@johnnyboy11234/esg-idea-contest 0.3.0 → 0.3.1

package/backend/api/openapi.yaml

@@ -152,6 +152,39 @@ paths:
         - name: size
           in: query
           schema: { type: integer, minimum: 1, maximum: 100, default: 20 }
+        - name: org
+          in: query
+          description: Closed set; an invalid value is 422 INVALID_ENUM (never ignored). Validated in the handler.
+          schema: { type: string }
+        - name: category
+          in: query
+          schema: { type: string }
+        - name: direction
+          in: query
+          schema: { type: string }
+        - name: leaderEmpNo
+          in: query
+          schema: { type: string }
+        - name: createdFrom
+          in: query
+          description: ISO 8601 instant with offset or Z; inclusive. Validated in the handler.
+          schema: { type: string }
+        - name: createdTo
+          in: query
+          description: ISO 8601 instant with offset or Z; exclusive. Validated in the handler.
+          schema: { type: string }
+        - name: q
+          in: query
+          description: Case-insensitive "name contains"; `%` and `_` are literal.
+          schema: { type: string }
+        - name: sort
+          in: query
+          description: createdAt (default) or name; anything else is 422 INVALID_ENUM. Validated in the handler.
+          schema: { type: string }
+        - name: order
+          in: query
+          description: asc or desc (default desc for createdAt, asc for name); anything else is 422 INVALID_ENUM. Validated in the handler.
+          schema: { type: string }
       responses:
         '200':
           description: One page of IdeaSummary
@@ -161,6 +194,42 @@ paths:
         '401': { $ref: '#/components/responses/Problem' }
         '422': { $ref: '#/components/responses/Problem' }
         '500': { $ref: '#/components/responses/Problem' }
+    post:
+      operationId: createIdea
+      tags: [ideas]
+      summary: Create an Idea with its slides (User only)
+      description: >
+        One atomic multipart request (PRD 6.6). Order: role 403, state 403, 400 (missing or repeated
+        part), 422 text fields (incl. FILENAME_TOO_LONG), file 413 / 422 EMPTY_FILE / 415 /
+        422 FILENAME_MISMATCH, 409 IDEA_DUPLICATE, then upload (503 STORAGE_UNAVAILABLE). A transaction
+        whose outcome is unknown answers 503 SERVICE_UNAVAILABLE (the Idea may exist). The Leader is
+        the caller; any leader value in the form is ignored. The body is read by the handler, so the
+        generated wrapper does not bind it.
+      parameters:
+        - $ref: '#/components/parameters/CsrfToken'
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema: { $ref: '#/components/schemas/CreateIdeaForm' }
+      responses:
+        '201':
+          description: Created; Location is /api/v1/ideas/{id}
+          headers:
+            Location:
+              schema: { type: string }
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/IdeaDetail' }
+        '400': { $ref: '#/components/responses/Problem' }
+        '401': { $ref: '#/components/responses/Problem' }
+        '403': { $ref: '#/components/responses/Problem' }
+        '409': { $ref: '#/components/responses/Problem' }
+        '413': { $ref: '#/components/responses/Problem' }
+        '415': { $ref: '#/components/responses/Problem' }
+        '422': { $ref: '#/components/responses/Problem' }
+        '500': { $ref: '#/components/responses/Problem' }
+        '503': { $ref: '#/components/responses/Problem' }
   /ideas/{id}:
     get:
       operationId: getIdea
@@ -259,6 +328,7 @@ components:
         field: { type: string }
         code: { type: string }
         expected: { type: string }
+        rule: { type: string, description: 'PASSWORD_POLICY only, the violated rule id (PRD 6.4)' }
     Deadline:
       type: object
       required: [deadline, state, serverTime]
@@ -272,6 +342,19 @@ components:
       properties:
         empNo: { type: string }
         name: { type: string }
+    CreateIdeaForm:
+      type: object
+      required: [category, org, direction, name, summary, slides]
+      properties:
+        category: { type: string, description: 'COOL_IDEA or OUTSTANDING_IMPACT' }
+        org: { type: string, description: 'AAID, BSID, ICSD, TSID, PLED or DEID' }
+        direction: { type: string, description: One of the five ESG directions (PRD 6.6) }
+        name: { type: string, description: '1-75 code points after clean-up; no / \ : * ? " < > |' }
+        summary: { type: string, description: 1-300 code points after clean-up }
+        slides:
+          type: string
+          format: binary
+          description: 'One PDF or PPTX, at most 5 MiB, named {I|O}_{org}_{leaderName}_{leaderEmpNo}_{name}.{pdf|pptx}'
     IdeaSummary:
       type: object
       required: [id, name, category, org, direction, leader, memberCount, myRelation, createdAt, slidesUpdatedAt]

package/backend/cmd/server/main.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"os"
 	"os/signal"
+	"sync"
 	"sync/atomic"
 	"syscall"
 
