Kyle Isom
38da2e9a4b
- Authenticator with Login, ValidateToken, Logout - 30-second SHA-256-keyed cache with lazy eviction - TLS 1.3, custom CA support, service context (name + tags) - Error types: ErrInvalidToken, ErrInvalidCredentials, ErrForbidden, ErrUnavailable - Context helpers for TokenInfo propagation - 14 tests with mock MCIAS server and injectable clock Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2.3 KiB
2.3 KiB
MCDSL Progress
Current State
Phase 2 complete. The db and auth packages are implemented and tested.
Completed
Phase 0: Project Setup (2026-03-25)
- Initialized Go module (
git.wntrmute.dev/kyle/mcdsl) - Created
.golangci.yamlmatching platform standard (withexportedrule enabled since this is a shared library) - Created
Makefilewith standard targets (build, test, vet, lint, all) - Created
.gitignore - Created
doc.gopackage doc make allpasses clean
Phase 1: db — SQLite Foundation (2026-03-25)
Open(path string) (*sql.DB, error)— opens with WAL, FK, busy timeout 5000ms, 0600 permissions, creates parent dirsMigrationtype with Version, Name, SQL fieldsMigrate(database *sql.DB, migrations []Migration) error— sequential, transactional, idempotent, records name and timestamp in schema_migrationsSchemaVersion(database *sql.DB) (int, error)— highest applied versionSnapshot(database *sql.DB, destPath string) error— VACUUM INTO with 0600 permissions, creates parent dirs- 11 tests covering open, migrate, and snapshot
Phase 2: auth — MCIAS Token Validation (2026-03-25)
Configtype matching[mcias]TOML section (ServerURL, CACert, ServiceName, Tags)TokenInfotype (Username, Roles, IsAdmin)New(cfg Config, logger *slog.Logger) (*Authenticator, error)— creates MCIAS client with TLS 1.3, custom CA support, 10s timeoutLogin(username, password, totpCode string) (token, expiresAt, err)— forwards to MCIAS with service context, returns ErrForbidden for policy denials, ErrInvalidCredentials for bad credsValidateToken(token string) (*TokenInfo, error)— 30s SHA-256-keyed cache, lazy eviction, concurrent-safe (RWMutex)Logout(token string) error— revokes token on MCIAS- Error types: ErrInvalidToken, ErrInvalidCredentials, ErrForbidden, ErrUnavailable
- Context helpers: ContextWithTokenInfo, TokenInfoFromContext
- 14 tests: login (success, invalid creds, forbidden), validate (admin, non-admin, expired, unknown), cache (hit, expiry via injectable clock), logout, constructor validation, context roundtrip, admin detection
make allpasses clean (vet, lint 0 issues, 25 total tests, build)
Next Steps
- Phase 3:
configpackage (TOML loading, env overrides, standard sections)