Auth: username/password (email login)

Open
#16 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
go, postgresql
Domain
api, authentication, backend, database, security

Research direction

Start by locating the Go HTTP entry points for /login, /auth/login, /auth/logout, /auth/me, and /auth/register, along with database initialization. Use the users and sessions schema, session TTL, bcrypt requirements, cookie behavior, and route exceptions as the acceptance map. Done means authentication, bootstrap registration, session middleware, and protected-route behavior all match the issue.

Written by the indexing model from the issue text.

Description

enhancement good first issue security

Sub-issue of #2.

Implement the foundational authentication layer using email + password. This is the prerequisite for all other auth methods and the authorization model (#3).

Database

CREATE TABLE users (
  id         BIGSERIAL PRIMARY KEY,
  email      TEXT NOT NULL UNIQUE,
  name       TEXT NOT NULL,
  password_hash TEXT,          -- NULL for SSO-only accounts
  created_at TIMESTAMPTZ DEFAULT now()
);

CREATE TABLE sessions (
  id         TEXT PRIMARY KEY,  -- random 32-byte hex token
  user_id    BIGINT REFERENCES users(id) ON DELETE CASCADE,
  created_at TIMESTAMPTZ DEFAULT now(),
  expires_at TIMESTAMPTZ NOT NULL
);

password_hash is nullable so the same users table works for SSO accounts (Google #16, Apple #17) that have no password.

Endpoints

Method Path Description
GET /login Serve the login page
POST /auth/login Validate email + password, set session cookie
POST /auth/logout Clear session cookie
GET /auth/me Return current user (used by frontend)

Session management

  • On successful login: generate a random session token, insert into sessions, set Set-Cookie: session=<token>; HttpOnly; SameSite=Strict.
  • Auth middleware: read session cookie, look up in DB, attach user to r.Context().
  • Session TTL: configurable via SESSION_TTL_HOURS env var (default 720 = 30 days).

Password requirements

  • Minimum 12 characters.
  • Stored as bcrypt hash (cost 12).
  • No complexity rules — length is sufficient.

What to protect

All routes except POST /snaps (API key auth — #4) and GET /photos/{token} (token is the auth) should require a valid session.

First-run bootstrap

If the users table is empty, the first POST /auth/register call succeeds without restriction and creates an admin account. Subsequent registrations require an existing admin to invite or a configurable ALLOW_REGISTRATION=true flag.

Related

  • #2 Authentication (parent)
  • #3 Authorization
  • #4 API keys
Dominant language
Go
Stars
0
Forks
0
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from williamokano/SentinelSnap

All issues in williamokano/SentinelSnap

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.