@@ -17,9 +18,12 @@ import (
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/deadline"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/config"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/job"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/storage"
 )
 
 func main() {
@@ -52,7 +56,14 @@ func run() error {
 		return err
 	}
 	sessions := auth.New(db)
-	logins, err := auth.NewLogins(sessions, auditSvc, auth.NoThrottle{}) // B1b-04 wires the real throttle
+	logins, err := auth.NewLogins(sessions, auditSvc, auth.DBThrottle{DB: db})
+	if err != nil {
+		return err
+	}
+	slides, err := storage.NewMinIO(storage.MinIOConfig{
+		Endpoint: cfg.MinIO.Endpoint, AccessKey: cfg.MinIO.AccessKey, SecretKey: cfg.MinIO.SecretKey,
+		Bucket: cfg.MinIO.Bucket, Secure: cfg.MinIO.Secure,
+	})
 	if err != nil {
 		return err
 	}
@@ -62,14 +73,36 @@ func run() error {
 		Logouts: auth.LogoutHandler{Logouts: &auth.Logouts{Sessions: sessions, Audit: auditSvc}, Fail: errs.Write},
 		Me:      auth.MeHandler{Sessions: sessions, Fail: errs.Write},
 		Account: account.Handler{
-			Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.StubPolicy{}},
+			Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.DefaultPolicy()},
 			Fail:    errs.Write,
 		},
 		Deadline: deadline.Handler{Store: deadline.SQLStore{DB: db}},
+		Ideas: idea.Handler{
+			Service: &idea.Service{
+				DB: db, Audit: auditSvc,
+				Gate:    deadline.Gate{Store: deadline.SQLStore{DB: db}},
+				Slides:  server.IdeaSlideRules(),
+				Objects: slides,
+				Aborter: storage.NewPendingDeletion(db, slides, log),
+			},
+			ExpectedFilename: storage.ExpectedFilenameBase,
+			Fail:             errs.Write,
+		},
 	}
 
+	// Background jobs stop when the root context is cancelled, or when Run
+	// returns for another reason, and are awaited before the pool closes.
+	jobCtx, stopJobs := context.WithCancel(ctx)
+	var jobs sync.WaitGroup
+	defer func() { stopJobs(); jobs.Wait() }()
+	jobs.Go(func() {
+		job.Run(jobCtx, log, job.Spec{Name: "auth-purge", Interval: auth.PurgeInterval, Jitter: auth.PurgeJitter},
+			auth.Purger{DB: db, Log: log}.Purge)
+	})
+
 	var ready atomic.Bool
 	return server.Run(ctx, cfg, log, server.NewPublic(log, server.Mount(si),
+		web.TrustedProxies(cfg.ProxyHops),
 		auth.Middleware(sessions, server.IsPublic, log),
 		csrf.Middleware(errs.Write, server.ActionFor)), &ready, server.DBCheck(db))
 }

