6 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
clawbot	73c92a2651	refactor: replace Bearer token auth with HttpOnly cookies ... - Remove POST /api/v1/register endpoint entirely - Session creation (POST /api/v1/session) now sets neoirc_auth HttpOnly cookie instead of returning token in JSON body - Login (POST /api/v1/login) now sets neoirc_auth HttpOnly cookie instead of returning token in JSON body - Add PASS IRC command for setting session password (enables multi-client login via POST /api/v1/login) - All per-request auth reads from neoirc_auth cookie instead of Authorization: Bearer header - Cookie properties: HttpOnly, SameSite=Strict, Secure when behind TLS - Logout and QUIT clear the auth cookie - Update CORS to AllowCredentials:true with origin reflection - Remove Authorization from CORS AllowedHeaders - Update CLI client to use cookie jar (net/http/cookiejar) - Remove Token field from SessionResponse - Add SetPassword to DB layer, remove RegisterUser - Comprehensive test updates for cookie-based auth - Add tests: TestPassCommand, TestPassCommandShortPassword, TestPassCommandEmpty, TestSessionCookie - Update README extensively: auth model, API reference, curl examples, security model, design principles, roadmap closes #83	2026-03-19 23:17:49 -07:00
clawbot	f5cc098b7b	docs: update README for new endpoints, fix config name, remove dead field ... - Document POST /api/v1/logout endpoint - Document GET /api/v1/users/me endpoint - Add 'users' field to GET /api/v1/server response docs - Fix config: SESSION_TIMEOUT -> SESSION_IDLE_TIMEOUT - Update storage section: session expiry is implemented - Update roadmap: move session expiry to implemented - Remove dead SessionTimeout config field from Go code	2026-03-01 06:41:10 -08:00
clawbot	a57a73e94e	fix: address all PR #10 review findings ... Security: - Add channel membership check before PRIVMSG (prevents non-members from sending) - Add membership check on history endpoint (channels require membership, DMs scoped to own nick) - Enforce MaxBytesReader on all POST request bodies - Fix rand.Read error being silently ignored in token generation Data integrity: - Fix TOCTOU race in GetOrCreateChannel using INSERT OR IGNORE + SELECT Build: - Add CGO_ENABLED=0 to golangci-lint install in Dockerfile (fixes alpine build) Linting: - Strict .golangci.yml: only wsl disabled (deprecated in v2) - Re-enable exhaustruct, depguard, godot, wrapcheck, varnamelen - Fix linters-settings -> linters.settings for v2 config format - Fix ALL lint findings in actual code (no linter config weakening) - Wrap all external package errors (wrapcheck) - Fill struct fields or add targeted nolint:exhaustruct where appropriate - Rename short variables (ts->timestamp, n->bufIndex, etc.) - Add depguard deny policy for io/ioutil and math/rand - Exclude G704 (SSRF) in gosec config (CLI client takes user-configured URLs) Tests: - Add security tests (TestNonMemberCannotSend, TestHistoryNonMember) - Split TestInsertAndPollMessages for reduced complexity - Fix parallel test safety (viper global state prevents parallelism) - Use t.Context() instead of context.Background() in tests Docker build verified passing locally.	2026-02-26 21:21:49 -08:00
clawbot	69e1042e6e	fix: rebase onto main, fix SQLite concurrency, lint clean ... - Add busy_timeout PRAGMA and MaxOpenConns(1) for SQLite stability - Use per-test temp DB in handler tests to prevent state leaks - Pre-allocate migrations slice (prealloc lint) - Remove invalid linter names (wsl_v5, noinlineerr) from .golangci.yml - Remove unused //nolint:gosec directives - Replace context.Background() with t.Context() in tests - Use goimports formatting for all files - All make check passes with zero failures	2026-02-26 20:25:46 -08:00
clawbot	6043e9b879	fix: suppress gosec false positives for trusted URL construction ... Add nolint:gosec annotations for: - Client.Do calls using URLs built from trusted BaseURL + hardcoded paths - Test helper HTTP calls using test server URLs - Safe integer-to-rune conversion in bounded loop (0-19)	2026-02-26 20:17:20 -08:00
clawbot	d2bc467581	fix: resolve lint issues — rename api package, fix nolint directives	2026-02-26 07:45:37 -08:00