amaurycoudr/chess-project
2
0
Fork 0
Code Issues 17 Pull requests 2 Projects Releases Packages 1 Activity Actions 1

Accounts and Sessions on the wire: sign up, sign in, sign out and refresh behind the guard #378

New issue
Closed
opened 2026-10-11 16:26:46 +00:00 by root · 22 comments
root commented 2026-10-11 16:26:46 +00:00 (Migrated from gitlab.core-project.space)
Copy link

Imported from GitHub amaurycoudr/chess-project#378, opened by @amaurycoudr on 2026-10-11 16:26 UTC.

Parent

#364

What to build

A Player can create an Account with an email, a password and a Username, and is signed in as soon as it exists. They can sign in from any browser with their email in any letter case, sign out of this browser only, and stay signed in for 30 days after last use. Each signed-in browser is a Session: one Postgres row and the two cookies ADR 0030 names, rotated on refresh with the 30-second grace. A global guard reads the access cookie. Each procedure declares one of three modes: required, optional (every Room and game procedure, and account.me) or none (sign-up, sign-in, refresh). An expired or invalid access token is UNAUTHORIZED in every mode, never an anonymous call. A deleted Account is refused at once.

This ticket also writes the Username ADR, adds Username to the glossary and rewords Account. It makes the signing secret required config, and confirms that Chromium keeps Secure and __Host- cookies on plain-HTTP localhost before anything builds on them.

Seam: loadConfig; the RPC wire (the real app in process on the PGlite database, with a cookie jar per client, a fake clock and a cheap hash cost)

