feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).
2026-09-08 17:32:03 -04:00
commit c728016dec
128 changed files with 9788 additions and 0 deletions
@@ -0,0 +1,97 @@
+import 'dotenv/config';
+
+import { buildApp } from './build-app.js';
+import { createDatabase } from '../infrastructure/database/client.js';
+import { createPasswordResetNotifier } from '../infrastructure/email/password-reset-notifier.js';
+import { createRedisConnection } from '../infrastructure/redis/client.js';
+import { createAuthenticationService } from '../modules/auth/services/authentication-service.js';
+import { createMfaService } from '../modules/auth/services/mfa-service.js';
+import { createSecretProtector } from '../modules/auth/domain/secret-protection.js';
+import { createMfaMethodRepository } from '../modules/auth/repositories/mfa-method-repository.js';
+import { createSecurityAuditRepository } from '../modules/auth/repositories/security-audit-repository.js';
+import { createSessionRepository } from '../modules/auth/repositories/session-repository.js';
+import { createUserRepository } from '../modules/auth/repositories/user-repository.js';
+import { createPasswordResetRepository } from '../modules/auth/repositories/password-reset-repository.js';
+import { createRedisLoginRateLimiter } from '../modules/auth/services/login-rate-limiter.js';
+import { createPasswordRecoveryService } from '../modules/auth/services/password-recovery-service.js';
+import { createInventoryItemRepository } from '../modules/inventory/repositories/inventory-item-repository.js';
+import { createInventoryItemService } from '../modules/inventory/services/inventory-item-service.js';
+import { createInventoryImageRepository } from '../modules/inventory/repositories/inventory-image-repository.js';
+import { createInventoryImageService } from '../modules/inventory/services/inventory-image-service.js';
+import { createConditionRepository } from '../modules/inventory/repositories/condition-repository.js';
+import { createListingRepository } from '../modules/listings/repositories/listing-repository.js';
+import { createListingService } from '../modules/listings/services/listing-service.js';
+import { createProductRepository } from '../modules/products/repositories/product-repository.js';
+import { createProductService } from '../modules/products/services/product-service.js';
+
+function parsePort(value) {
+  const port = Number.parseInt(value ?? '3000', 10);
+
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error('API_PORT must be an integer between 1 and 65535.');
+  }
+
+  return port;
+}
+
+async function startServer() {
+  const database = createDatabase();
+  const redis = await createRedisConnection();
+  const productRepository = createProductRepository(database.db);
+  const inventoryItemRepository = createInventoryItemRepository(database.db);
+  const inventoryImageRepository = createInventoryImageRepository(database.db);
+  const listingRepository = createListingRepository(database.db);
+  const conditionRepository = createConditionRepository(database.db);
+  const userRepository = createUserRepository(database.db);
+  const sessionRepository = createSessionRepository(database.db);
+  const passwordResetRepository = createPasswordResetRepository(database.db);
+  const mfaMethodRepository = createMfaMethodRepository(database.db);
+  const securityAuditRepository = createSecurityAuditRepository(database.db);
+  const passwordResetNotifier = createPasswordResetNotifier();
+  const authenticationService = createAuthenticationService({
+    mfaService,
+    sessionRepository,
+    securityAuditRepository,
+    userRepository,
+  });
+  const app = buildApp({
+    authenticationService,
+    authenticateAdmin: (request) =>
+      authenticationService.authenticate(request.cookies.pokemon_inventory_session),
+    authorizeUnsafeRequest: (sessionToken, csrfToken) =>
+      authenticationService.authorizeUnsafeRequest(sessionToken, csrfToken),
+    isProduction: process.env.NODE_ENV === 'production',
+    loginRateLimiter: createRedisLoginRateLimiter({ redisClient: redis.client }),
+    mfaService,
+    passwordRecoveryService: createPasswordRecoveryService({
+      passwordResetNotifier,
+      passwordResetRepository,
+      securityAuditRepository,
+      userRepository,
+    }),
+    passwordResetRateLimiter: createRedisLoginRateLimiter({
+      keyPrefix: 'pokemon-inventory:auth:password-reset:',
+      redisClient: redis.client,
+    }),
+    inventoryItemService: createInventoryItemService({
+      conditionRepository,
+      inventoryItemRepository,
+      productRepository,
+    }),
+    inventoryImageService: createInventoryImageService({ inventoryImageRepository }),
+    listingService: createListingService({ listingRepository, inventoryImageRepository }),
+    productService: createProductService({ productRepository }),
+  });
+
+  app.addHook('onClose', async () => {
+    await database.close();
+    await redis.close();
+  });
+
+  await app.listen({ host: '0.0.0.0', port: parsePort(process.env.API_PORT) });
+}
+
+startServer().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});