kolaente 78f79accb5 refactor(auth): extract transport-agnostic login, logout and OIDC cores ...

Pull the credential/TOTP check, session deletion, user-token issuance and
OIDC callback flow out of the v1 echo handlers and into reusable helpers so
both /api/v1 and the upcoming /api/v2 share one implementation:

- auth.IssueUserToken + auth.WriteUserAuthCookies split the token/cookie
  machinery from the echo response; NewUserAuthTokenResponse now wraps them.
- auth.SessionIDFromContext reads the sid claim for logout.
- shared.AuthenticateUserCredentials, shared.DeleteSession hold the login
  and logout cores.
- openid.AuthenticateCallback holds the OIDC exchange/getOrCreate/TOTP/team
  sync, returning the user; HandleCallback issues the token as before.

v1 behaviour is unchanged on the wire.

2026-06-17 19:43:41 +00:00

..

auth

refactor(auth): extract transport-agnostic login, logout and OIDC cores

2026-06-17 19:43:41 +00:00

avatar

fix(api/v2): reject non-decodable images (e.g. SVG) on avatar upload with 400

2026-06-02 11:55:25 +00:00

background

refactor(background): extract download + unsplash-proxy logic for reuse

2026-06-17 11:31:50 +00:00

dump

chore(lint): suppress known gosec false positives

2026-03-23 16:23:15 +01:00

humaecho5

feat: vendor humaecho adapter for echo/v5

2026-05-31 12:56:57 +00:00

keyvalue

fix(keyvalue): treat undecodable cached values as a cache miss

2026-05-30 13:48:01 +00:00

migration

refactor(migration): extract file/CSV migrate orchestration into shared funcs

2026-06-12 08:51:19 +00:00