France
Joined on 2026-08-19
Block a user
9b47685002
refac: split the auth handler into registration and login, account verification, and password reset handlers, each with its own dependencies
3282b0580c
fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id
cbb403011a
fix: login and password reset requests are rate-limited per client (not in the README; there is currently no brute-force protection on the public auth routes)
f3ec3d2fa2
fix: resetting the password or cancelling a registration ends existing sessions: a token issued before the change is refused
81c4b62175
fix: reading a single article follows the same rule as the list: anyone can read an online article, a verified user can also read an offline one, and an unknown or hidden id returns 404
2ee28203ab
fix: API responses never include a user's password, verification code or reset code hashes, or their expiry dates; verifying an account returns only the public user fields
6d510d2805
refac: register only open while no verified acc exists, enforced by a use case rather than handler & sends verification email whose link uses the conf pub URL whose code expires after 2h
6e9e108033
refac: several unverified users can exist at once: an empty reset or verification code is stored as no value so it doesn't break the unique constraint, and deleting a user removes the row so the same username and email can register again
0b4e614ec9
refac: runtime settings are read once at startup and passed in through the composition root; no handler, router or repository reads environment variables
e474f03d91
refac: authenticated user can upload an image to an existing article and receives its public location; an unknown article returns 404 and a disallowed type returns 400
5992c8598b
refac: allowed image types and the size limit are a domain rule checked by the use case, not by the persistence layer
8a8a24434a
refac: deleting an article also deletes its images, and deleting a missing article returns 404
8822bdddd0
refac: authenticated user can publish and unpublish an article; an unknown id returns 404