saqib mirandClaude Sonnet 5
79bc2ef25b
Closes the two gaps 010-identity-auth explicitly deferred (password reset, login rate-limiting), plus a shared password-strength validator both the reset-consume endpoint and admin account creation now depend on. - Password reset: single-use, paired-Redis-key tokens (never in Postgres), identical response regardless of account existence, stubbed delivery via a structured log line (no email infrastructure exists yet). - Password strength: one validatePasswordStrength() call site, wired into both POST /admin/users and the reset-consume flow. - Login rate-limiting: checkRateLimit keyed by submitted email, checked before any credential verification. Also fixes tests/helpers/auth.ts's shared loginAs() helper, which reused two fixed accounts across the whole integration suite via upsert — now rate-limited per email, that collided across ~30 files sharing one budget. Each call now gets a unique email; no call sites needed to change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
23 lines
849 B
TypeScript
23 lines
849 B
TypeScript
import { FastifyInstance } from 'fastify';
|
|
import { authController } from '../controller';
|
|
|
|
export async function authRoutes(fastify: FastifyInstance): Promise<void> {
|
|
fastify.post('/auth/login', (req, reply) => authController.handleLogin(req, reply));
|
|
|
|
fastify.get('/auth/me', { preHandler: fastify.authenticate }, (req, reply) =>
|
|
authController.getCurrentUser(req, reply),
|
|
);
|
|
|
|
fastify.post('/auth/logout', { preHandler: fastify.authenticate }, (req, reply) =>
|
|
authController.handleLogout(req, reply),
|
|
);
|
|
|
|
// 013-auth-hardening: ungated, like login itself — the caller has no session yet.
|
|
fastify.post('/auth/password-reset/request', (req, reply) =>
|
|
authController.requestPasswordReset(req, reply),
|
|
);
|
|
fastify.post('/auth/password-reset/consume', (req, reply) =>
|
|
authController.resetPassword(req, reply),
|
|
);
|
|
}
|