package/backend/db/migration/V005__idea.sql

@@ -0,0 +1,49 @@
+-- V005 (B3-01): idea, one row per team (PRD 6.6). There is no Idea without slides, so the slide metadata
+-- lives on this row as NOT NULL columns (D22). Members are added by V006 (B5-01, idea_member).
+--   category / org / direction  closed value sets (VARCHAR + CHECK, never ENUM)
+--   name     1-75 code points, utf8mb4_bin: case-sensitive, unique per leader (D20), not globally
+--   summary  1-300 code points
+--   slides_object_key  slides/{ideaId}/{uuid}.{ext} (D50); the clean-up job asks "does any idea reference this key?"
+--   slides_size        1..5 MiB (5,242,880 bytes, PRD 6.8)
+--   version  optimistic-locking counter (PRD 9 #3); every successful UPDATE of the row adds 1
+-- The text clean-up (NFC, whitespace) is done by shared/text before the INSERT; the CHECKs are the second line.
+
+CREATE TABLE idea (
+    id                UUID          NOT NULL DEFAULT UUID(),
+    leader_id         UUID          NOT NULL,
+    category          VARCHAR(24)   NOT NULL,
+    org               VARCHAR(4)    NOT NULL,
+    direction         VARCHAR(24)   NOT NULL,
+    name              VARCHAR(75)   NOT NULL,
+    summary           VARCHAR(300)  NOT NULL,
+    slides_object_key VARCHAR(128)  NOT NULL,
+    slides_ext        VARCHAR(4)    NOT NULL,
+    slides_size       INT UNSIGNED  NOT NULL,
+    slides_sha256     CHAR(64)      NOT NULL,
+    slides_updated_at DATETIME(6)   NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+    version           INT UNSIGNED  NOT NULL DEFAULT 0,
+    created_at        DATETIME(6)   NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+    updated_at        DATETIME(6)   NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+    PRIMARY KEY (id),
+    -- A join request addresses an Idea by (leader employee ID, name) (PRD 6.6); this is also the IDEA_DUPLICATE guard.
+    UNIQUE KEY uq_idea_leader_name (leader_id, name),
+    -- Deleting a User is not a supported operation while they lead an Idea.
+    CONSTRAINT fk_idea_leader FOREIGN KEY (leader_id) REFERENCES app_user (id),
+    CONSTRAINT ck_idea_category CHECK (category IN ('COOL_IDEA', 'OUTSTANDING_IMPACT')),
+    CONSTRAINT ck_idea_org CHECK (org IN ('AAID', 'BSID', 'ICSD', 'TSID', 'PLED', 'DEID')),
+    CONSTRAINT ck_idea_direction CHECK (direction IN ('GREEN_MANUFACTURING', 'RESPONSIBLE_SUPPLY_CHAIN',
+        'INCLUSIVE_WORKPLACE', 'TALENT_DEVELOPMENT', 'CARING_FOR_DISADVANTAGED')),
+    CONSTRAINT ck_idea_name CHECK (CHAR_LENGTH(name) BETWEEN 1 AND 75
+        AND name NOT REGEXP '[[:cntrl:]]' AND name NOT REGEXP '[/\\\\:*?"<>|]'),
+    CONSTRAINT ck_idea_summary CHECK (CHAR_LENGTH(summary) BETWEEN 1 AND 300),
+    CONSTRAINT ck_idea_slides_ext CHECK (slides_ext IN ('pdf', 'pptx')),
+    CONSTRAINT ck_idea_slides_size CHECK (slides_size BETWEEN 1 AND 5242880),
+    CONSTRAINT ck_idea_slides_sha256 CHECK (slides_sha256 REGEXP '^[0-9a-f]{64}$'),
+    -- "My Ideas" and the Leader filter; the visibility query starts from here for Users.
+    KEY ix_idea_leader (leader_id, created_at, id),
+    -- Default list order (createdAt, id as final tie-breaker) and the name order.
+    KEY ix_idea_created (created_at, id),
+    KEY ix_idea_name (name, id),
+    -- Orphan-file check: "no idea row has slides_object_key = ?"
+    KEY ix_idea_slides_key (slides_object_key)
+) ENGINE = InnoDB DEFAULT CHARSET = utf8mb4 COLLATE = utf8mb4_bin;

package/backend/db/migration/V006__login_lock.sql

@@ -0,0 +1,15 @@
+-- V006 (B1b-04): per-key login lock (PRD 6.5, OI-12). One row per submitted employee-ID string (control
+-- characters stripped, cut to 32 chars), also for accounts that do not exist. All times are database time.
+--   fail_count   consecutive failures, each within 15 min of the previous one
+--   locked_until set by the 5th failure to NOW + 15 min (fixed; later failures never extend it)
+-- The IP sliding window (login_attempt) arrives with B1b-05.
+
+CREATE TABLE login_lock (
+    lock_key     VARCHAR(32) NOT NULL,
+    fail_count   INT         NOT NULL,
+    last_fail_at DATETIME(6) NOT NULL,
+    locked_until DATETIME(6) NULL,
+    PRIMARY KEY (lock_key),
+    -- Purge scans by age.
+    KEY ix_login_lock_last_fail (last_fail_at)
+) ENGINE = InnoDB DEFAULT CHARSET = utf8mb4 COLLATE = utf8mb4_bin;

