sneak
a2f96fc40e
check / check (push) Failing after 1s
Both cookie-authenticated HTML form posts (POST / and POST /generate) now require a CSRF token via gorilla/csrf, the recorded default in GO_PACKAGE_DEFAULTS.md. The token cookie is independent of the session cookie, so it also covers the login POST, where no session exists yet (login CSRF). The token key is derived from the signing key with its own HKDF salt, so tokens survive restarts and reuse no other key material; gorilla/csrf supplies crypto/rand generation and constant-time compare. The form routes sit in a chi group behind the middleware; the hidden token field is rendered into login.html and generator.html. In local plaintext HTTP mode (debug) requests are marked plaintext so the library does not demand an https Referer or set a Secure cookie the browser would withhold; in production, behind the TLS-terminating proxy, it enforces its https Referer origin check. Model: opus-4-8
161 lines
7.8 KiB
AMPL
161 lines
7.8 KiB
AMPL
module sneak.berlin/go/pixa
|
|
|
|
go 1.25.4
|
|
|
|
require (
|
|
git.eeqj.de/sneak/smartconfig v1.0.0
|
|
github.com/99designs/basicauth-go v0.0.0-20230316000542-bf6f9cbbf0f8
|
|
github.com/davidbyttow/govips/v2 v2.16.0
|
|
github.com/dustin/go-humanize v1.0.1
|
|
github.com/fxamacker/cbor/v2 v2.9.0
|
|
github.com/getsentry/sentry-go v0.40.0
|
|
github.com/go-chi/chi/v5 v5.2.3
|
|
github.com/go-chi/cors v1.2.2
|
|
github.com/gorilla/csrf v1.7.3
|
|
github.com/gorilla/securecookie v1.1.2
|
|
github.com/prometheus/client_golang v1.23.2
|
|
github.com/slok/go-http-metrics v0.13.0
|
|
github.com/spf13/cobra v1.10.2
|
|
go.uber.org/fx v1.24.0
|
|
golang.org/x/crypto v0.41.0
|
|
modernc.org/sqlite v1.42.2
|
|
)
|
|
|
|
require (
|
|
cloud.google.com/go/auth v0.16.2 // indirect
|
|
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
|
|
cloud.google.com/go/compute/metadata v0.7.0 // indirect
|
|
cloud.google.com/go/iam v1.5.2 // indirect
|
|
cloud.google.com/go/secretmanager v1.15.0 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.1 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/keyvault/azsecrets v0.12.0 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
|
|
github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 // indirect
|
|
github.com/armon/go-metrics v0.4.1 // indirect
|
|
github.com/aws/aws-sdk-go-v2 v1.36.6 // indirect
|
|
github.com/aws/aws-sdk-go-v2/config v1.29.18 // indirect
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.17.71 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.33 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.37 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.37 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.18 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.8 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.25.6 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.34.1 // indirect
|
|
github.com/aws/smithy-go v1.22.4 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/coreos/go-semver v0.3.1 // indirect
|
|
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/emicklei/go-restful/v3 v3.12.1 // indirect
|
|
github.com/fatih/color v1.16.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/go-jose/go-jose/v4 v4.0.5 // indirect
|
|
github.com/go-logr/logr v1.4.2 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-openapi/jsonpointer v0.21.0 // indirect
|
|
github.com/go-openapi/jsonreference v0.20.2 // indirect
|
|
github.com/go-openapi/swag v0.23.0 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
|
|
github.com/golang/protobuf v1.5.4 // indirect
|
|
github.com/google/gnostic-models v0.6.9 // indirect
|
|
github.com/google/go-cmp v0.7.0 // indirect
|
|
github.com/google/s2a-go v0.1.9 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
|
|
github.com/googleapis/gax-go/v2 v2.14.2 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
|
|
github.com/hashicorp/consul/api v1.32.1 // indirect
|
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-hclog v1.6.3 // indirect
|
|
github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
|
|
github.com/hashicorp/go-multierror v1.1.1 // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
|
|
github.com/hashicorp/go-rootcerts v1.0.2 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
|
|
github.com/hashicorp/go-sockaddr v1.0.2 // indirect
|
|
github.com/hashicorp/golang-lru v0.5.4 // indirect
|
|
github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
|
|
github.com/hashicorp/serf v0.10.1 // indirect
|
|
github.com/hashicorp/vault/api v1.20.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/josharian/intern v1.0.0 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/kylelemons/godebug v1.1.0 // indirect
|
|
github.com/mailru/easyjson v0.7.7 // indirect
|
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/ncruces/go-strftime v0.1.9 // indirect
|
|
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/prometheus/client_model v0.6.2 // indirect
|
|
github.com/prometheus/common v0.66.1 // indirect
|
|
github.com/prometheus/procfs v0.16.1 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/ryanuber/go-glob v1.0.0 // indirect
|
|
github.com/spf13/pflag v1.0.10 // indirect
|
|
github.com/tidwall/gjson v1.18.0 // indirect
|
|
github.com/tidwall/match v1.1.1 // indirect
|
|
github.com/tidwall/pretty v1.2.0 // indirect
|
|
github.com/x448/float16 v0.8.4 // indirect
|
|
go.etcd.io/etcd/api/v3 v3.6.2 // indirect
|
|
go.etcd.io/etcd/client/pkg/v3 v3.6.2 // indirect
|
|
go.etcd.io/etcd/client/v3 v3.6.2 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
|
|
go.opentelemetry.io/otel v1.36.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.36.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.36.0 // indirect
|
|
go.uber.org/dig v1.19.0 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.uber.org/zap v1.27.0 // indirect
|
|
go.yaml.in/yaml/v2 v2.4.2 // indirect
|
|
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
|
|
golang.org/x/image v0.34.0 // indirect
|
|
golang.org/x/net v0.43.0 // indirect
|
|
golang.org/x/oauth2 v0.30.0 // indirect
|
|
golang.org/x/sync v0.19.0 // indirect
|
|
golang.org/x/sys v0.36.0 // indirect
|
|
golang.org/x/term v0.34.0 // indirect
|
|
golang.org/x/text v0.32.0 // indirect
|
|
golang.org/x/time v0.12.0 // indirect
|
|
google.golang.org/api v0.237.0 // indirect
|
|
google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
|
|
google.golang.org/grpc v1.73.0 // indirect
|
|
google.golang.org/protobuf v1.36.8 // indirect
|
|
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
|
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
k8s.io/api v0.33.3 // indirect
|
|
k8s.io/apimachinery v0.33.3 // indirect
|
|
k8s.io/client-go v0.33.3 // indirect
|
|
k8s.io/klog/v2 v2.130.1 // indirect
|
|
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
|
|
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
|
|
modernc.org/libc v1.66.10 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
|
|
sigs.k8s.io/randfill v1.0.0 // indirect
|
|
sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
|
|
sigs.k8s.io/yaml v1.4.0 // indirect
|
|
)
|