user
ba943d95ed
feat: add per-IP rate limiting to login endpoint
...
check / check (push) Successful in 1m15s
Add a token-bucket rate limiter (golang.org/x/time/rate) that limits
login attempts per client IP on POST /api/v1/login. Returns 429 Too
Many Requests with a Retry-After header when the limit is exceeded.
Configurable via LOGIN_RATE_LIMIT (requests/sec, default 1) and
LOGIN_RATE_BURST (burst size, default 5). Stale per-IP entries are
automatically cleaned up every 10 minutes.
Only the login endpoint is rate-limited per sneak's instruction —
session creation and registration use hashcash proof-of-work instead.
2026-03-17 02:26:59 -07:00
f2e7a6ec85
[deps] Migrate from chi v1 to chi/v5 ( #73 )
...
check / check (push) Successful in 5s
## Summary
Migrates all `go-chi/chi` imports from v1 (v1.5.5) to v5 (v5.2.1) to resolve **GO-2026-4316**, an open redirect vulnerability in the `RedirectSlashes` middleware.
## Changes
- `go.mod`: replaced `github.com/go-chi/chi v1.5.5` with `github.com/go-chi/chi/v5 v5.2.1`
- Updated import paths in 4 files:
- `internal/server/server.go`
- `internal/server/routes.go`
- `internal/middleware/middleware.go`
- `internal/handlers/api.go`
- `go.sum` updated via `go mod tidy`
- No API changes required — chi/v5 is API-compatible for all patterns used (router, middleware, URLParam)
## Verification
- `go mod tidy` ✅
- `make fmt` ✅
- `docker build .` (runs `make check`: lint, fmt-check, test) ✅
- All tests pass with 58.1% handler coverage, 100% IRC numerics coverage
closes #42
Reviewed-on: #73
Co-authored-by: clawbot <clawbot@noreply.example.org >
Co-committed-by: clawbot <clawbot@noreply.example.org >
2026-03-13 00:32:10 +01:00
clawbot
8bb083a7f8
Add project scaffolding with fx DI, SQLite migrations, and healthcheck
...
- go.mod with git.eeqj.de/sneak/chat module
- internal packages: globals, logger, config, db, healthcheck, middleware, handlers, server
- SQLite database with embedded migration system (schema_migrations tracking)
- Migration 001: schema_migrations table
- Migration 002: channels table
- Config with chat-specific vars (MAX_HISTORY, SESSION_TIMEOUT, MAX_MESSAGE_SIZE, MOTD, SERVER_NAME, FEDERATION_KEY)
- Healthcheck endpoint at /.well-known/healthcheck.json
- Makefile, .gitignore
- cmd/chatd/main.go entry point
2026-02-09 12:22:28 -08:00
