alvaro/normogen
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
63 commits 1 branch 0 tags 574 KiB
Commit graph

63 commits

This branch
This branch
All branches
Author SHA1 Message Date
goose
02b24a3ac1 Phase 2.3: Complete JWT Authentication with token rotation and revocation 
- Fixed DateTime timestamp issues (use timestamp_millis instead of to_millis)
- Implemented token rotation: old refresh tokens revoked on refresh
- Implemented logout revocation: tokens immediately marked as revoked
- Removed rate limiting (deferred to Phase 2.6)
- Created comprehensive verification report
- Updated STATUS.md

All Phase 2.3 objectives complete:
✅ JWT Access Tokens (15 min expiry)
✅ JWT Refresh Tokens (30 day expiry)
✅ Token Rotation
✅ Token Revocation
✅ PBKDF2 Password Hashing
✅ Auth endpoints (register, login, refresh, logout)
✅ Protected routes with JWT middleware
✅ Health check endpoints

Compiles successfully with only unused code warnings.
 2026-02-15 09:05:34 -03:00
goose
8b2c13501f Phase 2.3: JWT Authentication implementation 
- Implemented JWT-based authentication system with access and refresh tokens
- Added password hashing service using PBKDF2
- Created authentication handlers: register, login, refresh, logout
- Added protected routes with JWT middleware
- Created user profile handlers
- Fixed all compilation errors
- Added integration tests for authentication endpoints
- Added reqwest dependency for testing
- Created test script and environment example documentation

All changes:
- backend/src/auth/: Complete auth module (JWT, password, claims)
- backend/src/handlers/: Auth, users, and health handlers
- backend/src/middleware/: JWT authentication middleware
- backend/src/config/: Added AppState with Clone derive
- backend/src/main.rs: Fixed imports and added auth routes
- backend/src/db/mod.rs: Changed error handling to anyhow::Result
- backend/Cargo.toml: Added reqwest for testing
- backend/tests/auth_tests.rs: Integration tests
- thoughts/: Documentation updates (STATUS.md, env.example, test_auth.sh)
 2026-02-14 20:03:11 -03:00
goose
154c3d1152 Phase 2.2: MongoDB connection and models 2026-02-14 15:37:02 -03:00
goose
1cf927f527 Docs: Add backend deployment constraints and monorepo structure 
- Documented Docker/Kubernetes deployment requirements
- Added homelab configuration (resource limits, ports)
- Configured reverse proxy compatibility
- Designed monorepo structure (backend/mobile/web/shared)
 2026-02-14 15:30:13 -03:00
goose
1e38fe3ace Phase 2.1: Backend project initialized with Docker configuration 
- Created Cargo.toml with all required dependencies
- Implemented health/ready endpoints
- Added Docker configuration (production + development)
- Configured docker-compose with resource limits
- Set up MongoDB service with persistence
- Verified build (cargo check passed)
- Prepared monorepo structure for mobile/web/shared

Next: Phase 2.2 (MongoDB connection and models)
 2026-02-14 15:30:06 -03:00
goose
4dca44dbbe Research: MongoDB schema design complete 
- Zero-knowledge encryption for ALL sensitive data + metadata
- Blood pressure example: value + type + unit ALL encrypted
- 9 collections: users, families, profiles, health_data, lab_results, medications, appointments, shares, refresh_tokens
- Client-side encryption (AES-256-GCM, PBKDF2)
- Server NEVER decrypts data
- Privacy-preserving queries (plaintext fields: userId, profileId, familyId, date, tags)
- Tagging system for encrypted data search
- Date range queries (plaintext dates)

Key principle:
- Both value AND metadata encrypted (e.g., "blood_pressure" + "120/80")
- No plaintext metadata leaks
- Server stores ONLY encrypted data

Updated tech stack decisions with MongoDB schema

All major research complete (Rust, Mobile, Web, State, Auth, Database)