package/backend/db/migration/V007__login_attempt.sql

@@ -0,0 +1,15 @@
+-- V007 (B1b-05): per-IP login failure events (PRD 6.5). One row per failed login attempt; the IP limit counts
+-- the rows of one address inside a sliding 15-minute window (30 failures -> 429). Throttled attempts are not
+-- recorded. All times are database time. Rows older than the window are dead weight; the purge job (B1b-07)
+-- deletes them by attempted_at.
+
+CREATE TABLE login_attempt (
+    id           BIGINT      NOT NULL AUTO_INCREMENT,
+    ip           INET6       NOT NULL,
+    attempted_at DATETIME(6) NOT NULL,
+    PRIMARY KEY (id),
+    -- Window count and "the 30th newest" lookup per address.
+    KEY ix_login_attempt_ip_time (ip, attempted_at),
+    -- Purge scans by age.
+    KEY ix_login_attempt_time (attempted_at)
+) ENGINE = InnoDB DEFAULT CHARSET = utf8mb4;

package/backend/db/migration/V008__pending_file_deletion.sql

@@ -0,0 +1,27 @@
+-- V008 (B3-06): pending_file_deletion, MinIO object keys that should be deleted (PRD 6.8, Sequence.md 2, D25, D36).
+-- Written in v1; the clean-up job that drains it is the next phase (PRD 9 #7). All times are database time.
+--   object_key       slides/{ideaId}/{uuid}.{ext}; no FK to idea: the row must outlive the idea it came from
+--   reason           REPLACED       old key, inserted in the transaction that switched the pointer
+--                    DELETED        key of a deleted Idea, inserted in the delete transaction
+--                    UPLOAD_ABORTED new key whose transaction rolled back (delete failed) or ended unknown;
+--                                   the job deletes it only after next_attempt_at AND if no idea row references it
+--   next_attempt_at  earliest time the job may act: NOW for REPLACED / DELETED / known rollback,
+--                    NOW + grace period for an unknown outcome (OI-19, proposed 10 min)
+--   attempts         failed job attempts so far (the job backs off with next_attempt_at)
+-- A key may appear more than once (UPLOAD_ABORTED after a lost COMMIT ack, later REPLACED), so it is not unique.
+-- A row is removed when the object was deleted, or when the job finds an UPLOAD_ABORTED key still referenced.
+
+CREATE TABLE pending_file_deletion (
+    id              BIGINT        NOT NULL AUTO_INCREMENT,
+    object_key      VARCHAR(128)  NOT NULL,
+    reason          VARCHAR(16)   NOT NULL,
+    created_at      DATETIME(6)   NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+    next_attempt_at DATETIME(6)   NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+    attempts        INT UNSIGNED  NOT NULL DEFAULT 0,
+    PRIMARY KEY (id),
+    CONSTRAINT ck_pending_file_deletion_reason CHECK (reason IN ('REPLACED', 'DELETED', 'UPLOAD_ABORTED')),
+    CONSTRAINT ck_pending_file_deletion_key CHECK (CHAR_LENGTH(object_key) BETWEEN 1 AND 128),
+    -- The job claims due rows: WHERE next_attempt_at <= NOW(6) ORDER BY next_attempt_at, id FOR UPDATE SKIP LOCKED.
+    KEY ix_pending_file_deletion_due (next_attempt_at, id),
+    KEY ix_pending_file_deletion_key (object_key)
+) ENGINE = InnoDB DEFAULT CHARSET = utf8mb4 COLLATE = utf8mb4_bin;

package/backend/db/migration/V009__login_throttle_audit.sql

@@ -0,0 +1,13 @@
+-- V009 (B1b-06): "a throttled key is audited once per window" (PRD 6.11). One row per throttled subject records
+-- until when its THROTTLED audit row has been written; a throttled attempt writes a new audit row only after it
+-- wins the claim (expired row updated, or row inserted), so replicas agree. All times are database time.
+--   scope  'key' (login_lock key) or 'ip' (source address)
+-- Rows past audited_until are dead weight; the purge job (B1b-07) deletes them.
+
+CREATE TABLE login_throttle_audit (
+    scope         VARCHAR(8)  NOT NULL,
+    subject       VARCHAR(45) NOT NULL,
+    audited_until DATETIME(6) NOT NULL,
+    PRIMARY KEY (scope, subject),
+    KEY ix_login_throttle_audit_until (audited_until)
+) ENGINE = InnoDB DEFAULT CHARSET = utf8mb4 COLLATE = utf8mb4_bin;

