 Kharec
|
e2c46c9e58
|
fix: SSRF DNS rebinding
|
2026-07-23 16:41:17 +02:00 |
|
|
Kharec
|
96958af310
|
clean: remove unused middleware and tests
|
2026-07-23 16:41:04 +02:00 |
|
|
Kharec
|
f7d43def1c
|
chore: ignore SECURITY_AUDIT.md and stop tracking it
|
2026-05-06 20:14:33 +02:00 |
|
|
Kharec
|
d891b33b57
|
docs(SECURITY_AUDIT): mark Phase 2–4 remediation complete
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
60daeddbe4
|
docs: proxy HSTS trust, middleware order, and Swagger gating
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
537a7e3759
|
docs(.env.example): document SWAGGER_ENABLED for production Swagger
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
194884293f
|
test(e2e): align security header checks with CSP-only XSS defense
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
0fbb6f4a88
|
test(integration): drop deprecated X-XSS-Protection expectation
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
b3f6f5b15e
|
test(handlers): RequireAuth distinguishes missing context from user id zero
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
2ede636bd6
|
test(server): Swagger hidden in production unless SWAGGER_ENABLED
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
7c525e71cb
|
test(middleware): encoded SQL query triggers suspicious activity log
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
620798577e
|
test(middleware): cache LRU, SHA-256 keys, prefix invalidation
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
b41d3bb20c
|
fix(server): gate Swagger by env and pass cache invalidation prefixes
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
abaf46e624
|
test(middleware): CSP config and removed XSS auditor header
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
61875201f9
|
fix(middleware): configurable Swagger CSP, log CSP nonce errors, drop X-XSS-Protection
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
d668567dc5
|
test(middleware): GetUserIDFromContext returns nil or pointer
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
102f1d8400
|
fix(middleware): decode URL before suspicious SQL/XSS probes
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
98985db537
|
fix(middleware): rate-limit key uses optional user ID pointer
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
be64e7c8d2
|
fix(middleware): SHA-256 keys, LRU cache, and prefix-scoped invalidation
|
2026-05-06 20:13:56 +02:00 |
|
|
Kharec
|
1aa256c6a8
|
fix(handlers): RequireAuth and VoteContext use optional user ID pointer
|
2026-05-06 20:07:47 +02:00 |
|
|
Kharec
|
dccf85e038
|
fix(middleware): return *uint from GetUserIDFromContext for nil when unauthenticated
|
2026-05-06 20:07:41 +02:00 |
|
|
Kharec
|
4e188eb8d5
|
test(middleware): expect CSRF cookie readable by script for header submit
|
2026-05-06 20:07:35 +02:00 |
|
|
Kharec
|
2adf72c138
|
fix(middleware): set CSRF cookie HttpOnly false for double-submit from JS
|
2026-05-06 20:07:00 +02:00 |
|
|
Kharec
|
add60ad3c2
|
test(middleware): CORS wildcard+credentials panic and trimmed env origins
|
2026-05-06 20:06:55 +02:00 |
|
|
Kharec
|
89131331a6
|
fix(middleware): validate CORS origins and reject wildcard with credentials
|
2026-05-06 20:06:53 +02:00 |
|
|
Kharec
|
0baf7053fc
|
test(middleware): lock rapid-request tracker reset in TestIsRapidRequest
|
2026-05-06 16:47:46 +02:00 |
|
|
Kharec
|
5d145613d2
|
fix(middleware): add mutex for rapid-request counter
|
2026-05-06 16:47:35 +02:00 |
|
|
Kharec
|
12db6409ce
|
test: cover CSRF skip behavior for Bearer vs cookie auth
|
2026-04-23 13:34:51 +02:00 |
|
|
Kharec
|
5fc208c9da
