Phase 6: authentication, multi-user, and CSRF protection #69

Manually merged

marvin8 merged 52 commits from feat/multiuser into main 2026-10-06 04:24:28 +00:00

Conversation 1 Commits 52 Files changed 71 +8513 -1067

agent-pi commented 2026-10-06 03:53:51 +00:00

Collaborator

Copy link

Lands the Phase 6 collecting branch: three efforts making yunjin a proper multi-user application.

Effort 1 — auth, sessions, CSRF. Login/setup/logout, session-derived current_user()/require_current_user() on every route, hand-rolled synchronizer-token CSRF on all state-changing requests, per-user session revocation via users.sessions_valid_after, yunjin set-password CLI, constant-work login verification, safe ?next= redirects.

Effort 2 — data ownership. Global feeds + feed_subscriptions link table, per-user aggregates with watermark + backlog LLM aggregation and per-user no-op skips, unsubscribe with orphan-feed GC invariant, OPML and CLI scoping.

Effort 3 — account management. CLI-only account creation (yunjin create-user, no admin role), self-service password change (current-password gate; current session survives, others revoked), passkey support via webauthn 3.0.1 — username-less login, enrollment and credential management on a new Account card, 12-hour passkey sessions with a server-side replay cap — self-service account deletion with data cleanup (last-user guard in web, CLI unrestricted), yunjin create-user / delete-user CLI, docs (docs/config.md, docs/cli.md, new docs/passkeys.md and docs/account.md). Also closes a setup-gate gap that account deletion made reachable (POST /setup now enforces the recorded per-request gate).

New environment variables: YUNJIN_RP_ID, YUNJIN_ORIGIN (passkeys; disabled unless both set), plus the existing documented session/cookie variables. One dependency added (webauthn~=3.0.1). Docs updated throughout; HTTPS-on-a-stable-domain documented as the passkey prerequisite.

Test suite: 622 passing; full nox green (ty, ruff, complexipy, pysentry, pytest 3.12/3.13/3.14, deptry, zaojun).

Closes #25
Closes #65
Closes #67

Lands the Phase 6 collecting branch: three efforts making yunjin a proper multi-user application. **Effort 1 — auth, sessions, CSRF.** Login/setup/logout, session-derived `current_user()`/`require_current_user()` on every route, hand-rolled synchronizer-token CSRF on all state-changing requests, per-user session revocation via `users.sessions_valid_after`, `yunjin set-password` CLI, constant-work login verification, safe `?next=` redirects. **Effort 2 — data ownership.** Global `feeds` + `feed_subscriptions` link table, per-user aggregates with watermark + backlog LLM aggregation and per-user no-op skips, unsubscribe with orphan-feed GC invariant, OPML and CLI scoping. **Effort 3 — account management.** CLI-only account creation (`yunjin create-user`, no admin role), self-service password change (current-password gate; current session survives, others revoked), passkey support via `webauthn` 3.0.1 — username-less login, enrollment and credential management on a new Account card, 12-hour passkey sessions with a server-side replay cap — self-service account deletion with data cleanup (last-user guard in web, CLI unrestricted), `yunjin create-user` / `delete-user` CLI, docs (`docs/config.md`, `docs/cli.md`, new `docs/passkeys.md` and `docs/account.md`). Also closes a setup-gate gap that account deletion made reachable (`POST /setup` now enforces the recorded per-request gate). New environment variables: `YUNJIN_RP_ID`, `YUNJIN_ORIGIN` (passkeys; disabled unless both set), plus the existing documented session/cookie variables. One dependency added (`webauthn~=3.0.1`). Docs updated throughout; HTTPS-on-a-stable-domain documented as the passkey prerequisite. Test suite: 622 passing; full nox green (ty, ruff, complexipy, pysentry, pytest 3.12/3.13/3.14, deptry, zaojun). Closes #25 Closes #65 Closes #67

