3 Commits

Author	SHA1	Message	Date
RevIQ	617fa78046	Fix Session.id type and restore nested passkey routes ... - Change Session.id from number to string to match DB bigint type - Restore me.passkeys.{list,rename,delete} nested route structure - Remove unnecessary String() conversion in logout procedure - Auto-formatted procedure files Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-09 15:44:45 +08:00
RevIQ	829d365e80	Implement auth procedures with code review fixes ... Add complete auth backend (Workstream D): - Auth middleware for session/API key authentication - Signup with password or passkey (WebAuthn) - Login flow with device trust and email confirmation - Password reset and email verification - Session management and logout Utilities created: - cookies.ts: Cookie helpers and configuration - crypto.ts: Token generation and hashing - password.ts: zxcvbn validation, argon2id hashing - geo.ts: IP/location extraction from headers - email.ts: Stubbed email sending - session.ts: Session creation and device trust Code review improvements applied: - Use ORPCError instead of Error in procedures - Add ast-grep rule to enforce ORPCError usage - Remove error info leakage (generic messages) - Optimize N+1 query with JOIN in login-password - Extract signupWithPassword/signupWithPasskey for testability - Add 15-minute WebAuthn challenge expiry check - Strengthen CookieOptions type definitions Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-09 15:19:15 +08:00
RevIQ	93132d76c0	Add api-server and CLI applications ... - Create api-server with Bun.serve: - oRPC router with stub handlers for all procedures - Auth middleware placeholder - CORS configuration - Create CLI tool with stricli: - bootstrap command for initial superuser creation - Placeholder commands for auth, user, org management Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-09 11:45:03 +08:00