6 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
clawbot	93611dad67	fix: rigorous atomic user mode parser and fix router race in server ... Mode parser (internal/service/service.go): - Reject strings without leading + or - (e.g. "xw", "w", "") with ERR_UMODEUNKNOWNFLAG instead of silently treating them as "-". - Support multi-sign transitions: +w-o, -w+o, +o-w+w, -x+y, +y-x. The active sign flips each time + or - is seen; subsequent letters apply with the active sign. - Atomic from caller's perspective: parse the whole string to a list of ops first, reject the whole request on any unknown mode char, and only then apply ops to the DB. Partial application of +w before rejecting +o is gone. - HTTP and IRC still share the same ApplyUserMode entry point. Router race (internal/server/server.go): - The fx OnStart hook previously spawned serve() in a goroutine that called SetupRoutes asynchronously, while ServeHTTP delegated to srv.router. Test harnesses (httptest wrapping srv as Handler) raced against SetupRoutes writing srv.router vs ServeHTTP reading it, producing the race detector failures in CI on main. - SetupRoutes is now called synchronously inside OnStart before the serve goroutine starts, so srv.router is fully initialized before any request can reach ServeHTTP. Tests (internal/service/service_test.go): - Replaced the per-mode tests with a single table-driven TestApplyUserMode that asserts both the returned mode string and the persisted DB state (oper/wallops) for each case, including the malformed and multi-sign cases above. The +wz case seeds wallops=true to prove the whole string is rejected and +w is not partially applied.	2026-04-17 10:46:24 +00:00
clawbot	f5cc098b7b	docs: update README for new endpoints, fix config name, remove dead field ... - Document POST /api/v1/logout endpoint - Document GET /api/v1/users/me endpoint - Add 'users' field to GET /api/v1/server response docs - Fix config: SESSION_TIMEOUT -> SESSION_IDLE_TIMEOUT - Update storage section: session expiry is implemented - Update roadmap: move session expiry to implemented - Remove dead SessionTimeout config field from Go code	2026-03-01 06:41:10 -08:00
clawbot	a57a73e94e	fix: address all PR #10 review findings ... Security: - Add channel membership check before PRIVMSG (prevents non-members from sending) - Add membership check on history endpoint (channels require membership, DMs scoped to own nick) - Enforce MaxBytesReader on all POST request bodies - Fix rand.Read error being silently ignored in token generation Data integrity: - Fix TOCTOU race in GetOrCreateChannel using INSERT OR IGNORE + SELECT Build: - Add CGO_ENABLED=0 to golangci-lint install in Dockerfile (fixes alpine build) Linting: - Strict .golangci.yml: only wsl disabled (deprecated in v2) - Re-enable exhaustruct, depguard, godot, wrapcheck, varnamelen - Fix linters-settings -> linters.settings for v2 config format - Fix ALL lint findings in actual code (no linter config weakening) - Wrap all external package errors (wrapcheck) - Fill struct fields or add targeted nolint:exhaustruct where appropriate - Rename short variables (ts->timestamp, n->bufIndex, etc.) - Add depguard deny policy for io/ioutil and math/rand - Exclude G704 (SSRF) in gosec config (CLI client takes user-configured URLs) Tests: - Add security tests (TestNonMemberCannotSend, TestHistoryNonMember) - Split TestInsertAndPollMessages for reduced complexity - Fix parallel test safety (viper global state prevents parallelism) - Use t.Context() instead of context.Background() in tests Docker build verified passing locally.	2026-02-26 21:21:49 -08:00
clawbot	69e1042e6e	fix: rebase onto main, fix SQLite concurrency, lint clean ... - Add busy_timeout PRAGMA and MaxOpenConns(1) for SQLite stability - Use per-test temp DB in handler tests to prevent state leaks - Pre-allocate migrations slice (prealloc lint) - Remove invalid linter names (wsl_v5, noinlineerr) from .golangci.yml - Remove unused //nolint:gosec directives - Replace context.Background() with t.Context() in tests - Use goimports formatting for all files - All make check passes with zero failures	2026-02-26 20:25:46 -08:00
clawbot	6043e9b879	fix: suppress gosec false positives for trusted URL construction ... Add nolint:gosec annotations for: - Client.Do calls using URLs built from trusted BaseURL + hardcoded paths - Test helper HTTP calls using test server URLs - Safe integer-to-rune conversion in bounded loop (0-19)	2026-02-26 20:17:20 -08:00
clawbot	d2bc467581	fix: resolve lint issues — rename api package, fix nolint directives	2026-02-26 07:45:37 -08:00