package/backend/go.mod

@@ -9,9 +9,13 @@ require (
 	github.com/go-chi/chi/v5 v5.2.3
 	github.com/go-sql-driver/mysql v1.9.3
 	github.com/google/uuid v1.6.0
+	github.com/minio/minio-go/v7 v7.4.1
 	github.com/oapi-codegen/runtime v1.8.0
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
+	github.com/testcontainers/testcontainers-go v0.45.0
 	github.com/testcontainers/testcontainers-go/modules/mariadb v0.45.0
+	github.com/testcontainers/testcontainers-go/modules/minio v0.45.0
+	github.com/testcontainers/testcontainers-go/modules/toxiproxy v0.45.0
 	golang.org/x/crypto v0.58.0
 	golang.org/x/text v0.43.0
 )
@@ -33,6 +37,7 @@ require (
 	github.com/docker/go-connections v0.8.2 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/ebitengine/purego v0.10.1 // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
@@ -40,9 +45,13 @@ require (
 	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.23.1 // indirect
 	github.com/go-openapi/swag/jsonname v0.26.0 // indirect
-	github.com/klauspost/compress v1.18.7 // indirect
+	github.com/klauspost/compress v1.19.2 // indirect
+	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
+	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e // indirect
 	github.com/magiconair/properties v1.18.12 // indirect
+	github.com/minio/crc64nvme v1.1.1 // indirect
+	github.com/minio/md5-simd v1.1.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/go-archive v0.3.3 // indirect
 	github.com/moby/moby/api v1.56.1 // indirect
@@ -57,17 +66,20 @@ require (
 	github.com/oasdiff/yaml3 v0.0.14 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/rs/xid v1.6.0 // indirect
 	github.com/shirou/gopsutil/v4 v4.26.6 // indirect
-	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/sirupsen/logrus v1.10.2 // indirect
 	github.com/speakeasy-api/jsonpath v0.6.3 // indirect
 	github.com/speakeasy-api/openapi v1.24.0 // indirect
 	github.com/stretchr/testify v1.12.1 // indirect
-	github.com/testcontainers/testcontainers-go v0.45.0 // indirect
+	github.com/tinylib/msgp v1.6.4 // indirect
 	github.com/tklauser/go-sysconf v0.4.0 // indirect
 	github.com/tklauser/numcpus v0.12.0 // indirect
 	github.com/vmware-labs/yaml-jsonpath v0.3.2 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
+	github.com/zeebo/xxh3 v1.1.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
 	go.opentelemetry.io/otel v1.44.0 // indirect
@@ -75,9 +87,11 @@ require (
 	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/mod v0.41.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
 	golang.org/x/sync v0.24.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 	golang.org/x/tools v0.51.0 // indirect
+	gopkg.in/ini.v1 v1.67.3 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 

