383cfbed3b
Adds the full auth flow. Reads stay public; writes (currently only POST
/api/v1/mangas) require a CurrentUser. Both browsers and bot scripts hit
the same endpoints — they just present credentials differently.
Migration 0002_auth.sql introduces users.password_hash, a sessions
table, and an api_tokens table. Sessions and api_tokens store only
sha256(raw_token) — the raw value lives in the cookie or the
Authorization header.
New endpoints under /api/v1/auth/:
- POST /register — argon2id hash, creates a session, sets cookie.
- POST /login — verifies, rotates to a fresh session (old ones expire
naturally so other devices stay signed in).
- POST /logout — deletes the server-side session row + clears the
cookie via Max-Age=0.
- GET /me — current user via the new CurrentUser extractor.
- POST /tokens — issue a bot bearer token; raw value returned exactly
once at creation.
- DELETE /tokens/{id} — owner-only: 404 if unknown, 403 if it exists
but belongs to another user, 204 on success.
The CurrentUser axum extractor resolves cookie first, then
Authorization: Bearer; failure → AppError::Unauthenticated (401). New
AppError variants Unauthenticated/Forbidden/Conflict carry the matching
envelope codes; the top-level match in `code()` stays exhaustive.
Backend integration coverage in tests/api_auth.rs: register sets a
HttpOnly SameSite=Lax cookie and never leaks password_hash; duplicate
username → 409; weak password → 400; login rotates the cookie; wrong
password / unknown user → 401; /me with vs without cookie; logout
invalidates the cookie; bot-token roundtrip via Bearer; user A cannot
delete user B's token (403); unknown delete → 404.
Frontend:
- lib/api/auth.ts — typed wrappers; me() returns null on 401.
- lib/session.svelte.ts — per-tab user state with a seq counter to
guard against an in-flight /me clobbering a fresh setUser.
- lib/api/client.ts — request<T> returns undefined for 204.
- routes/login + routes/register — forms with action="javascript:void(0)"
so the no-JS path is a no-op (avoids the hydration-race where a
pre-attach click would submit via the browser default).
- routes/+layout.svelte — session-aware nav: spinner → user + Logout,
or Login / Register.
- e2e/auth-flow.spec.ts — login flips the layout, logout flips back;
bad credentials surface the API error message.
Config grows AuthConfig (cookie_secure, cookie_domain, session_ttl_days)
and CORS_ALLOWED_ORIGINS. CORS middleware is mounted in app::build and
stays a no-op (same-origin) until origins are listed.
Lockstep version bump to 0.3.0.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mangalord
A self-hosted manga and comics reader. Browse, search, read, bookmark, and upload manga and chapters. The HTTP API is consumed by both the SvelteKit web UI and external bots/scripts that perform the same actions programmatically.
Stack
- Backend: Rust, axum, sqlx
- Database: Postgres 16
- Frontend: SvelteKit 2 (Svelte 5 runes), TypeScript, Vite
- File storage: pluggable
Storagetrait — local FS today, S3 (and friends) as future impls - Deploy: Docker Compose on a single server
Quick start
cp .env.example .env
docker compose up --build
- Frontend: http://localhost:3000
- API: http://localhost:8080/api
- API health: http://localhost:8080/api/health
Local development
Run only Postgres in Docker; run backend and frontend natively for fast iteration:
docker compose -f docker-compose.dev.yml up -d
# backend
cd backend
export DATABASE_URL=postgres://mangalord:mangalord@localhost:5432/mangalord
cargo run
# frontend (separate shell)
cd frontend
npm install
npm run dev
The Vite dev server proxies /api to http://localhost:8080.
Tests
This project is developed test-first. Tests live at three levels:
# Backend: unit (in-module) + integration (tests/, per-test DB via #[sqlx::test])
cd backend && cargo test
# Frontend: unit / module tests (Vitest)
cd frontend && npm test
# Frontend: end-to-end (Playwright; spins up dev server, mocks API by default)
cd frontend && npm run test:e2e
API surface
| Method | Path | Purpose |
|---|---|---|
| GET | /api/health |
Liveness |
| GET | /api/mangas |
List / search mangas |
| POST | /api/mangas |
Create a manga |
| GET | /api/mangas/{id} |
Get a manga |
| GET | /api/files/{key} |
Stream a blob (cover, chapter page) |
Chapters, uploads, and bookmarks are next — the patterns to extend are documented in CLAUDE.md.