sulthan
13e8e73da7
The browser UI signs in with a Discord authorization code grant (identify + guilds.members.read) instead of a shared password. Guild membership is the gate; the owner's Discord ID is the only identity allowed in while registration is closed. Sessions become rows in a sessions table with opaque random ids — the cookie carries only the id, looked up and expiry-checked per request — so deleting a row revokes a session. HMAC cookie signing, its derived key, and WEB_PASSWORD are gone, and no replacement signing secret is introduced (ADR-0002). Discord's API base is configurable (DISCORD_API_BASE); the full flow is tested through the real router against a local stub, including the form-encoded token exchange Discord rejects if sent as JSON.
11 lines
483 B
SQL
11 lines
483 B
SQL
-- One row per browser session. The id is an opaque random value the cookie
|
|
-- carries verbatim; a request is authenticated by looking the row up, and
|
|
-- deleting the row is how a session is revoked. Expired rows are removed
|
|
-- lazily on lookup, so nothing sweeps them.
|
|
CREATE TABLE sessions (
|
|
id text PRIMARY KEY,
|
|
reader_id bigint NOT NULL REFERENCES readers (id) ON DELETE CASCADE,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
expires_at timestamptz NOT NULL
|
|
);
|