|
fix: only skip CSRF for /api/ routes with Bearer tokens
|
2026-04-23 13:34:43 +02:00 |
|
|
Kharec
|
ab17ff8b79
|
test: verify DecompressionMiddleware enforces size limit
|
2026-04-23 13:26:15 +02:00 |
|
|
Kharec
|
8990f5afb7
|
fix: cap decompressed request body side to prevent DoS
|
2026-04-23 13:26:03 +02:00 |
|
|
Kharec
|
8f255a4fe6
|
docs: update roadmap
|
2026-04-02 18:29:48 +02:00 |
|
|
Kharec
|
d56ee03cdb
|
fix: typo
|
2026-03-30 21:39:05 +02:00 |
|
|
Kharec
|
e58ba1b8d1
|
chore: add title
|
2026-03-18 18:07:15 +01:00 |
|
|
Kharec
|
4ffc601723
|
fix: avoid mangle backslash
|
2026-03-11 07:22:51 +01:00 |
|
|
Kharec
|
d6321e775a
|
test(integration): update DB monitoring health assertion to match nested services payload
|
2026-03-06 15:37:53 +01:00 |
|
|
Kharec
|
de9b544afb
|
refactor(cors): deduplicate origin validation and header logic without behavior change
|
2026-03-06 15:37:44 +01:00 |
|
|
Kharec
|
19291b7f61
|
feat: update swagger
|
2026-03-05 11:39:24 +01:00 |
|
|
Kharec
|
c31eb2f3df
|
test(e2e): make middleware tests assertion-driven and deterministic
|
2026-02-23 07:11:22 +01:00 |
|
|
Kharec
|
de08878de7
|
test(e2e): add middleware-enabled test context and server config toggles
|
2026-02-23 07:11:17 +01:00 |
|
|
Kharec
|
f0e8da51d0
|
feat(server): allow cacheable paths to be configured in router
|
2026-02-23 07:11:14 +01:00 |
|
|
Kharec
|
85882bae14
|
refactor: go fix ftw
|
2026-02-19 17:37:42 +01:00 |
|
|
Kharec
|
9185ffa6b5
|
test(server): mock title fetcher in router tests to remove network dependency
|
2026-02-19 17:37:31 +01:00 |
|
|
Kharec
|
986b4e9388
|
refactor: modernize code using go fix
|
2026-02-19 17:31:06 +01:00 |
|
|
Kharec
|
ac6e1ba80b
|
refactor: modern code using go fix
|
2026-02-19 17:30:12 +01:00 |
|
|
Kharec
|
14da02bc3f
|
refactor: use go fix
|
2026-02-19 17:29:44 +01:00 |
|
|
Kharec
|
31ef30c941
|
test(health): expect unhealthy for SMTP connection failures
|
2026-02-16 08:43:46 +01:00 |
|
|
Kharec
|
d4a89325e0
|
fix(health): mark SMTP connection/bootstrap failures as unhealthy
|
2026-02-16 08:43:33 +01:00 |
|
|
Kharec
|
4eb0a6360f
|
test(health): cover SMTP unhealthy aggregation behavior
|
2026-02-16 08:43:14 +01:00 |
|
|
Kharec
|
040b9148de
|
fix(health): treat SMTP unhealthy as degraded at app level
|
2026-02-16 08:43:01 +01:00 |
|
|
Kharec
|
6e0dfabcff
|
feat: health check now return json, definitely
|
2026-02-16 08:33:51 +01:00 |
|
|
Kharec
|
9e81ddfdfa
|
fix: don't reinvent the wheel
|
2026-02-15 12:05:25 +01:00 |
|
|
Kharec
|
b3b7c1d527
|
test: health check now supports smtp so we test it
|
2026-02-15 12:04:06 +01:00 |
|
|
Kharec
|
4c1caa44dd
|
refactor: smtp tests
|
2026-02-15 12:03:55 +01:00 |
|
|
Kharec
|
52c964abd2
|
docs: update readme
|
2026-02-15 12:00:33 +01:00 |
|
|
Kharec
|
a854138eac
|
feat: design a health subcommand
|
2026-02-15 11:59:16 +01:00 |
|
|
Kharec
|
70bfb54acf
|
refactor: use new health package
|
2026-02-15 11:56:19 +01:00 |
|
|
Kharec
|
a3ed6685de
|
feat: design a separate package for health check
|
2026-02-15 11:56:12 +01:00 |
|
|
Kharec
|
8f30fe7412
|
docs: update readme
|
2026-02-14 12:32:29 +01:00 |
|
|
Kharec
|
1a051b594c
|
fix: customize upvote ratio
|
2026-02-14 12:32:18 +01:00 |
|
|
Kharec
|
9718bcc79b
|
docs: update readme
|
2026-02-13 07:48:53 +01:00 |
|
|
Kharec
|
b1146b241c
|
feat: upgrade to go 1.26
|
2026-02-13 07:48:50 +01:00 |
|
|
Kharec
|
034bd8669e
|
test: cover lock after seeding behavior
|
2026-02-10 17:37:38 +01:00 |
|
|
Kharec
|
dc8a25d3b4
|
feat: lock seed user after seeding
|
2026-02-10 17:37:22 +01:00 |
|
|
Kharec
|
4d2018b20a
|
