# Current

> Keep this file short. One active step, one ordered backlog. Completed work moves to
> [progress.md](progress.md). If this file starts reading like a changelog, it has
> drifted — that's exactly what went wrong last time.

## Active: Milestone 1 — Identity, thin

**Goal:** the app knows who you are. An unclaimed installation is claimed through
`/setup`, and the resulting owner can log in and out. Enough identity to hang a profile
page off, and no more.

**Explicitly out of scope** — these are Milestone 7: multi-user registration,
invite codes, `RegistrationPolicy`, organisation management UI, roles beyond owner.

### Steps

- [x] Domain: typed IDs, `Email`, `PasswordHash`, `User`, `Organization`,
      `Membership`, `Role`, `Actor`, `DomainError`
- [x] Domain: repository traits — `UserRepository`, `OrgRepository`,
      `MembershipRepository`
- [x] Infrastructure: in-memory implementations (these are what make use cases
      testable without a database)
- [x] Application: `PasswordHasher` port + Argon2 adapter, stub hasher for tests
- [x] Domain: `SetupToken` — one-time claim secret, constant-time comparison
- [x] Application: `claim_instance` use case — token-gated, creates org → user →
      owner membership, returns the owner signed in
- [x] Application: `login` use case — verifies credentials, returns an `Actor`
- [x] Infrastructure: migrations + SQLite implementations
- [x] Infrastructure: `sessions` table + session storage
- [x] Boot: mint and print a `SetupToken` when unclaimed; register it in app context
- [x] Web: `/setup` claim page; every other route redirects there while unclaimed
- [x] Web: login page, logout, `current_actor(cx)` helper
- [ ] `/api/me` — first `/api` route, proves the use case layer has two consumers

### Done when

A fresh database prints a setup token at boot; `/setup` with that token creates the
owner and signs them in; logging out and back in works; `/api/me` returns that
identity.

Everything but `/api/me` is done and verified in a browser.

### Resolved

- **`__Host-` cookies need a secure context — and it bit.** The claim succeeded, the
  server recorded sessions, and every page still rendered signed out, because the
  browser silently discarded a `Secure` cookie served over plain HTTP. Nothing errored
  on either side. Fixed with `InsecureCookieTokenStore` behind
  `STEID_INSECURE_COOKIES`, off by default — see [runbook.md](runbook.md#configuration).
- **Claim TOCTOU** is now covered by a test that drives a real claim through the SQLite
  repos and asserts `unique(orgs.name)` / `unique(users.email)` refuse the second.

### Watch for

- **CSRF.** `SameSite=Lax` blocks cross-site POSTs, which covers the common case.
  Whether forms also want tokens is an open decision, not a default to pick quietly.
  Still undecided.
- **No rate limiting anywhere.** `/login` and `/setup` accept unlimited attempts. The
  setup token has 256 bits so brute force is not the worry; password guessing is.
- **Form errors are invisible.** A wrong token or password redirects back with no
  message — deliberate, so failures can't be used to probe, but indistinguishable from
  a broken form. Flash messages are the fix and don't exist yet.
- **Session sweeping is never called.** `sweep_expired` exists and is tested but
  nothing invokes it, so expired rows accumulate. Expiry is enforced on read, so this
  is tidiness rather than a security hole.
- **Foreign key ordering.** The org must be saved before the user — attempt #2 had to
  fix this in two places. Enforced now: `foreign_keys(true)` plus a test.
- Never log or `Debug`-print a password. `PasswordHash` is opaque on purpose.

## Backlog

Ordered. Pull from the top.

1. **Milestone 2 — Profile page.** `/{owner}` becomes the real home page, replacing
   the Milestone 0 placeholder. The frame the rest of the product hangs in.
2. **Milestone 3 — Writing.** Posts, markdown rendering, `/{owner}/{slug}`.
   *Open question: is writing actually the first portfolio feature, or is it
   projects/showcases?*
3. **Milestone 4 — Repo model.** `Repository` entity, `Visibility`, `create_repo`,
   bare repo on disk at `{data_dir}/{org}/{repo}.git`. Watch the DB-plus-filesystem
   atomicity problem — see [architecture.md](architecture.md#db-plus-filesystem-writes).
4. **Milestone 5 — Git over HTTP.** `git http-backend` subprocess, PATs over HTTP
   Basic. See [0001](decisions/0001-git-over-http-not-ssh.md).

## Open questions

- **Topcoat is early** (v0.5.0, first released 2026-07-22, breaking changes expected
  by its own authors). Expect churn that isn't feature work.
- Body size limits will reject large pushes at Milestone 5 — `topcoat-router` has a
  `body_limit` layer that needs raising on the git routes. Recorded here because it
  will surface as a confusing failure rather than a clear one.
- Topcoat ships Tailwind without Node, which reopens the design system attempt #1
  dropped purely to avoid an npm build step — see [ui.md](ui.md).

## Routing findings (Milestone 0)

- **Topcoat 0.5 requires rustc ≥ 1.95.** On an older toolchain `cargo add topcoat`
  silently resolves to an empty `topcoat v0.0.0` placeholder instead of failing. Local
  stable is now 1.97.1.
- `Router::builder().discover()` collects `#[page]`-annotated items **at link time**,
  so pages can live in any module. Layering is our choice, not the framework's.
- `module_router!` derives each URL from the module tree rather than a path string.
  Still deferred — Steid's URL space is parameterised at the root (`/{owner}`,
  `/{owner}/{repo}`), which means `path_param!` declarations inside route modules.
  Worth designing at Milestone 2 when the profile page makes it concrete.
- Path and query params are read from `Cx` via `path_param!` / `#[query_params]`, not
  injected as handler arguments. Parses are memoized per request.
- Layouts wrap by path prefix and nest outermost-first, and a layout can catch a page's
  `NotFoundError` to render a branded 404.
- `HOST` / `PORT` configure the bind address, so `STEID_LISTEN_ADDR` is gone.
- `Body` is a boxed `http_body::Body` used for both requests and responses, with
  `into_data_stream()` to read and `Body::new()` to wrap a stream — pack data can
  stream both directions without buffering. This is what makes Milestone 5 viable.