5073d9342a
Security: per-username login throttling, constant-time unknown-user check, Sec-Fetch-Site CSRF guard for writes, session rotation on login and password change, absolute session lifetime, sessions ended on reset and deactivation, last-admin protection, input length caps, ASCII usernames, clickjacking headers. Covered by tests/authentication.test.ts. Filter panel: toggle, fields and count share one row to save space. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
11 lines
597 B
TypeScript
11 lines
597 B
TypeScript
import { readAuthConfig } from "../auth/auth-config.js";
|
|
import { LoginThrottle } from "../auth/login-throttle.js";
|
|
import { SessionStore } from "../auth/sessions.js";
|
|
import { UserService } from "../../domain/services/user.service.js";
|
|
import { userRepository } from "./application-repositories.js";
|
|
|
|
export const authConfig = readAuthConfig();
|
|
export const sessionStore = new SessionStore(authConfig.sessionTtlMs, authConfig.sessionMaxAgeMs);
|
|
sessionStore.startSweeping();
|
|
export const loginThrottle = new LoginThrottle();
|
|
export const userService = new UserService(userRepository, authConfig);
|