test(e2e): split auth tests, remove sleep/retry skips, and dedupe security coverage
|
2026-02-10 17:19:00 +01:00 |
|
|
Kharec
|
65109a787c
|
feat: use GetVersion()
|
2026-01-26 22:17:14 +01:00 |
|
|
Kharec
|
75f1406edf
|
feat: use a getter
|
2026-01-26 22:17:02 +01:00 |
|
|
Kharec
|
11dc9b507f
|
feat: bump version to 0.1.1
|
2026-01-19 21:07:39 +01:00 |
|
|
Kharec
|
da616438e9
|
chore: update version in swagger
|
2026-01-19 21:07:30 +01:00 |
|
|
Kharec
|
7486865343
|
lint: remove duplicate string literals in seed tests
|
2026-01-19 16:43:51 +01:00 |
|
|
Kharec
|
fd0fd8954a
|
fix: close captureOutput pipe before read
|
2026-01-19 16:37:22 +01:00 |
|
|
Kharec
|
628db14f59
|
fix: avoid Update deadlock by unlocking before display
|
2026-01-19 16:37:15 +01:00 |
|
|
Kharec
|
7be196e4c3
|
test: move seed RNG to tests and add help/error cases
|
2026-01-19 16:37:01 +01:00 |
|
|
Kharec
|
2f4bd45efb
|
feat: make seed transactional and sequential with helpers
|
2026-01-19 16:36:51 +01:00 |
|
|
Kharec
|
1b53c2b66b
|
clean: get rid of parallel processor
|
2026-01-19 16:36:40 +01:00 |
|
|
Kharec
|
509e68f538
|
docs: review roadmap
|
2026-01-16 11:23:27 +01:00 |
|
|
Kharec
|
e6a44d830e
|
fix: avoid repeated string concatenation
|
2026-01-14 17:05:20 +01:00 |
|
|
Kharec
|
fe396b7537
|
feat: scope help printer to root command run
|
2026-01-14 13:00:03 +01:00 |
|
|
Kharec
|
6eb04aa3c5
|
refactor: adapt test name
|
2026-01-14 12:59:14 +01:00 |
|
|
Kharec
|
517d4482c9
|
test: fuzz urfave command path
|
2026-01-13 07:58:08 +01:00 |
|
|
Kharec
|
b6e2bf942a
|
tests: drive cli via urfave root command
|
2026-01-13 07:57:48 +01:00 |
|
|
Kharec
|
9f1058ba81
|
tests: assert server fields and use urfave cli
|
2026-01-13 07:57:37 +01:00 |
|
|
Kharec
|
2bdbb29ae6
|
refactor: remove legacy dispatch
|
2026-01-13 07:57:26 +01:00 |
|
|
Kharec
|
9d243a0ed1
|
docs: mark cli migration as complete
|
2026-01-13 07:46:38 +01:00 |
|
|
Kharec
|
9c74828b8d
|
tests: fuzz urfave command parsing
|
2026-01-13 07:46:30 +01:00 |
|
|
Kharec
|
9e78477eb5
|
tests: update cli help/json checks
|
2026-01-13 07:46:23 +01:00 |
|
|
Kharec
|
a74980caa1
|
deps: add urfave/cli v3 checksums
|
2026-01-13 07:46:05 +01:00 |
|
|
Kharec
|
816f08a20a
|
deps: add urfave/cli v3
|
2026-01-13 07:45:53 +01:00 |
|
|
Kharec
|
0cec152486
|
feat: migrate cli to urfave/cli v3
|
2026-01-13 07:45:18 +01:00 |
|
|
Kharec
|
5413737491
|
test: match validation error casing with json tags
|
2026-01-12 22:49:40 +01:00 |
|
|
Kharec
|
5f605e45c7
|
test: align title validation errors with json tags
|
2026-01-12 22:49:30 +01:00 |
|
|
Kharec
|
e5779183ff
|
test: cover json tag display and whitespace required case
|
2026-01-12 22:49:17 +01:00 |
|
|
Kharec
|
4814b64c2c
|
refactor: improve validation messages and string handling
|
2026-01-12 22:49:08 +01:00 |
|
|
Kharec
|
45cad505d6
|
fix: break import cycle by inlining fuzz helpers
|
2026-01-12 22:40:12 +01:00 |
|
|
Kharec
|
7f52347854
|
fix: enable foreign keys before AutoMigrate in fuzz DB
|
2026-01-12 22:37:54 +01:00 |
|
|
Kharec
|
542913cbef
|
fix: enable foreign key enforcement in fuzz DB
|
2026-01-12 22:36:46 +01:00 |
|
|
Kharec
|
2f964b0c79
|
fix: prevent schema drift in fuzz tests with AutoMigrate
|
2026-01-12 22:35:56 +01:00 |
|
|
Kharec
|
250ff79eeb
|
test: update TestGetFuzzDB to expect new DB instances per call
|
2026-01-12 22:34:44 +01:00 |
|
|
Kharec
|
4dfe260953
|
fix: remove global sync.Once to prevent DB state leakage in fuzz tests
|
2026-01-12 22:34:36 +01:00 |
|
|
Kharec
|
49e6bb1e9d
|
test: simplify pagination test loops
|
2026-01-12 12:26:26 +01:00 |
|