package/backend/go.sum

@@ -44,13 +44,16 @@ github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDD
 github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960/go.mod h1:9HQzr9D/0PGwMEbC3d5AB7oi67+h4TsQqItC1GVYG58=
 github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936 h1:PRxIJD8XjimM5aTknUK9w6DHLDox2r2M3DI4i2pnd3w=
 github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936/go.mod h1:ttYvX5qlB+mlV1okblJqcSMtR4c52UKxDiX9GRBS8+Q=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/ebitengine/purego v0.10.1 h1:dewVBCBT2GaMu1SrNTYxQhgQBethzfhiwvZiLGP/qyY=
 github.com/ebitengine/purego v0.10.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
 github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/getkin/kin-openapi v0.142.0 h1:izj0vBdFprMhitfzaX8sTqztsEQyvwhssBoB6n8NO7w=
 github.com/getkin/kin-openapi v0.142.0/go.mod h1:3BH9M9XDe/y9M5DSvEocVYAYq1w0qrhJHjC/vZi0AaY=
 github.com/go-chi/chi/v5 v5.2.3 h1:WQIt9uxdsAbgIYgid+BpYc+liqQZGMHRaUwp0JUcvdE=
@@ -95,8 +98,13 @@ github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB7
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/juju/gnuflag v0.0.0-20171113085948-2ce1bb71843d/go.mod h1:2PavIy+JPciBPrBUjwbNvtwB6RQlve+hkpll6QSNmOE=
-github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
-github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
+github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
+github.com/klauspost/crc32 v1.3.0/go.mod h1:D7kQaZhnkX/Y0tstFGf8VUzv2UofNGqCjnC3zdHB0Hw=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -108,6 +116,14 @@ github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e h1:Q6MvJtQK/iRcRt
 github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
 github.com/magiconair/properties v1.18.12 h1:sT9zQpvTB3B4gzrX0tmZNTEaGyg8Zw55MFYRE32Mr9I=
 github.com/magiconair/properties v1.18.12/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/mdelapenya/tlscert v0.2.0 h1:7H81W6Z/4weDvZBNOfQte5GpIMo0lGYEeWbkGp5LJHI=
+github.com/mdelapenya/tlscert v0.2.0/go.mod h1:O4njj3ELLnJjGdkN7M/vIVCpZ+Cf0L6muqOG4tLSl8o=
+github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=
+github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
+github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
+github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
+github.com/minio/minio-go/v7 v7.4.1 h1:PtU/zIOfQRWZ+QydXAZysc+xZYHdG+BBR4Z6TUvy73w=
+github.com/minio/minio-go/v7 v7.4.1/go.mod h1:nQnQi7zTfXR4lREtYXZQWqo5aw0Rqv+ZqCGrTORygRk=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.3.3 h1:OxxR9paxsluYi+zDUEXTTaIxtkK3viymW+Ka7vRhhME=
@@ -159,36 +175,55 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
+github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.16.0 h1:O9DK+vNMDVGLr2BeZqmpLeMjiMNkuXfcqntWbZV6S5g=
+github.com/rogpeppe/go-internal v1.16.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
+github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shirou/gopsutil/v4 v4.26.6 h1:Mzr/npDtQC/xpeEuQKHZt8Zo9CmPvhTj8nkR8w5TLDs=
 github.com/shirou/gopsutil/v4 v4.26.6/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
+github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q=
 github.com/speakeasy-api/jsonpath v0.6.3 h1:c+QPwzAOdrWvzycuc9HFsIZcxKIaWcNpC+xhOW9rJxU=
 github.com/speakeasy-api/jsonpath v0.6.3/go.mod h1:2cXloNuQ+RSXi5HTRaeBh7JEmjRXTiaKpFTdZiL7URI=
 github.com/speakeasy-api/openapi v1.24.0 h1:opoD27rupX7zBVPq1HkIGLeMOzNNA7JalhYP8q34i04=
 github.com/speakeasy-api/openapi v1.24.0/go.mod h1:g3+dIMe0AYgbbGvnlQZqesmjAVWSm9BmsjLevnefQrg=
 github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad/go.mod h1:qLr4V1qq6nMqFKkMo8ZTx3f+BZEkzsRUY10Xsm2mwU0=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
 github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/testcontainers/testcontainers-go v0.45.0 h1:ss9Stm9KDX6JLgGL4jr2fC5dwpabTbCBsRcGadBPR9k=
 github.com/testcontainers/testcontainers-go v0.45.0/go.mod h1:VMJZ7M+qhgfEHWNbtjm596OyEOraULSTDaus/h0hmJI=
 github.com/testcontainers/testcontainers-go/modules/mariadb v0.45.0 h1:oN0eXjn9Ae43kJThdWosEiq5mbU7RvkuRIfOZnO8Awg=
 github.com/testcontainers/testcontainers-go/modules/mariadb v0.45.0/go.mod h1:z5rjEcunHetNxfFAIwKp2uO9RA91aWIC5wvMZyPKZG0=
+github.com/testcontainers/testcontainers-go/modules/minio v0.45.0 h1:y/Nj/4ZkI220EJM6L45dntmNh73qcH7wLEuAgc9pyrE=
+github.com/testcontainers/testcontainers-go/modules/minio v0.45.0/go.mod h1:C07UqpIojab780lr5P9tKaYIIz2sPZWOUjp2E12pmmQ=
+github.com/testcontainers/testcontainers-go/modules/redis v0.45.0 h1:U7GClvzAxLc7pjDfFxw3K6+odTa8NbxEa31svO5gl/Q=
+github.com/testcontainers/testcontainers-go/modules/redis v0.45.0/go.mod h1:06G3YVRf2RHAFNKwtFYhVd4CYgnXLWXmckaJNWI4fGY=
+github.com/testcontainers/testcontainers-go/modules/toxiproxy v0.45.0 h1:bzp1LLWbgE5cWpfuR5lW6PuVddRoz7yzgK2zkwXYMQg=
+github.com/testcontainers/testcontainers-go/modules/toxiproxy v0.45.0/go.mod h1:CWGzEsj3+TX1D21EcpY1SLSuNroXiXfnZUlUY9w71Hw=
+github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
+github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=
 github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI=
 github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=
@@ -198,6 +233,10 @@ github.com/vmware-labs/yaml-jsonpath v0.3.2/go.mod h1:U6whw1z03QyqgWdgXxvVnQ90zN
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
+github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
+github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
+github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
@@ -287,6 +326,8 @@ gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/ini.v1 v1.67.3 h1:iM9Lhz5MRSGhHVGGwCuzG9KO8PoirCXj/m/qTmOJJQw=
+gopkg.in/ini.v1 v1.67.3/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