Acceptance criteria

  • auth.signUp, signIn, signOut, refresh, usernameAvailability and account.me exist in the contract, resource-oriented, with the errors the spec lists (EMAIL_TAKEN, USERNAME_TAKEN, USERNAME_NOT_ALLOWED, INVALID_CREDENTIALS, UNAUTHORIZED); UNAUTHORIZED joins the refusal status table as 401
  • Sign-up, sign-in and sign-out set and clear both cookies with exactly ADR 0030's names and attributes; the access cookie lives as long as the Session while the JWT inside expires in 15 minutes
  • The Username follows the format (3 to 20 characters, ASCII letters, digits, _, -) and the server-side reserved and blocked lists, each refusal tested; email and Username are unique ignoring case, tested with the other letter case; the availability read answers free, taken or not allowed
  • Passwords are refused under 8 characters and over 72 bytes; sign-in with an unknown email and with a wrong password give the same INVALID_CREDENTIALS, with a dummy hash compared for the unknown email
  • Refresh rotates the token and pushes expiry to 30 days; the replaced token works within 30 seconds and revokes the Session after; an unknown token and a token after sign-out fail; a failed refresh answers UNAUTHORIZED and clears both cookies
  • An expired access token on a Room read is UNAUTHORIZED; no cookie at all is a Spectator; a deleted Account's still-valid access token is refused
  • Only hashes of passwords and refresh tokens are stored
  • The RPC context carries the optional Account (id and Username) beside the Guest
  • loadConfig requires the signing secret, tested beside the existing config tests; dev, CI, previews and production provide it, so every stack still boots
  • Chromium's handling of both cookies on plain-HTTP localhost is confirmed and recorded in the PR body
  • The Username ADR and its index row land; GLOSSARY gains Username (aliases to avoid: display name, handle, nickname, login) and the reworded Account
  • The PR body proposes rewording the API standards' "one feature module" and Seat token header lines
  • The API's new auth/ folder is declared in the API's layer order and framework-import rules (the owner ruled on the accounts breakdown that declaring a folder the spec creates counts as the requested lint change; nothing else in lint config changes)
  • The owner has created production's signing secret before the spec reaches main, so production still boots
  • The ADR is this ticket's first commit, before any code it governs
> _Imported from GitHub [amaurycoudr/chess-project#378](https://github.com/amaurycoudr/chess-project/issues/378), opened by [@amaurycoudr](https://github.com/amaurycoudr) on 2026-10-11 16:26 UTC._ <!-- github-issue:378 --> --- ## Parent #364 ## What to build A **Player** can create an **Account** with an email, a password and a **Username**, and is signed in as soon as it exists. They can sign in from any browser with their email in any letter case, sign out of this browser only, and stay signed in for 30 days after last use. Each signed-in browser is a **Session**: one Postgres row and the two cookies ADR 0030 names, rotated on refresh with the 30-second grace. A global guard reads the access cookie. Each procedure declares one of three modes: required, optional (every **Room** and `game` procedure, and `account.me`) or none (sign-up, sign-in, refresh). An expired or invalid access token is UNAUTHORIZED in every mode, never an anonymous call. A deleted **Account** is refused at once. This ticket also writes the Username ADR, adds **Username** to the glossary and rewords **Account**. It makes the signing secret required config, and confirms that Chromium keeps `Secure` and `__Host-` cookies on plain-HTTP localhost before anything builds on them. Seam: `loadConfig`; the RPC wire (the real app in process on the PGlite database, with a cookie jar per client, a fake clock and a cheap hash cost) ## Acceptance criteria - [ ] `auth.signUp`, `signIn`, `signOut`, `refresh`, `usernameAvailability` and `account.me` exist in the contract, resource-oriented, with the errors the spec lists (`EMAIL_TAKEN`, `USERNAME_TAKEN`, `USERNAME_NOT_ALLOWED`, `INVALID_CREDENTIALS`, `UNAUTHORIZED`); `UNAUTHORIZED` joins the refusal status table as 401 - [ ] Sign-up, sign-in and sign-out set and clear both cookies with exactly ADR 0030's names and attributes; the access cookie lives as long as the **Session** while the JWT inside expires in 15 minutes - [ ] The **Username** follows the format (3 to 20 characters, ASCII letters, digits, `_`, `-`) and the server-side reserved and blocked lists, each refusal tested; email and **Username** are unique ignoring case, tested with the other letter case; the availability read answers free, taken or not allowed - [ ] Passwords are refused under 8 characters and over 72 bytes; sign-in with an unknown email and with a wrong password give the same `INVALID_CREDENTIALS`, with a dummy hash compared for the unknown email - [ ] Refresh rotates the token and pushes expiry to 30 days; the replaced token works within 30 seconds and revokes the **Session** after; an unknown token and a token after sign-out fail; a failed refresh answers UNAUTHORIZED and clears both cookies - [ ] An expired access token on a **Room** read is UNAUTHORIZED; no cookie at all is a **Spectator**; a deleted **Account**'s still-valid access token is refused - [ ] Only hashes of passwords and refresh tokens are stored - [ ] The RPC context carries the optional **Account** (id and **Username**) beside the **Guest** - [ ] `loadConfig` requires the signing secret, tested beside the existing config tests; dev, CI, previews and production provide it, so every stack still boots - [ ] Chromium's handling of both cookies on plain-HTTP localhost is confirmed and recorded in the PR body - [ ] The Username ADR and its index row land; GLOSSARY gains **Username** (aliases to avoid: display name, handle, nickname, login) and the reworded **Account** - [ ] The PR body proposes rewording the API standards' "one feature module" and Seat token header lines - [ ] The API's new `auth/` folder is declared in the API's layer order and framework-import rules (the owner ruled on the accounts breakdown that declaring a folder the spec creates counts as the requested lint change; nothing else in lint config changes) - [ ] The owner has created production's signing secret before the spec reaches `main`, so production still boots - [ ] The ADR is this ticket's first commit, before any code it governs
root commented 2026-10-11 16:26:46 +00:00 (Migrated from gitlab.core-project.space)
Copy link

GitHub issue relations, imported as "related" links (GitLab CE has no sub-issues or blocking links).

