From 71782f2e9b7c170d3738619770c23ab458ec7a53 Mon Sep 17 00:00:00 2001 From: sneak Date: Fri, 7 Aug 2026 16:37:15 +0000 Subject: [PATCH] docs: record startup config validation in TODO.md (closes #52) --- TODO.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/TODO.md b/TODO.md index 29359f7..5f6fa30 100644 --- a/TODO.md +++ b/TODO.md @@ -27,6 +27,12 @@ returns 410; logout redirects back to login # Completed Steps +- 2026-08-07 validate configuration on startup, fail fast on bad + config (closes #52): a config value that is set but unparseable or + invalid aborts startup naming the key and value (defaults apply only + to omitted keys), unknown config keys abort startup, a malformed + config file aborts instead of being skipped, and `state_dir` is + verified creatable and writable before the listener binds - 2026-08-07 fix the two remaining gosec findings (G124 in internal/session): session cookies now always carry Secure/HttpOnly/SameSite=Strict on both the set and clear paths; @@ -55,7 +61,6 @@ returns 410; logout redirects back to login - P0: implement cache size management and eviction so the disk cannot fill up -- P0: validate configuration on startup, fail fast on bad config - P1: implement blocked networks configuration to extend SSRF protection - P1: rate limit global concurrent upstream fetches to prevent