Spaces:
Sleeping
Sleeping
| title: Planner Auth — Real Authentication | |
| emoji: 🔐 | |
| colorFrom: indigo | |
| colorTo: green | |
| sdk: docker | |
| app_port: 7860 | |
| pinned: false | |
| license: mit | |
| # Planner Auth 🔐 | |
| A **real (server-side) authentication server** **+ protected planner**: passwords hashed with bcrypt, sessions managed by the server with an `httpOnly` cookie, each user's data stored and filtered **on the server**, and an `/app` page that only opens with a valid session. | |
| ## How to use it | |
| 1. Open the Space → **Sign up** → create an account → click **Open the Planner**. | |
| 2. The planner (`/app`) loads habits, tasks and focus sessions **from the server API** — nothing in IndexedDB. | |
| 3. Try opening `/app` while logged out: the server redirects you to the login. | |
| 4. Reload the page: you're still logged in (the session lives on the server). | |
| ## Endpoints | |
| ### Authentication | |
| | Route | What it does | | |
| |---|---| | |
| | `POST /api/register` | validates, hashes with bcrypt (10 rounds), creates the user, starts a session | | |
| | `POST /api/login` | bcrypt compare, **regenerates the session** (anti fixation), rate limit of 5 tries / 15 min | | |
| | `POST /api/logout` | destroys the session on the server | | |
| | `GET /api/me` | protected — returns the session's user, or 401 | | |
| | `POST /api/forgot-password` | random token, stored only as a SHA-256 hash, 15 min validity | | |
| | `POST /api/reset-password` | validates the token (single use) and replaces the password hash | | |
| ### Per-user data — all require a session and filter by `owner` | |
| | Route | What it does | | |
| |---|---| | |
| | `GET/POST /api/habits`, `PUT/DELETE /api/habits/:id` | the logged-in user's habits (emoji, color, daily/weekly with a goal) | | |
| | `GET /api/checkins`, `POST /api/checkins/toggle` | daily completions (`{habitId, date}`), validates habit ownership | | |
| | `GET/POST /api/tasks`, `PUT/DELETE /api/tasks/:id`, `POST /api/tasks/reorder` | tasks with priority and due date, reordering by id list | | |
| | `GET/POST /api/sessions` | focus (pomodoro) sessions | | |
| | `GET /app` | the planner page — **redirects to `/` without a session** | | |
| ## Security details | |
| - **bcrypt** with 10 rounds — the password is never stored as plain text. | |
| - **Server-side session**: the `planner.sid` cookie is `httpOnly`, `sameSite=lax`, automatically `Secure` behind the Space's HTTPS; secret generated with `crypto.randomBytes` and persisted. | |
| - **Session regeneration on login** (anti fixation) and login rate limiting. | |
| - **`/app` outside `express.static`**: the file lives in `private/` and is only served by the route that requires a session — there is no way to download it directly. | |
| - **Per-user isolation on the server**: every data route filters by `owner = current session`; a user cannot read or change another user's data, even by forging ids. | |
| - **Reset token** stored as a SHA-256 hash, single use, expiring; the "forgot password" response is identical whether the e-mail exists or not. | |
| ## Honest limitations | |
| - Storage is `data/db.json` (swap for SQLite/Postgres in production). | |
| - Sessions are in memory (`MemoryStore`) — they don't survive a Space restart; use Redis in production. | |
| - No e-mail in a Space: the reset token comes back in the API response (demo). In production it would go by e-mail. | |
| - No explicit CSRF token (`sameSite=lax` covers the basic case); no HTTPS of its own (the Space proxy handles it). |