> _GitHub issue relations, imported as "related" links (GitLab CE has no sub-issues or blocking links)._ <!-- github-relations --> - Parent (sub-issue of): #364 - Blocked by: #377, #376 - Blocking: #382, #379
root commented 2026-10-13 08:39:47 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in issue #379

mentioned in issue #379
root commented 2026-10-13 08:39:49 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in issue #382

mentioned in issue #382
root commented 2026-10-13 08:41:22 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in issue #364

mentioned in issue #364
root commented 2026-10-13 08:41:26 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in issue #376

mentioned in issue #376
root commented 2026-10-13 08:41:26 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in issue #377

mentioned in issue #377
root commented 2026-10-13 08:42:28 +00:00 (Migrated from gitlab.core-project.space)
Copy link

marked this issue as related to #364

marked this issue as related to #364
root commented 2026-10-13 08:42:36 +00:00 (Migrated from gitlab.core-project.space)
Copy link

marked this issue as related to #376

marked this issue as related to #376
root commented 2026-10-13 08:42:37 +00:00 (Migrated from gitlab.core-project.space)
Copy link

marked this issue as related to #377

marked this issue as related to #377
root commented 2026-10-13 08:42:37 +00:00 (Migrated from gitlab.core-project.space)
Copy link

marked this issue as related to #382

marked this issue as related to #382
root commented 2026-10-13 08:42:37 +00:00 (Migrated from gitlab.core-project.space)
Copy link

marked this issue as related to #379

marked this issue as related to #379
root commented 2026-10-14 10:36:00 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 32b51615a2

mentioned in commit 32b51615a24ac9e2fad9336ba84e37025f6d1f03
root commented 2026-10-14 10:36:00 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 045e0c70f1

mentioned in commit 045e0c70f1a616271ade5d8e8e992125efd74ce8
root commented 2026-10-14 10:36:01 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 71fdd96928

mentioned in commit 71fdd969287abb61120dc70a2789419dd647522c
root commented 2026-10-14 10:36:01 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit a6157e1eee

mentioned in commit a6157e1eeed3447cb75cdf29d988ceae3a2364b8
root commented 2026-10-14 10:36:01 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 0634afd438

mentioned in commit 0634afd438d7827123e204ffd3c9d926065d655e
root commented 2026-10-14 10:36:16 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in merge request !523

mentioned in merge request !523
root commented 2026-10-14 12:19:55 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 6b480f21be

mentioned in commit 6b480f21be780e8f289f062d3bd97a9a88f375ad
root commented 2026-10-14 12:19:55 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 938a5409c7

mentioned in commit 938a5409c797461ae28c59400be970da7df69857
root commented 2026-10-14 12:19:56 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit f06de8b474

mentioned in commit f06de8b4744d9d2fcf8d319669ede92fabce59a7
root commented 2026-10-14 12:19:56 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 402c03186b

mentioned in commit 402c03186be64163ef3358d06d5e5602949f274e
root commented 2026-10-14 12:19:56 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 081eca8464

