.1 KiB
AMPL
31 lines
1.1 KiB
AMPL
module gitea.d-ma.be/mathias/tapir
|
|
|
|
go 1.26.1
|
|
|
|
require (
|
|
github.com/a-h/templ v0.3.1020
|
|
github.com/coreos/go-oidc/v3 v3.18.0
|
|
github.com/fergusstrange/embedded-postgres v1.34.0
|
|
github.com/go-jose/go-jose/v4 v4.1.4
|
|
github.com/golang-migrate/migrate/v4 v4.19.1
|
|
github.com/jackc/pgx/v5 v5.9.2
|
|
github.com/stretchr/testify v1.11.1
|
|
golang.org/x/crypto v0.45.0
|
|
golang.org/x/oauth2 v0.36.0
|
|
)
|
|
|
|
require (
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/jackc/pgerrcode v0.0.0-20220416144525-469b46aa5efa // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/lib/pq v1.10.9 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/rogpeppe/go-internal v1.15.0 // indirect
|
|
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
|
|
golang.org/x/sync v0.18.0 // indirect
|
|
golang.org/x/text v0.31.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|