Next: Backend development (Axum + MongoDB)
 2026-02-14 13:39:57 -03:00
goose
203c0b4331 Research: JWT authentication selected 
- Comprehensive JWT research completed
- JWT with refresh tokens selected (9.5/10 score)
- Token revocation strategies (blacklist + versioning)
- Refresh token pattern (token rotation)
- Zero-knowledge password recovery integration
- Family member access control (permissions in JWT)

Key decisions:
- Access tokens: 15 minutes (short-lived)
- Refresh tokens: 30 days (long-lived, stored in MongoDB)
- Token rotation: Prevents reuse of stolen tokens
- Token versioning: Invalidate all tokens on password change
- Recovery phrases: Zero-knowledge password recovery from encryption.md
- Family permissions: parent, child, elderly roles

Updated tech stack decisions

Next: Database schema design (MongoDB collections)
 2026-02-14 12:44:33 -03:00
goose
195ba2ec4e Research: Redux Toolkit 2.x selected for state management 
- Completed Redux vs Zustand vs Jotai comparison
- Redux Toolkit selected (9.2/10 score)
- Best for complex state (family structure, permissions)
- Best for offline sync (RTK Query, optimistic updates)
- Largest ecosystem (most resources, tutorials, examples)
- Best developer experience (time-travel debugging)
- 100% code sharing between React Native and React

Trade-offs:
- More boilerplate (clearer structure)
- Steeper learning curve (better patterns)
- Larger bundle 60KB vs 3KB (negligible impact)

Updated tech stack decisions and README

Next: Authentication system design (JWT with recovery phrases)
 2026-02-14 12:32:32 -03:00
goose
735df1f15d Research: Phase 1 complete - Executive summary 
- Backend: Axum selected (18% faster, 25% less memory)
- Mobile: React Native selected (70-80% code sharing)
- Web: React selected (code sharing, best charts)
- Platform strategy: Mobile-first with web companion
- Implementation timeline: 22-32 weeks (5.5-8 months)
- Next: State management research (Redux vs Zustand)
 2026-02-14 11:40:22 -03:00
goose
1701ce4518 Research: Phase 1 complete - Technology stack defined 
- Created comprehensive research summary document
- Backend: Axum selected for I/O performance and memory efficiency
- Frontend: React Native + React selected for code sharing
- Mobile-first platform strategy defined
- Implementation timeline estimated (22-32 weeks)
- Next research priorities identified

Key decisions:
- Axum: 18% faster for large encrypted data, 25% less memory
- React Native: 70-80% code sharing between mobile and web
- Single language (TypeScript) reduces development cost

Next: State management research (Redux vs Zustand)
 2026-02-14 11:39:59 -03:00
goose
307f4964fa Research: React Native + React selected for mobile and web 
- Completed mobile-first platform strategy research
- React Native selected for iOS and Android mobile apps
- React selected for web companion app
- 70-80% code sharing between mobile and web
- Excellent health sensor integration (HealthKit, Health Connect)
- QR scanning, encryption, and background sync support
- Created comprehensive frontend research documentation
- Updated README with platform strategy
- Updated tech stack decisions

Key advantages:
- Single language (TypeScript) reduces development cost
- 70-80% code sharing between mobile and web
- Excellent health sensor integration
- Great chart visualization for web companion
- Faster time to market

Next: State management research (Redux vs Zustand)
 2026-02-14 11:39:08 -03:00
goose
eef5aed28e Research: Axum selected as Rust web framework 
- Completed performance comparison of Actix vs Axum
- Axum selected for I/O-bound workload advantages
- 18% faster for large encrypted data transfers
- 25% less memory for 1000+ concurrent connections
- Better streaming support and Tower middleware ecosystem
- Created comprehensive research documentation
- Updated README with framework decision

Next: Research frontend framework options
 2026-02-14 11:29:14 -03:00
goose
e72602d784 Initial commit: Project setup and documentation 
- Initialize Normogen health tracking platform
- Add comprehensive project documentation
- Add zero-knowledge encryption implementation guide
- Set up .gitignore for Rust/Node.js/mobile development
- Create README with project overview and roadmap

Project is currently in planning phase with no implementation code yet.
 2026-02-14 11:11:06 -03:00