23 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	d2fe767471	Round session cookie Max-Age without overflowing ... Adding time.Second-1 to MEALQUEST_SESSION_MAX overflowed time.Duration near its largest accepted value, giving a negative MaxAge that net/http sends as Max-Age=0. Divide by time.Second and increment the quotient when there is a remainder instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 10:13:52 -04:00
dev_agentandClaude Opus 5.5	52664ad64b	Round session cookie Max-Age up to whole seconds ... A maximum session lifetime with fractional seconds (e.g. 2500ms) was truncated to a 2-second cookie Max-Age, so the browser dropped the cookie before the server-side absolute limit. Round up instead; the stored expires_at keeps the configured duration. Fixes review finding MQ-19-2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 10:11:10 -04:00
dev_agentandClaude Opus 5.5	60c3538967	Reject session lifetimes finer than stored millisecond precision ... MEALQUEST_SESSION_IDLE and MEALQUEST_SESSION_MAX must now be whole milliseconds: session expiry is stored as a store.Timestamp, so a value such as 1500us would be truncated and a session could expire early. Fixes review finding MQ-19-1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 10:08:46 -04:00
dev_agentandClaude Opus 5.5	1dfba7b9db	Add server-side sessions, session cookie and logout ... A successful OIDC callback now creates a sessions row through the new auth.SessionManager: a random 256-bit ID whose SHA-256 hash is the only stored form, the subject, email, name and groups claims, a separate random CSRF token and created/last_seen/expires timestamps. The ID travels only in the __Host-mealquest_session cookie (HttpOnly, Secure, SameSite=Lax, Path=/, no Domain). SessionFor rejects a session unused for MEALQUEST_SESSION_IDLE or older than MEALQUEST_SESSION_MAX, deletes it, and otherwise slides last_seen_at. POST /auth/logout deletes the row, clears the cookie and redirects to the provider's end_session_endpoint, which discovery now requires. The session lifetimes are optional configuration (defaults 720h and 4320h, per D-004); set values must be positive with MAX at least IDLE. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 10:02:17 -04:00
dev_agent	99c8f1625f	Feature 03 task 1: OIDC login and callback against Authentik (#16) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 09:58:05 -04:00
approver_agent	19ea8d52d8	Merge pull request 'Feature 02: SQLite Data Layer and Schema' (#14) from feature/b9c21d67-bf72-411a-901d-77e57352d398-sqlite-data-layer-and-schema into dev	2026-10-03 09:30:47 -04:00
dev_agent	c1a868c48b	Feature 02 integration fix: repository coverage and boot-path tests (#15) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 09:27:22 -04:00
dev_agent	17a69f4de7	Feature 02 task 4: sqlc configuration and core queries (#13) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 09:15:40 -04:00
dev_agent	fa7c6b7218	Feature 02 task 3: Initial v1 schema migration (#12) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 09:06:21 -04:00
dev_agent	b06d1680a3	Feature 02 task 2: Store helpers: transactions, ULIDs and time conventions (#11) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 08:54:55 -04:00
dev_agent	e9ee4e768a	Feature 02 task 1: SQLite connection and embedded migration runner (#10) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 00:54:02 -04:00
approver_agent	65b27a7689	Merge pull request 'Feature 01: Repository Scaffold and CI' (#8) from feature/19ad7feb-aba0-4b76-ab70-c47d71ed5e76-repository-scaffold-and-ci into dev	2026-10-03 00:40:39 -04:00
dev_agent	645b3c00b2	Feature 01 integration fix: CI build parity with make build (#9) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 00:36:48 -04:00
dev_agent	9f4537d0cb	Feature 01 task 6: AGENTS.md, CLAUDE.md, README and architecture docs (#7) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 00:26:15 -04:00
dev_agent	ec13423b6f	Feature 01 task 5: Gitea Actions CI workflow (#6) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 00:12:39 -04:00
dev_agent	c28dff18cd	Feature 01 task 4: Makefile and multi-stage Dockerfile (#5) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-02 23:06:58 -04:00
dev_agent	85569b451f	Feature 01 task 3: Embed the PWA build with SPA fallback (#4) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-02 22:47:01 -04:00
dev_agent	f0b2696059	Feature 01 task 2: Vite React TypeScript web skeleton (#3) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-02 22:26:34 -04:00
dev_agent	e3d8c4d73d	Feature 01 task 1: Go module, fail-fast config and /health (#2) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-02 22:20:34 -04:00
overseer	d2dc58a2ec	Merge pull request 'Design files' (#1) from main into dev ... Reviewed-on: #1	2026-10-02 15:10:15 -04:00
Joshua King	3a83e6c942	Design files	2026-10-02 15:09:42 -04:00
Joshua King	3f2ba4ed21	adding in design files	2026-10-02 12:23:10 -04:00
Joshua King	ef7b8cbd82	first commit	2026-10-02 10:18:10 -04:00