Merge pull request #11 from Oppskrift/002-user-auth

002 user auth

Author: Scttpr

.env.example

@@ -13,9 +13,14 @@ POSTGRES_PASSWORD=oppskrift
 POSTGRES_DB=oppskrift
 
 # JWT Secret (REQUIRED - minimum 32 characters)
-# Generate with: openssl rand -base64 32
+# Generate with: openssl rand -base64 48
 JWT_SECRET=change-me-in-production-min-32-chars
 
+# TOTP Encryption Key (REQUIRED in production - 64 hex chars = 32 bytes)
+# Generate with: openssl rand -hex 32
+# Used to encrypt TOTP secrets stored in database
+TOTP_ENCRYPTION_KEY=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+
 # S3 Bucket (REQUIRED)
 S3_BUCKET=oppskrift
 
@@ -42,3 +47,34 @@ BASE_URL=http://localhost:3000
 # Federation
 INSTANCE_DOMAIN=localhost:3000
 INSTANCE_NAME=Oppskrift Dev
+
+# =============================================================================
+# AUTHENTICATION (Optional - have sensible defaults)
+# =============================================================================
+
+# Session settings
+SESSION_EXPIRY_DAYS=7
+
+# Rate limiting
+RATE_LIMIT_LOGIN_PER_IP=10
+RATE_LIMIT_LOGIN_PER_ACCOUNT=5
+LOCKOUT_DURATION_MINUTES=15
+
+# =============================================================================
+# EMAIL / SMTP (Optional - email features disabled if not configured)
+# =============================================================================
+
+# For local development with Mailpit (docker-compose up mailpit)
+# View emails at http://localhost:8025
+SMTP_HOST=localhost
+SMTP_PORT=1025
+EMAIL_FROM_ADDRESS=noreply@localhost
+EMAIL_FROM_NAME=Oppskrift Dev
+
+# For production, use a real SMTP provider:
+# SMTP_HOST=smtp.example.com
+# SMTP_PORT=587
+# SMTP_USER=noreply@oppskrift.example.com
+# SMTP_PASSWORD=your-smtp-password
+# EMAIL_FROM_ADDRESS=noreply@oppskrift.example.com
+# EMAIL_FROM_NAME=Oppskrift

.githooks/pre-commit

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Pre-commit hook for Oppskrift
-# Runs formatting and linting checks before allowing commits
+# Runs formatting, linting, and secret scanning before allowing commits
 
 set -e
 
@@ -12,6 +12,20 @@ NC='\033[0m' # No Color
 
 echo "Running pre-commit checks..."
 
+# Gitleaks secret scanning (on staged files only)
+if command -v gitleaks &> /dev/null; then
+    echo "Running gitleaks..."
+    if gitleaks protect --staged --config .gitleaks.toml; then
+        echo -e "${GREEN}Gitleaks OK${NC}"
+    else
+        echo -e "${RED}Gitleaks found potential secrets in staged files${NC}"
+        exit 1
+    fi
+else
+    echo -e "${YELLOW}Warning: gitleaks not installed, skipping secret scan${NC}"
+    echo "Install with: brew install gitleaks (macOS) or download from GitHub"
+fi
+
 # Check if docker or podman is available for database
 if ! command -v docker &> /dev/null && ! command -v podman &> /dev/null; then
     echo -e "${YELLOW}Warning: Docker/Podman not available, skipping database-dependent checks${NC}"

.github/workflows/ci.yml

@@ -9,53 +9,12 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
-  DATABASE_URL: postgres://oppskrift:oppskrift@localhost:5432/oppskrift
+  SQLX_OFFLINE: true
+  # Test-only encryption key for 2FA (64 hex chars = 32 bytes)
+  TOTP_ENCRYPTION_KEY: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
 
 jobs:
-  # Build first - all other jobs depend on this
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:15-alpine
-        env:
-          POSTGRES_USER: oppskrift
-          POSTGRES_PASSWORD: oppskrift
-          POSTGRES_DB: oppskrift
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
-        with:
-          toolchain: stable
-      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
-        with:
-          cache-all-crates: "true"
-          shared-key: "build"
-      - name: Install sqlx-cli
-        run: cargo install sqlx-cli --no-default-features --features postgres
-      - name: Run migrations
-        run: sqlx migrate run
-      - name: Build
-        run: cargo build --all-features
-      # Cache build artifacts for other jobs
-      - name: Save build artifacts
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            target/
-            ~/.cargo/registry/
-            ~/.cargo/git/
-          key: build-${{ github.sha }}
-
-  # Format check - no dependencies, fast
+  # Fast checks - no dependencies, run in parallel
   fmt:
     name: Format
     runs-on: ubuntu-latest
@@ -67,51 +26,38 @@ jobs:
           components: rustfmt
       - run: cargo fmt --all -- --check
 
-  # Clippy - depends on build, reuses build cache
-  clippy:
-    name: Clippy
-    needs: build
+  # Build and lint - uses SQLX_OFFLINE, no database needed
+  check:
+    name: Check & Clippy
     runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:15-alpine
-        env:
-          POSTGRES_USER: oppskrift
-          POSTGRES_PASSWORD: oppskrift
-          POSTGRES_DB: oppskrift
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
         with:
           toolchain: stable
           components: clippy
-      # Restore build artifacts from build job
-      - name: Restore build artifacts
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+      - name: Build
+        run: cargo build --all-features
+      - name: Clippy
+        run: cargo clippy --all-features -- -D warnings
+      # Save artifacts for test job
+      - uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             target/
             ~/.cargo/registry/
             ~/.cargo/git/
           key: build-${{ github.sha }}
-      - name: Install sqlx-cli
-        run: cargo install sqlx-cli --no-default-features --features postgres
-      - name: Run migrations
-        run: sqlx migrate run
-      - run: cargo clippy --all-features -- -D warnings
 
