8 Commits

Include renames

Author	SHA1	Message	Date
sneak	6a753f14c4	feat: CSRF protection on the login and URL-generator forms (closes #93) ... Both cookie-authenticated HTML form posts (POST / and POST /generate) now require a CSRF token via gorilla/csrf, the recorded default in GO_PACKAGE_DEFAULTS.md. The token cookie is independent of the session cookie, so it also covers the login POST, where no session exists yet (login CSRF). The token key is derived from the signing key with its own HKDF salt, so tokens survive restarts and reuse no other key material; gorilla/csrf supplies crypto/rand generation and constant-time compare. The form routes sit in a chi group behind the middleware; the hidden token field is rendered into login.html and generator.html. In local plaintext HTTP mode (debug) requests are marked plaintext so the library does not demand an https Referer or set a Secure cookie the browser would withhold; in production, behind the TLS-terminating proxy, it enforces its https Referer origin check. model: claude-opus-4-8	2026-09-21 12:57:23 +00:00
clawbot	04b5db6fbf	next -&gt; main (1.0.0 milestone) (#105) ... Accumulating milestone branch. One squashed commit per closed issue; `next` is kept green and mergeable to `main` at any time without notice. Landed so far: - `chore: update golangci-lint to v2.12.2 with canonical config` (#54) — canonical v2-schema `.golangci.yml`, pins bumped in `Dockerfile` and `script/bootstrap`, tree at `0 issues.`. Three behaviour deltas are recorded in that PR's body: `Cache.StoreVariant` takes a context, `MetadataStorage.Store` no longer leaks temp files on failure, and the `signing_key` too-short error text gained a `value too short:` prefix. Sequencing for the milestone is tracked in #103. Reviewed-on: #105 Co-authored-by: clawbot <clawbot@noreply.example.org>	2026-09-21 09:31:54 +02:00
sneak	87a8393537	Change encrypted URL format to /v1/e/{token}/img.{ext} ... Add trailing filename to encrypted URLs for better browser compatibility. The filename is ignored by the server but helps browsers identify content type.	2026-01-08 16:14:01 -08:00
sneak	1f809a6fc9	Implement ETag, HEAD requests, and conditional requests ... - Add ETag generation based on output content hash (first 16 chars) - Add ContentLength to ImageResponse from cache - Add LoadWithSize method to ContentStorage - Add GetOutputWithSize method to Cache - Handle HEAD requests returning headers only - Handle If-None-Match conditional requests returning 304 - Register HEAD route for image proxy endpoint	2026-01-08 10:08:38 -08:00
sneak	2e349a8b83	Implement security headers middleware ... Adds X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and X-XSS-Protection headers to all responses.	2026-01-08 10:02:17 -08:00
sneak	1f0ec59eb5	Wire up auth routes and encrypted URL endpoint ... Add session manager and encurl generator to handlers. Register /, /logout, /generate, /v1/e/{token}, /static/* routes.	2026-01-08 07:38:44 -08:00
sneak	0eb6193431	Use HTTPWriteTimeout constant for request timeout	2026-01-08 02:22:25 -08:00
sneak	516853626d	Add basic webserver skeleton with healthcheck	2026-01-08 02:20:23 -08:00