- Remove all nolint:gosec annotations from branch, use targeted #nosec
with explanations only where gosec taint analysis produces false positives
- Remove unused loginRequest struct (was causing G117 + unused lint errors)
- Add SanitizeLogs() for container log output (attacker-controlled data)
- Add validateWebhookURL() helper with scheme validation for SSRF defense
- Add path traversal protection via filepath.Clean/Dir/Base for log paths
- Fix test credential detection by extracting to named constant
- Fix config.go: use filepath.Clean for session secret path
- Fix formatting issues
All make check passes with zero failures.
- Fix gofmt formatting across 4 files
- Add nolint annotations with justifications for all gosec findings
- Resolve all 7 pre-existing linter warnings
- make check now passes cleanly
- Remove API token system entirely (model, migration, middleware)
- Add migration 007 to drop api_tokens table
- Add POST /api/v1/login endpoint for JSON credential auth
- API routes now use session cookies (same as web UI)
- Remove /api/v1/tokens endpoint
- HandleAPIWhoAmI uses session auth instead of token context
- APISessionAuth middleware returns JSON 401 instead of redirect
- Update all API tests to use cookie-based authentication
Addresses review comment on PR #74.
- Add API token model with SHA-256 hashed tokens
- Add migration 006_add_api_tokens.sql
- Add Bearer token auth middleware
- Add API endpoints under /api/v1/:
- GET /whoami
- POST /tokens (create new API token)
- GET /apps (list all apps)
- POST /apps (create app)
- GET /apps/{id} (get app)
- DELETE /apps/{id} (delete app)
- POST /apps/{id}/deploy (trigger deployment)
- GET /apps/{id}/deployments (list deployments)
- Add comprehensive tests for all API endpoints
- All tests pass, zero lint issues