agent-pi added 52 commits 2026-10-06 03:53:51 +00:00

✨ Add user credential columns migration 6dcd63fc1c

✨ Add password hash and session validity to user model b7b3d7a2ef

✨ Add auth service with password hashing and session validity 485edf31af

♻️ Extract safe_next_path redirect helper 459bea7b03

✨ Add setup, login, and logout routes with session config 7dfc606934

🔒 Enforce authentication and CSRF across all routes ae6619a3c1

✨ Derive acting user from session on all routes 91eabdcec5

📝 Add set-password CLI and document session configuration 878248630d

🐛 Initialize database in set-password command 4411edaf17

🐛 Equalize failed-login work to prevent username enumeration b7c618a8f5

🐛 Container smoke test fetches the login page bdd5faba40

🔁 Re-trigger CI after PR #63 push non-dispatch ff1ee472c0

🔀 Merge branch 'feat/effort1-auth' into feat/multiuser 532606369f

🙈 Ignore local .pi and media directories 02553250ae

🔧 Bump dependencies and align pre-commit revisions a78fe97b3e

🔧 Switch WuMing agents to DeepSeek flash and raise diff cap to 5000 4a2457d070

🗃️ Add feed subscriptions and per-user aggregates migration e4890545a7

✨ Cluster and read aggregates per user 69a8b44391

🗃️ Add subscription model and data access layer 3bcd54ef90

✨ Add subscription service with orphan-feed GC bfdd67d766

🐛 Make subscription cleanup atomic 01551c39ee

✨ Scope feed management and OPML to the session user b0140b3a51

✨ Replace feed deletion with per-user unsubscribe 97524d35e8

📝 Add per-user CLI flags and document data ownership 1de8592b0d

📝 Fix refresh docstring and generics annotation in aggregator 821d00a07d

✅ Pin unsubscribe effect and document feed-reuse metadata 819cb9827f

🔒 Scope aggregate article links to the aggregating user c851e8af5f

✅ Assert the subscription UNIQUE constraint by indexed columns 5439ead0ca

⏪ Run the nox pytest session with plain pytest bcbf9e80fc

📝 Reword the waitress licence-ignore rationale a49c7862d6

📝 Mark reuse-ignored add-feed options in the CLI table f74f9f2f9f

✅ Cover get_articles_for_feeds and clarify unsubscribe docs 7d3b6c2b56

🔀 Merge branch 'feat/issue-65-data-ownership' into feat/multiuser f80a44a309

🗃️ Add webauthn credential schema and data access layer dc90ee96d7

➕ Add webauthn dependency 5c4d1891fa

✨ Add webauthn ceremony service d0b37300b6

🔒 Enforce per-login session lifetimes fcbfd15b6c

✨ Add username-less passkey login c4c3f0c074

✨ Add passkey enrollment and credential management 0bb3e564f5

✨ Add password change with session handling 366c86a242

✨ Add self-service account deletion with data cleanup e08d2185fd

✨ Add create-user and delete-user CLI commands 45bfb5d56a

📝 Document account management and passkeys 0ff72cf093

🐛 Close setup-gate bypass and harden registration errors ... 5ee6dc5ea4

POST /setup honored the setup gate only on GET, so a passwordless
leftover account was claimable by an anonymous visitor once any other
user was credentialed. The POST branch now checks setup_required first,
and _ensure_default_user seeds the passwordless default user only when
no users exist at all — deleting user id 1 while other users survive no
longer resurrects a claimable account, while fresh installs and full
teardowns still re-seed default and reopen setup.

Registration verify now maps the UNIQUE-constraint sqlite3.IntegrityError
from a repeated credential id to the generic 400 instead of a 500, and
finish_registration stores transports only when the client JSON carries a
genuine list.

🔒 Scope gitleaks allowlist to the public fixture vector bbc03b665f

✅ Expect IntegrityError in credential-id uniqueness test f05ef6a65b

📝 Say aggregates, not groups, in the passkey deletion docs f94e6ca018

📝 Anchor the gitleaks vector regex and round out account docs e1a8fb2068

📝 Move account docs to a dedicated page ab3edcdc4b

📝 Qualify passkey gating, operator wording, and seeded default in docs f7fba96d94

✅ Restore session lifetime config via monkeypatch d6318639e0

🔀 Merge branch 'feat/issue-67-account-management' into feat/multiuser cea51eb532

forgejo-actions commented 2026-10-06 03:53:57 +00:00

Copy link

This PR is too large to review automatically (12670 lines; limit is 5000). Please consider splitting it into smaller PRs.

This PR is too large to review automatically (12670 lines; limit is 5000). Please consider splitting it into smaller PRs.

marvin8 manually merged commit 89f26f7d68 into main 2026-10-06 04:24:28 +00:00

agent-pi referenced this pull request 2026-10-06 04:33:38 +00:00

Phase 6 hardening: authentication, multi-user, and CSRF protection #25

agent-pi referenced this pull request 2026-10-06 04:33:39 +00:00

Effort 2: make data ownership per-user (feeds, aggregates, OPML) #65

agent-pi referenced this pull request 2026-10-06 04:33:39 +00:00

Effort 3: account management (Phase 6 multi-user) #67

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

Compat/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority

Critical

The priority is critical

  

Priority

High

The priority is high

  

Priority

Low

The priority is low

  

Priority

Medium

The priority is medium

  

Reviewed

Confirmed

Issue has been confirmed

  

Reviewed

Duplicate

This issue or pull request already exists

  

Reviewed

Invalid

Invalid issue

  

Reviewed

Won't Fix

This issue won't be fixed

  

Status

Abandoned

Somebody has started to work on this but abandoned work

  

Status

Blocked

Something is blocking this issue or pull request

  

Status

Need More Info

Feedback is required to reproduce issue or to continue work

No labels

Compat/Breaking

Kind/Bug

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/Security

Kind/Testing

Priority

Critical

Priority

High

Priority

Low

Priority

Medium

Reviewed

Confirmed

Reviewed

Duplicate

Reviewed

Invalid

Reviewed

Won't Fix

Status

Abandoned

Status

Blocked

Status

Need More Info

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference

marvin8/yunjin!69

No description provided.