coreci/researchx
7
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 19 Wiki Activity

19 Releases 19 Tags

RSS Feed
  • v0.3.1 b8b0b68f1b
    Compare

    v0.3.1 — auth + sessions + user scoping Stable

    coreci-bot released this 2026-09-29 21:36:50 +00:00 | 18 commits to milestone/v0.3-hosted since this release

    v0.3 Phase 1 — Auth + Sessions + User Scoping.

    REQ-69 user/pass auth: argon2id (argon2-cffi, to_thread), server-side sessions (token_urlsafe(32), sha256-at-rest, httpOnly SameSite=Lax cookies, 14-day sliding expiry, immediate revocation, token rotation), CSRF (X-ResearchX-Request on all non-GET), /healthz outside /api.
    REQ-70 admin-managed accounts: first-registered-is-admin (atomic — 8-way race pinned), registration closed after, admin create/deactivate (kills sessions, retains data), password min length 12.
    REQ-71 user scoping: runs/<user_id>/<run_id>/ partitioning, owner-keyed registry (cross-owner 404 across all 8 run endpoints), RunState.owner_id, restart sweep (G-101: PLANNING→CANCELLED), registry pruning.

    Security review (in-phase): P0 first-admin register race fixed; P1 corrupt-users.json fail-closed. Verify: PASS 4/4 layers. 184 backend + 119 frontend tests green.

    Downloads