Accounts: email and password #37

Merged

anas merged 2 commits from feature/accounts into main

2026-10-08 21:05:05 +00:00

Author	SHA1	Message	Date
Anas Rashid	aa264aa6c3	Merge main (selection menu) into feature/accounts	2026-10-08 22:58:08 +02:00
Anas Rashid	e409adc668	Accounts: email and password sign-up, sign-in/out, change password, delete account (#18 ) - API (api/src/auth.ts): scrypt password hashes; random session tokens stored only as SHA-256; 30-day sliding sessions; rate limits on sign-in (per IP and per email) and sign-up; changing the password signs out other devices; deleting the account removes its data. - Site: /signup, /signin (returns to the page the reader came from), /account; header link; plain forms, no JavaScript needed. Session in an HTTP-only, SameSite=Lax cookie (Secure over HTTPS). - CSRF: Astro's origin check, with the site's hostnames listed (SITE_HOSTS) so its own form posts pass and other sites' are refused. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 22:53:51 +02:00

Author

SHA1

Message

Date

Anas Rashid

aa264aa6c3

Merge main (selection menu) into feature/accounts

2026-10-08 22:58:08 +02:00

Anas Rashid

e409adc668

Accounts: email and password sign-up, sign-in/out, change password, delete account (#18 )

- API (api/src/auth.ts): scrypt password hashes; random session tokens stored only as SHA-256;
  30-day sliding sessions; rate limits on sign-in (per IP and per email) and sign-up; changing the
  password signs out other devices; deleting the account removes its data.
- Site: /signup, /signin (returns to the page the reader came from), /account; header link; plain
  forms, no JavaScript needed. Session in an HTTP-only, SameSite=Lax cookie (Secure over HTTPS).
- CSRF: Astro's origin check, with the site's hostnames listed (SITE_HOSTS) so its own form posts
  pass and other sites' are refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-08 22:53:51 +02:00

Accounts: email and password #37

2 Commits