mentioned in commit 081eca846411abafeac0ccbd2cc031182073017d
root (Migrated from gitlab.core-project.space) closed this issue 2026-10-14 13:28:23 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
claude/forgejo-ci-refactor-637a4b
claude/implement-spec-576-809869
fix/front-browser-pages
docs/contributing-forgejo-ci
fix/storybook-ghsa-f2ph-cmg5-wxc8
prototype/dead-end-page
prototype/puzzles-ui-redesign
prototype/399-front-screens
ci/front-test-one-job
feat/370-drizzle-gateway
pr-screenshots
feat/369-postgres-per-stack
claude/pawn-promotion-capture-score-46fffb
claude/github-workflow-improvements-30cf86
docs/352-adr-claim-guest
docs/351-adr-seat-identity
claude/retro-last-10-conversations-9af723
docs/accounts-adrs
claude/lighthouse-pt-4b5a78
docs/350-adr-sessions
feat/game-status-326
research/postgres-on-vps
research/email-provider
prototype/offer-overlay
ci/339-pr-screenshots
prototype/game-status
ci/317-faster-pipeline
spec/303-vps-hosting
claude/paste-invite-link-room-code
docs/309-adr-vps-hosting
fix/311-client-route-fallback
claude/back-navigation-feature-2166ea
claude/resource-contract
claude/api-nest-orpc
claude/adr-nest-orpc
claude/e2e-tests-new-features-1ce2a1
claude/la-spec-273-fd55ac
claude/matt-pocock-skills-integration-444ba9
chore/adopt-the-cognitive-load-coding-rules-270
feat/choose-the-promotion-piece-in-a-popover-instead-of-auto-queening-267
feat/animate-piece-moves-on-the-board-264
feat/show-drag-state-on-the-board-263
feat/move-a-piece-by-dragging-and-dropping-it-261
feat/blocking-modal-when-the-room-has-closed-246
feat/truthful-opponent-presence-lost-connection-left-new-opponent-248
feat/horizontal-game-and-room-action-bars-with-a-confirmed-leave-247
feat/room-status-block-with-a-fixed-height-and-seat-relative-wording-245
docs/amend-adr-0016-a-vacated-seat-replaces-the-60-second-left-timer-244
feat/lint-against-hard-coded-copy-in-the-front-front-no-literal-copy-252
feat/translate-the-front-with-a-language-provider-english-french-242
docs/adr-front-i18n-paraglide
docs/stacked-prs
fix/render-build-fails-on-corepack-enable-record-the-hosting-adr-240
front/8-lint-error
front/7-local-home-align
front/6-comment-purge
front/5-cache-policy
front/3-dissolve-room-actions
front/4-tests-through-view
front/2-room-restructure
front/1-test-harness
feat/deploy-to-render-free-tier-with-a-preview-per-pr-233
harness/6-coding-standards
harness/5-adrs
harness/4-mechanical-rules
harness/3-drop-sandcastle
harness/2-skill-forks
harness/1-adr-index
claude/e2e-test-sub-agents-f8d06b
claude/e2e-hook-performance-072aa8
e2e-restart
e2e-spectator
e2e-draw-offer
e2e-resign-and-reload
e2e-mate-two-browsers
orchestrate-issue-168-implementation
implement-issue-169-and-pr
orpc-ws-room-feature
home-page-issues
comment-audit-and-rules
local/4-local-rail
local/3-local-board
local/2-design-prep
local/1-engine-accessors
prototype/home-page
prototype/game-screen-layout
worktree-front
chore/worktree-env-and-ports
feat/slice-1-3a-front-store-ws-effect-connection-status-screen-136
fix/143-release-seat-on-disconnect
claude/sandcastle-runner-contract
feat/slice-1-2a-apps-api-skeleton-hono-ws-echo-origin-allowlist-132
feat/slice-1-1-chess-contracts-package-context-md-cleanup-128
refactor/reorganise-src-into-layered-folders-per-adr-0008-123
refactor/refactor-engine-reorganise-src-into-layered-folders-per-adr-0008-123
refactor/introduce-the-piecereader-read-port-118
refactor/move-isattacked-to-attacks-ts-with-board-only-signature-111
feat/slice-b1-zobrist-key-computation-for-positions-99
refactor/slice-a-re-back-squareset-with-split-32-representation-97
sandcastle/sequential-reviewer/1779180017269
feat/san-formatter-core-encoding-moves-captures-en-passant-promotion-castling-92
sandcastle/sequential-reviewer/1779111400188
refactor/engine-pr-10-1-migrate-stalemate-into-a-draw-status-variant-86
sandcastle/sequential-reviewer/1779099667568
feat/engine-pr-9-1-castling-rights-tracking-updatecastlingrights-applymove-wiring-80
refactor/extract-piece-attacks-registry-and-rewire-isattacked-movegen-77
sandcastle/sequential-reviewer/1779027444485
backup/pre-axis-a-rewrite
Labels
Clear labels   
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
spec
Parent spec written by to-spec

  
wayfinder:grilling

   
wayfinder:map

   
wayfinder:prototype

   
wayfinder:research

   
wayfinder:task

   
wontfix
This will not be worked on

No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
spec
wayfinder:grilling
wayfinder:map
wayfinder:prototype
wayfinder:research
wayfinder:task
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#379 Sign-up and sign-in pages: the navigation names the Account, a refresh keeps it signed in
amaurycoudr/chess-project
#382 Seats and Games as an Account: one Seat across devices, Games owned and listed by the Account
amaurycoudr/chess-project
Depends on
#376 My games: this browser's decided Games, reachable from the navigation
amaurycoudr/chess-project
#377 Export a stored Game as PGN, with the result of a Resignation or an agreed Draw
amaurycoudr/chess-project
Reference
amaurycoudr/chess-project#378
No description provided.