-  # Tests - depends on build, reuses build cache
+  # Tests need real database
   test:
     name: Test
-    needs: build
+    needs: check
     runs-on: ubuntu-latest
+    env:
+      DATABASE_URL: postgres://oppskrift:oppskrift@localhost:5432/oppskrift
+      SQLX_OFFLINE: false
     services:
       postgres:
         image: postgres:15-alpine
@@ -131,27 +77,23 @@ jobs:
       - uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
         with:
           toolchain: stable
-      # Restore build artifacts from build job
-      - name: Restore build artifacts
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      - uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             target/
             ~/.cargo/registry/
             ~/.cargo/git/
           key: build-${{ github.sha }}
+      - name: Cache sqlx-cli
+        id: cache-sqlx
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ~/.cargo/bin/sqlx
+          key: sqlx-cli-0.8
       - name: Install sqlx-cli
-        run: cargo install sqlx-cli --no-default-features --features postgres
+        if: steps.cache-sqlx.outputs.cache-hit != 'true'
+        run: cargo install sqlx-cli --no-default-features --features postgres --locked
       - name: Run migrations
         run: sqlx migrate run
-      - run: cargo test --all-features
-
-  # Security audit - no dependencies, can run in parallel
-  audit:
-    name: Security Audit
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run tests
+        run: cargo test --all-features

.github/workflows/security.yml

@@ -0,0 +1,64 @@
+name: Security
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Daily security scan at 6 AM UTC
+    - cron: '0 6 * * *'
+
+env:
+  SQLX_OFFLINE: true
+
+jobs:
+  # All security checks in one job to reduce overhead
+  security:
+    name: Security Checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master
+        with:
+          toolchain: stable
+          components: clippy
+
+      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+
+      # Gitleaks - secret scanning
+      - name: Install Gitleaks
+        run: |
+          curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz -o gitleaks.tar.gz
+          tar xzf gitleaks.tar.gz
+          chmod +x gitleaks
+
+      - name: Secret Scan
+        run: ./gitleaks detect --source . --config .gitleaks.toml --verbose
+
+      # Cargo audit - dependency vulnerabilities
+      - name: Cache cargo-audit
+        id: cache-audit
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ~/.cargo/bin/cargo-audit
+          key: cargo-audit-0.21
+      - name: Install cargo-audit
+        if: steps.cache-audit.outputs.cache-hit != 'true'
+        run: cargo install cargo-audit --locked
+
+      - name: Dependency Audit
+        run: cargo audit --deny warnings --deny unmaintained --deny yanked
+
+      # Security-focused clippy lints (warnings, not errors)
+      - name: Security Lints
+        run: |
+          cargo clippy --all-features -- \
+            -W clippy::unwrap_used \
+            -W clippy::expect_used \
+            -D unsafe_code \
+            -W clippy::todo \
+            -W clippy::unimplemented

.gitleaks.toml

@@ -1,27 +1,50 @@
-# Gitleaks configuration for Oppskrift
-title = "Oppskrift Gitleaks Configuration"
+# Gitleaks configuration
+# https://github.com/gitleaks/gitleaks
 
-[allowlist]
-description = "Allowed patterns"
-paths = [
-    ".env.example",
-    "docker-compose.yml",
-]
+title = "Oppskrift Gitleaks Config"
+
+[extend]
+useDefault = true
 
-[[rules]]
-id = "jwt-secret"
-description = "JWT Secret"
-regex = '''JWT_SECRET\s*=\s*["']?[^"'\s]{33,}["']?'''
-keywords = ["jwt_secret", "JWT_SECRET"]
+# Allowlist for false positives
+[allowlist]
+description = "Allowlisted patterns and paths"
 
-[[rules]]
-id = "database-url"
-description = "Database URL with credentials"
-regex = '''postgres://[^:]+:[^@]+@'''
-keywords = ["DATABASE_URL", "postgres://"]
+# Placeholder/example values in documentation
+regexes = [
+    # Placeholder passwords in docs
+    '''your-smtp-password''',
+    '''your-256-bit-secret-here''',
+    # Template variables
+    '''\$\{DB_PASSWORD\}''',
+    '''\$\{.*_SECRET\}''',
+    # Test credentials (explicitly fake)
+    '''test:test@''',
+    # Fake argon2 hashes in tests
+    '''fakesalt''',
+    '''fakehash''',
+    # Example/truncated JWTs in docs
+    '''eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9\.\.\.''',
+    # Test assertions checking key format (not actual keys)
+    '''starts_with\("-----BEGIN''',
+]
 
-[[rules]]
-id = "s3-secret"
-description = "S3 Secret Access Key"
-regex = '''S3_SECRET_ACCESS_KEY\s*=\s*["']?[^"'\s]+["']?'''
-keywords = ["S3_SECRET", "secret_access_key"]
+paths = [
+    # Documentation with example configs
+    '''DEPLOYMENT\.md''',
+    '''quickstart\.md''',
+    '''testing\.md''',
+    # Scripts that generate secrets (contain templates, not real secrets)
+    '''scripts/generate-secrets\.sh''',
+    # Test files with fake hashes
+    '''tests/timing_test\.rs''',
+    '''tests/enumeration_test\.rs''',
+    # Example env file
+    '''\.env\.example''',
+    # Crypto module tests (assertions checking key format)
+    '''src/lib/crypto\.rs''',
+    # OSK templates with example tokens
+    '''\.osk/domaines/.*\.md''',
+    # CI workflows with test-only keys
+    '''\.github/workflows/.*\.yml''',
+]