Daniel Noulet c7c81fb65c feat: account menu, database roles, and single logout

Bundles the console work from the current branch: the header account
control, database-backed roles and permissions, and signing out across
the applications that share this sign-in.

The account control replaces a separate identity chip and a separate
sign-out button, which meant the header carried two controls describing
one fact. web/account.js is mounted into every page by a placeholder and
owns the keyboard handling, the outside-click behaviour and the sign-out
form once. It also fills the trigger's name, which the previous markup
left empty.

Signing out revokes the hosted-login bearer sessions this installation
issued, then redirects to the provider's end_session_endpoint when the
discovery document advertises one. Applications that authenticate
against this installation therefore lose their session too; one pointed
straight at an identity provider is out of its reach and is unchanged.

Roles and permissions become rows rather than a closed enum, so a tenant
can extend the catalog without a migration, and a role can no longer be
granted a capability that is not in it. requireSameOrigin now compares
against the origin the request arrived on instead of the configured base
URL, which defaulted to http://localhost:8080 and so rejected every
write in a deployment that never set it.

Two bugs found while verifying in a browser:

  - A profile picture never rendered. avatarURL built an absolute URL
    from the configured base URL, and the page's own img-src 'self'
    blocked it. The console's own pages now take a root-relative path;
    only /connect/userinfo, read from another origin, needs an absolute
    one, and it follows the request.
  - absoluteURL preferred the configuration over the request while its
    comment claimed the opposite, which also misdirected the logout
    redirect.

Card layout: the footer was one two-column row shared between a label
and a forty-character identifier, so the identifier took the width and
crushed its label into three stacked words. Each pair is a line now, the
value truncates with the full text in the title, and cards align their
footers across a row.

2026-10-05 19:18:07 +02:00

3.1 KiB

Raw Blame History

Coding standards

Go

Use the standard library unless a dependency clearly reduces security or protocol risk.
Keep public APIs small, documented, and backward compatible.
Pass context.Context through I/O boundaries and always bound network calls with timeouts.
Wrap errors with the operation; never log secrets, cookies, authorization headers, or full API keys.
Return explicit errors. Runtime authorization must fail closed.
Keep SQL tenant-aware: management queries must join through membership, and writes must enforce role in the query or transaction.
Derive authorization from the database role and permission tables instead of hardcoding role names. Resolve a member's capabilities by joining role_permissions, render controls from the capability lists the server returns, and keep internal/role limited to the permission vocabulary shared with the migrations.
Use cryptographically secure randomness for credentials and constant-time comparison for signatures.
Format with gofmt; run go test -race ./..., go vet ./..., and go build ./....

HTTP API

Routes are versioned under /api/v1; health and authentication routes are infrastructure exceptions.
JSON handlers reject unknown fields, extra JSON values, and oversized bodies.
Errors use {"error":"human-readable message"} without internal implementation details.
Use 401 for absent/unusable authentication, 403 for authenticated credentials outside policy, 404 when existence must not disclose access, and 422 for semantically invalid contracts.
Any management mutation requires a valid user session and same-origin browser request.
Update web/openapi.json whenever endpoint behavior changes.

Database

Use UUID primary keys for tenant data and UTC timestamptz timestamps.
Foreign keys declare deletion behavior; frequently queried authorization fields get explicit indexes.
Applied migrations are immutable and forward-compatible.
Multi-step writes use transactions. Do not add application-side checks that can race when a database constraint can enforce the invariant.

Frontend

Preserve keyboard access, semantic elements, visible focus, responsive layout, and sufficient contrast in every theme.
Escape all server-provided strings before assigning HTML. Prefer textContent for new dynamic surfaces.
Store only visual preferences in local storage; authentication remains in HTTP-only cookies.
Keep the console dependency-free unless complexity justifies a reviewed build tool decision.

Tests and reviews

New domain behavior needs table-driven unit tests and negative cases.
Security boundaries need explicit tests for missing, malformed, expired, cross-tenant, and unauthorized inputs.
Integration tests that need PostgreSQL should use a disposable database and never shared developer data.
Reviews prioritize tenant isolation, fail-closed behavior, migration compatibility, secret handling, and error visibility.

Commit style

Use focused commits with imperative subjects, for example Add scoped API key authorization. Do not mix unrelated refactors with behavior changes. Explain migration and security implications in the commit body.

3.1 KiB Raw Blame History