66bb0d87ab
fix(security): 删除 .env.production 并清理硬编码密码
...
ci/cd Manually approved by coordinator
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Has been cancelled
CI/CD Pipeline / Frontend Lint (pull_request) Has been cancelled
- 删除 .env.production（含占位符密钥，已从版本控制移除）
- scripts/smoke_public_*.py: 密码改为从环境变量 SMOKE_TEST_PASSWORD 读取
- infra/docker/infra.yml: POSTGRES_PASSWORD 改为引用环境变量
- packages/application/auth/jwt_handler.py: 文档示例密钥改为占位符
2026-06-27 18:10:52 +08:00
0ac81bfb1b
fix( #25 ): 移除硬编码 localhost:3000
...
- 添加 APP_BASE_URL 配置项到 Settings
- auth.py 中改用 settings.APP_BASE_URL
- register_user_use_case.py 和 password_reset_use_case.py 移除默认值
- base_url 参数改为必须由调用方传入
- 更新 .env.example 添加 APP_BASE_URL
2026-06-27 17:20:17 +08:00
c6010f490a
fix( #12 ): 实现 refresh token 查找功能
...
- 完善 _find_session_by_refresh_token() 方法
- 使用 session_store.get_session_by_refresh_token() 直接查询
- 利用 Redis 反向索引实现 O(1) 查找复杂度
2026-06-27 17:20:17 +08:00
xiaoxia
5dbde7e176
feat: add download_url field to generated video APIs ( #20 )
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Waiting to run
Tests / test (pull_request) Waiting to run
Tests / lint (pull_request) Waiting to run
CI/CD Pipeline / Validate Code Quality And Tests (push) Has been cancelled
Deploy / Deploy Staging (push) Has been cancelled
Deploy / Build Production Runtime Images (push) Has been cancelled
Deploy / Deploy Production (push) Has been cancelled
Deploy / Production Browser E2E (push) Has been cancelled
2026-06-26 21:13:18 +08:00
xiaoxia
5f3688e002
fix(P1-2): implement token refresh use case with session verification
Deploy / Deploy Staging (push) Failing after 1s
Deploy / Build Production Runtime Images (push) Has been skipped
Deploy / Deploy Production (push) Has been skipped
Deploy / Production Browser E2E (push) Has been skipped
CI/CD Pipeline / Validate Code Quality And Tests (push) Has been cancelled
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 1m0s
Tests / test (pull_request) Failing after 1m0s
Tests / lint (pull_request) Failing after 1m0s
2026-06-26 17:52:34 +08:00
114bc8aff2
chore(security): triage bandit findings
CI/CD Pipeline / Validate Code Quality And Tests (push) Failing after 12s
Deploy / Deploy Staging (push) Successful in 2m26s
Deploy / Deploy Production (push) Has been skipped
2026-06-21 13:38:46 +08:00
fa19a34f7a
feat(auth): add verification and password reset routes
CI/CD Pipeline / Validate Code Quality And Tests (push) Failing after 15s
Deploy / Deploy Staging (push) Successful in 1m57s
Deploy / Deploy Production (push) Has been skipped
2026-06-21 10:40:56 +08:00
2c3856a5a0
refactor(auth): route simple auth through use cases
CI/CD Pipeline / Validate Code Quality And Tests (push) Failing after 13s
Deploy / Deploy Staging (push) Successful in 1m48s
Deploy / Deploy Production (push) Has been skipped
2026-06-21 08:22:49 +08:00
b79d6718d6
style: normalize python formatting gates
CI/CD Pipeline / Validate Code Quality And Tests (push) Failing after 21s
Deploy / Deploy Production (push) Has been cancelled
Deploy / Deploy Staging (push) Has been cancelled
2026-06-21 06:52:19 +08:00
e5224d090b
refactor(domain): move auth infrastructure to adapters
CI/CD Pipeline / Validate Code Quality And Tests (push) Failing after 1m6s
Deploy / Deploy Staging (push) Successful in 2m14s
Deploy / Deploy Production (push) Has been skipped
2026-06-21 00:46:56 +08:00
f38df083db
fix(phase7): resolve remaining TODOs - session_id in JWT and repository injection
CI/CD Pipeline / Validate Code Quality And Tests (push) Has been cancelled
2026-06-19 09:47:20 +08:00
1aa111ffd2
feat(auth): add password reset functionality
...
Deploy / Deploy Staging (push) Failing after 6s
Deploy / Deploy Production (push) Has been skipped
Tests / test (push) Failing after 8s
Tests / lint (push) Failing after 9s
- Implement RequestPasswordResetUseCase to generate reset token
- Send password reset email with 1-hour expiration
- Implement ResetPasswordUseCase to verify token and update password
- Security: return success even if user not exists (avoid enumeration)
- Validate new password strength before reset
- Clear reset token after successful password change
- Add 9 comprehensive unit tests (all passed)
Phase 4 Task 8/68 completed
2026-06-17 01:25:53 +08:00
651bbd0142
feat(auth): add login, logout and refresh token use cases
...
Deploy / Deploy Staging (push) Failing after 8s
Deploy / Deploy Production (push) Has been skipped
Tests / test (push) Failing after 7s
Tests / lint (push) Failing after 6s
- Implement LoginUseCase with password verification and JWT token generation
- Generate user_auth token (without workspace) for initial login
- Create session with refresh_token in Redis
- Track last_login_at and last_login_ip
- Implement LogoutUseCase for single device or all devices
- Add RefreshTokenUseCase placeholder (to be implemented)
- Add 9 comprehensive unit tests (all passed)
Phase 4 Task 7/68 completed
2026-06-17 01:24:45 +08:00
424327c762
feat(auth): add user registration with email verification
...
Deploy / Deploy Staging (push) Failing after 6s
Deploy / Deploy Production (push) Has been skipped
Tests / test (push) Failing after 8s
Tests / lint (push) Failing after 7s
- Implement RegisterUserUseCase with password validation and email verification
- Implement VerifyEmailUseCase for email confirmation
- Add UserRepository interface and InMemoryUserRepository implementation
- Support duplicate email/username checking
- Generate verification tokens and send verification emails
- Add 9 comprehensive unit tests (all passed)
Phase 4 Task 6/68 completed
2026-06-17 01:20:40 +08:00
XiaoXia Bot
xiaoxia