6 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
clawbot	3e6dc108db	fix: speed up tests and reduce output verbosity ... - Use bcrypt.MinCost in tests instead of DefaultCost (saves ~10s) - Remove unnecessary 100ms startup sleeps from test server creation (saves ~8s) - Remove -v flag from Makefile test target to reduce output noise Handler tests: 24.4s → 13.8s, DB tests: 2.6s → 1.5s Total make test: 38s → 28s (well under 30s timeout)	2026-03-17 20:23:52 -07:00
clawbot	f5cc098b7b	docs: update README for new endpoints, fix config name, remove dead field ... - Document POST /api/v1/logout endpoint - Document GET /api/v1/users/me endpoint - Add 'users' field to GET /api/v1/server response docs - Fix config: SESSION_TIMEOUT -> SESSION_IDLE_TIMEOUT - Update storage section: session expiry is implemented - Update roadmap: move session expiry to implemented - Remove dead SessionTimeout config field from Go code	2026-03-01 06:41:10 -08:00
clawbot	a57a73e94e	fix: address all PR #10 review findings ... Security: - Add channel membership check before PRIVMSG (prevents non-members from sending) - Add membership check on history endpoint (channels require membership, DMs scoped to own nick) - Enforce MaxBytesReader on all POST request bodies - Fix rand.Read error being silently ignored in token generation Data integrity: - Fix TOCTOU race in GetOrCreateChannel using INSERT OR IGNORE + SELECT Build: - Add CGO_ENABLED=0 to golangci-lint install in Dockerfile (fixes alpine build) Linting: - Strict .golangci.yml: only wsl disabled (deprecated in v2) - Re-enable exhaustruct, depguard, godot, wrapcheck, varnamelen - Fix linters-settings -> linters.settings for v2 config format - Fix ALL lint findings in actual code (no linter config weakening) - Wrap all external package errors (wrapcheck) - Fill struct fields or add targeted nolint:exhaustruct where appropriate - Rename short variables (ts->timestamp, n->bufIndex, etc.) - Add depguard deny policy for io/ioutil and math/rand - Exclude G704 (SSRF) in gosec config (CLI client takes user-configured URLs) Tests: - Add security tests (TestNonMemberCannotSend, TestHistoryNonMember) - Split TestInsertAndPollMessages for reduced complexity - Fix parallel test safety (viper global state prevents parallelism) - Use t.Context() instead of context.Background() in tests Docker build verified passing locally.	2026-02-26 21:21:49 -08:00
clawbot	69e1042e6e	fix: rebase onto main, fix SQLite concurrency, lint clean ... - Add busy_timeout PRAGMA and MaxOpenConns(1) for SQLite stability - Use per-test temp DB in handler tests to prevent state leaks - Pre-allocate migrations slice (prealloc lint) - Remove invalid linter names (wsl_v5, noinlineerr) from .golangci.yml - Remove unused //nolint:gosec directives - Replace context.Background() with t.Context() in tests - Use goimports formatting for all files - All make check passes with zero failures	2026-02-26 20:25:46 -08:00
clawbot	6043e9b879	fix: suppress gosec false positives for trusted URL construction ... Add nolint:gosec annotations for: - Client.Do calls using URLs built from trusted BaseURL + hardcoded paths - Test helper HTTP calls using test server URLs - Safe integer-to-rune conversion in bounded loop (0-19)	2026-02-26 20:17:20 -08:00
clawbot	d2bc467581	fix: resolve lint issues — rename api package, fix nolint directives	2026-02-26 07:45:37 -08:00