Andy Dixon
a002a2c100
Phase 1 foundation. Local auth per ADR-0006: Argon2id passwords, opaque hashed session tokens with idle/absolute expiry, CSRF token plus Origin check on cookie sessions, per-IP token bucket and per-account exponential lockout, three roles enforced by middleware, personal API tokens for noemactl. Audit log writer used by every admin mutation. API: request ids, panic recovery, strict CSP and security headers, body limits, single JSON error envelope, health/ready/status, users, sessions, tokens, audit, token-protected /metrics. UI: embedded html/template pages (login, first-run setup, dashboard, system, users, account, audit, interpretation boundary), light/dark theme, dependency-free app.js with CSRF-aware fetch and SSE helper. Binaries: noemad with graceful shutdown, migrations at start, bootstrap admin from environment, supervised background tasks; noemactl with status, migrate, user create and meaningful exit codes.
30 lines
806 B
Go
30 lines
806 B
Go
// Package app holds the dependency bundle shared by the HTTP API, the web UI
|
|
// and the CLI-facing services. It exists so that constructors take one typed
|
|
// value instead of a growing parameter list, without resorting to globals.
|
|
package app
|
|
|
|
import (
|
|
"io/fs"
|
|
"log/slog"
|
|
"time"
|
|
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
|
|
"github.com/andydixon/noema/internal/audit"
|
|
"github.com/andydixon/noema/internal/auth"
|
|
"github.com/andydixon/noema/internal/config"
|
|
"github.com/andydixon/noema/internal/observability"
|
|
)
|
|
|
|
// Deps is everything a handler may need. Fields are added per phase.
|
|
type Deps struct {
|
|
Config config.Config
|
|
Log *slog.Logger
|
|
DB *pgxpool.Pool
|
|
Auth *auth.Service
|
|
Audit *audit.Logger
|
|
Metrics *observability.Metrics
|
|
Migrations fs.FS
|
|
Started time.Time
|
|
}
|