package/backend/internal/account/account_test.go

@@ -15,7 +15,7 @@ import (
 // A Service with no database: every case here must be rejected before any I/O.
 func validate(t *testing.T, cmd account.RegisterCommand) *web.Error {
 	t.Helper()
-	svc := &account.Service{Policy: account.StubPolicy{}}
+	svc := &account.Service{Policy: account.DefaultPolicy()}
 	_, err := svc.Register(context.Background(), cmd, account.Request{})
 	var e *web.Error
 	if !errors.As(err, &e) {
@@ -25,7 +25,7 @@ func validate(t *testing.T, cmd account.RegisterCommand) *web.Error {
 }
 
 func good() account.RegisterCommand {
-	return account.RegisterCommand{EmpNo: "089290", Name: "王小明", Email: "a@b.c", Password: "whatever-goes"}
+	return account.RegisterCommand{EmpNo: "089290", Name: "王小明", Email: "a@b.c", Password: "Correct-Horse-1"}
 }
 
 func codes(e *web.Error) []string {
@@ -61,11 +61,11 @@ func TestRegisterValidation(t *testing.T) {
 		{"email non-ASCII", func(c *account.RegisterCommand) { c.Email = "é@x.com" }, web.CodeValidationFailed, "email:INVALID_FORMAT"},
 		{"email empty", func(c *account.RegisterCommand) { c.Email = "" }, web.CodeValidationFailed, "email:REQUIRED"},
 		{"email 255 chars", func(c *account.RegisterCommand) { c.Email = strings.Repeat("a", 253) + "@b" }, web.CodeValidationFailed, "email:OUT_OF_RANGE"},
-		{"password empty", func(c *account.RegisterCommand) { c.Password = "" }, web.CodeValidationFailed, "password:REQUIRED"},
-		{"password beyond bcrypt", func(c *account.RegisterCommand) { c.Password = strings.Repeat("p", 73) }, web.CodeValidationFailed, "password:OUT_OF_RANGE"},
+		{"password empty", func(c *account.RegisterCommand) { c.Password = "" }, web.CodePasswordPolicy, "password:PASSWORD_POLICY password:PASSWORD_POLICY"},
+		{"password beyond bcrypt", func(c *account.RegisterCommand) { c.Password = strings.Repeat("Pp1", 25) }, web.CodePasswordPolicy, "password:PASSWORD_POLICY"},
 		{"all fields in form order", func(c *account.RegisterCommand) {
 			c.EmpNo, c.Name, c.Email, c.Password = "x", "a:b", "nope", ""
-		}, web.CodeValidationFailed, "empNo:INVALID_FORMAT name:INVALID_NAME_CHARS email:INVALID_FORMAT password:REQUIRED"},
+		}, web.CodeValidationFailed, "empNo:INVALID_FORMAT name:INVALID_NAME_CHARS email:INVALID_FORMAT password:PASSWORD_POLICY password:PASSWORD_POLICY"},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -143,7 +143,7 @@ func TestTopCodeIsPasswordPolicyWhenFirst(t *testing.T) {
 
 func handlerFor(got *error) http.Handler {
 	h := account.Handler{
-		Service: &account.Service{Policy: account.StubPolicy{}},
+		Service: &account.Service{Policy: account.DefaultPolicy()},
 		Fail:    func(_ http.ResponseWriter, _ *http.Request, err error) { *got = err },
 	}
 	return http.HandlerFunc(h.Register)