Implement IIdGenerator and the participant-token auth handler #17

New issue

Closed

opened 2026-07-05 19:20:14 +01:00 by TimCane · 0 comments

TimCane commented

2026-07-05 19:20:14 +01:00

(Migrated from github.com)

Goal

Crypto-RNG ids (22-char base64url), 43-char tokens, short codes; hex-SHA-256 token hashing; ParticipantTokenHandler resolving {sessionId}+bearer -> participantId claims, [Authorize] + HostOnly policy, and DomainExceptionMiddleware -> ProblemDetails.

References

Done when

Advances M2 A1 (auth matrix).

Part of M2: Session core.

## Goal Crypto-RNG ids (22-char base64url), 43-char tokens, short codes; hex-SHA-256 token hashing; ParticipantTokenHandler resolving {sessionId}+bearer -> participantId claims, [Authorize] + HostOnly policy, and DomainExceptionMiddleware -> ProblemDetails. ## References - [docs/07-backend-design.md](https://github.com/TimCane/bill-splitter/blob/main/docs/07-backend-design.md) - [docs/02-domain-model.md#participant](https://github.com/TimCane/bill-splitter/blob/main/docs/02-domain-model.md#participant) - [docs/04-api-contract.md#auth](https://github.com/TimCane/bill-splitter/blob/main/docs/04-api-contract.md#auth) - [docs/04-api-contract.md#errors](https://github.com/TimCane/bill-splitter/blob/main/docs/04-api-contract.md#errors) ## Done when - Advances M2 A1 (auth matrix). --- Part of **M2: Session core**.