Auth: add magic-link/session migrations and runtime datasource - #44
Open
RandyJDean wants to merge 1 commit into
Open
Auth: add magic-link/session migrations and runtime datasource#44RandyJDean wants to merge 1 commit into
RandyJDean wants to merge 1 commit into
Conversation
- V0004 relaxes members.full_name and adds profile_completed_at so magic-link verification can create shell accounts before sign-up - V0005 creates magic_link_tokens (hashed, single-use, email-keyed) - V0006 creates Spring Session JDBC tables (schema owned by Flyway; spring.session.jdbc.initialize-schema=never) - Re-enable DataSourceAutoConfiguration with spring.datasource wired to the existing DATABASE_* env vars; disable runtime Flyway (migrations stay out-of-band via `just migrate`) - Add spring-session-jdbc, spring-boot-starter-security (previously only transitive via oauth2-client), spring-security-test - New app.auth.* properties (base-url, cookie-secure, magic-link-ttl); dev profile serves non-Secure cookies over plain HTTP - Fix .example.env DATABASE_NAME leftover from codebloom -> patchats Co-Authored-By: Claude Fable 5 <[email protected]>
Contributor
Author
This was referenced Jul 9, 2026
|
Graphite Automations"Request reviewers once CI passes" took an action on this PR • (07/10/26)2 reviewers were added to this PR based on Henry Chen's automation. |
arklian
reviewed
Jul 10, 2026
Comment on lines
+26
to
+28
| server: | ||
| # Trust X-Forwarded-* from the reverse proxy so rate limiting sees real client IPs. | ||
| forward-headers-strategy: framework |
Member
There was a problem hiding this comment.
Gotta investigate what this does.
| @@ -0,0 +1,12 @@ | |||
| -- Single-use sign-in tokens emailed to users. Keyed by email (not member id) | |||
| -- because the member row is only created once the link is verified. | |||
| CREATE TABLE IF NOT EXISTS "magic_link_tokens" ( | |||
Member
There was a problem hiding this comment.
We should figure out a style guide for SQL stuff. Should the table names be lowercase or caps or whatever standard?
| -- Single-use sign-in tokens emailed to users. Keyed by email (not member id) | ||
| -- because the member row is only created once the link is verified. | ||
| CREATE TABLE IF NOT EXISTS "magic_link_tokens" ( | ||
| id UUID PRIMARY KEY, |
Member
There was a problem hiding this comment.
Should this be uuid? Maybe investigate?
| @@ -0,0 +1,4 @@ | |||
| app: | |||
| auth: | |||
| # Dev runs plain HTTP through the Vite proxy; a Secure cookie would be silently dropped. | |||
Member
There was a problem hiding this comment.
Does this need to be the case? Should we be logging in on dev too?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
magic-link verification can create shell accounts before sign-up
spring.session.jdbc.initialize-schema=never)
the existing DATABASE_* env vars; disable runtime Flyway (migrations
stay out-of-band via
just migrate)only transitive via oauth2-client), spring-security-test
dev profile serves non-Secure cookies over plain HTTP
Co-Authored-By: Claude Fable 5 [email protected]