auth-api 2.0.0

.config/nextest.toml

@@ -0,0 +1,26 @@
+# cargo-nextest configuration.
+#
+# Every test runs in its own process against its own database (cloned from a
+# migrated template), so tests are safe to run fully in parallel.
+
+[profile.default]
+# Flag a test as slow after 30 s and kill it after 2 minutes: a hung test (a
+# stalled Redis or NATS call) must fail loudly instead of freezing the run.
+slow-timeout = { period = "30s", terminate-after = 4 }
+# No retries: a flaky test is a bug to fix, not noise to hide.
+retries = 0
+
+# Simulations hold dependencies down or slow on purpose, and the long
+# scenarios run for minutes.
+[[profile.default.overrides]]
+filter = 'binary(simulation)'
+slow-timeout = { period = "60s", terminate-after = 20 }
+
+[profile.ci]
+# Report every failure in one run.
+fail-fast = false
+failure-output = "immediate-final"
+
+[profile.ci.junit]
+# target/nextest/ci/junit.xml
+path = "junit.xml"

.dockerignore

@@ -1,10 +1,12 @@
 # Git
 .git
 .gitignore
-.gitleaks.toml
+trivy-secret.yaml
 
 # Rust build artifacts
 target/
+# The image builds with the toolchain of its pinned Rust base image.
+rust-toolchain.toml
 
 # Environment files
 .env
@@ -14,6 +16,15 @@ target/
 # Documentation
 docs/
 reports/
+CHANGELOG.md
+
+# Not part of the build: release bundles, perf and ops tooling, fuzzing
+dist/
+perf/
+scripts/
+nginx/
+fuzz/
+config.prod.env
 README.md
 LICENSE
 

.env.dev

@@ -4,6 +4,9 @@ APP_ENV=development
 SERVER_HOST=0.0.0.0
 SERVER_PORT=3000
 APP_PUBLIC_URL=http://localhost:3000
+# Web application the emails link to (/verify-email, /reset-password).
+# Blank: same as APP_PUBLIC_URL.
+FRONTEND_URL=
 TRUSTED_PROXY_CIDRS=
 
 # Database (matches docker-compose.dev.yml)
@@ -27,9 +30,8 @@ JWT_ACCESS_EXPIRY_SECS=900
 JWT_REFRESH_EXPIRY_SECS=2592000
 JWT_STRICT_SESSION_BINDING=false
 # Audience values stamped into the `aud` claim of access tokens (CSV).
-# Each entry must match the `expected_aud` (or APP_PUBLIC_URL fallback) of a
-# downstream resource server that will accept tokens minted here.
-# Local stack ports: billing-api on :3001, core-api on :3002.
+# Each entry names a downstream resource server that accepts tokens minted
+# here; APP_PUBLIC_URL is always added. Example: two local services.
 JWT_AUDIENCE=http://localhost:3001,http://localhost:3002
 
 # Argon2id (lighter settings for dev)
@@ -56,14 +58,6 @@ LOCKOUT_THRESHOLD=100
 LOCKOUT_DURATION_SECS=60
 SENSITIVE_ACTION_REAUTH_SECS=600
 
-# GeoIP (disabled in dev)
-GEOIP_DB_PATH=
-GEOIP_REQUIRED=false
-RISK_ALERT_THRESHOLD=30
-RISK_CHALLENGE_THRESHOLD=60
-RISK_BLOCK_THRESHOLD=80
-RISK_HISTORY_DAYS=90
-
 # SMTP (Mailpit - matches docker-compose.dev.yml)
 SMTP_HOST=mailpit
 SMTP_PORT=1025

.github/dependabot.yml

@@ -0,0 +1,67 @@
+# Dependency updates, monthly and grouped, to keep noise and CI runs low:
+# one pull request per ecosystem for minor and patch updates, one for major
+# updates (a deliberate migration, but visible rather than ignored).
+#
+# Pull requests target staging, the draft branch: they are checked by the CI
+# when staging is proposed to main. Security updates always target main.
+
+version: 2
+
+updates:
+  - package-ecosystem: cargo
+    directories: ["/", "/fuzz"]
+    target-branch: staging
+    open-pull-requests-limit: 2
+    schedule:
+      interval: monthly
+      time: "06:00"
+      timezone: Europe/Paris
+    groups:
+      cargo:
+        update-types: [minor, patch]
+      cargo-major:
+        update-types: [major]
+    ignore:
+      # sqlx 0.8's `ipnetwork` feature is tied to the 0.20 line: a second
+      # ipnetwork version breaks every sqlx Type/Encode/Decode bound on the
+      # IpNetwork columns. Drop this once sqlx supports ipnetwork 0.21+.
+      - dependency-name: ipnetwork
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    target-branch: staging
+    open-pull-requests-limit: 1
+    schedule:
+      interval: monthly
+      time: "06:00"
+      timezone: Europe/Paris
+    groups:
+      actions:
+        patterns: ["*"]
+
+  # Base images of the Dockerfiles, pinned by digest.
+  - package-ecosystem: docker
+    directory: "/"
+    target-branch: staging
+    open-pull-requests-limit: 1
+    schedule:
+      interval: monthly
+      time: "06:00"
+      timezone: Europe/Paris
+    groups:
+      dockerfiles:
+        patterns: ["*"]
+
+  # Images of the compose files, pinned by digest.
+  - package-ecosystem: docker-compose
+    directories: ["/", "/deploy/monitoring"]
+    target-branch: staging
+    open-pull-requests-limit: 1
+    schedule:
+      interval: monthly
+      time: "06:00"
+      timezone: Europe/Paris
+    groups:
+      compose:
+        patterns: ["*"]

.github/workflows/backmerge.yml

@@ -0,0 +1,46 @@
+name: Back-merge
+
+# staging is the draft branch that pull requests to main come from. After a
+# merge, main holds a merge commit that staging lacks: fast-forward staging so
+# the next pull request starts from main. When draft commits were pushed to
+# staging in the meantime, the fast-forward is impossible: the job leaves
+# staging alone and warns, and staging is brought up to date by hand.
+#
+# Merge staging into main with a merge commit (not squash or rebase): staging
+# then stays an ancestor of main and the fast-forward works.
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: backmerge
+
+jobs:
+  fast-forward:
+    name: Fast-forward staging to main
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Fast-forward
+        run: |
+          if ! git fetch origin staging 2> /dev/null; then
+            echo "No staging branch: nothing to do."
+            exit 0
+          fi
+          if git merge-base --is-ancestor origin/staging HEAD; then
+            git push origin HEAD:refs/heads/staging
+            echo "staging fast-forwarded to $(git rev-parse --short HEAD)."
+          else
+            echo "::warning::staging has commits that are not on main; bring it up to date by hand."
+          fi