6 Commits

Include renames

Author	SHA1	Message	Date
3 people	12446f9f79	fix: change module path to sneak.berlin/go/upaas (closes #143) (#149) ... Changes the Go module path from `git.eeqj.de/sneak/upaas` to `sneak.berlin/go/upaas`. All import paths in Go files updated accordingly. `go mod tidy` and `make check` pass cleanly. fixes #143 Co-authored-by: user <user@Mac.lan guest wan> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: #149 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-01 23:22:18 +01:00
clawbot	cdd7e3fd3a	fix: set DestroySession MaxAge to -1 instead of -1*time.Second (closes #39) ... The gorilla/sessions MaxAge field expects seconds, not nanoseconds. Previously MaxAge was set to -1000000000 (-1 * time.Second in nanoseconds), which worked by accident since any negative value deletes the cookie. Changed to the conventional value of -1.	2026-02-15 22:07:57 -08:00
user	97a5aae2f7	simplify: replace mutex + ON CONFLICT with a single DB transaction ... Remove the sync.Mutex and CreateUserAtomic (INSERT ON CONFLICT) in favor of a single DB transaction in CreateFirstUser that atomically checks for existing users and inserts. SQLite serializes write transactions, so this is sufficient to prevent the race condition without application-level locking.	2026-02-15 21:41:52 -08:00
clawbot	763e722607	fix: prevent setup endpoint race condition (closes #26) ... Add mutex and INSERT ON CONFLICT to CreateUser to prevent TOCTOU race where concurrent requests could create multiple admin users. Changes: - Add sync.Mutex to auth.Service to serialize CreateUser calls - Add models.CreateUserAtomic using INSERT ... ON CONFLICT(username) DO NOTHING - Check RowsAffected to detect conflicts at the DB level (defense-in-depth) - Add concurrent race condition test (10 goroutines, only 1 succeeds) The existing UNIQUE constraint on users.username was already in place. This fix adds the application-level protection (items 1 & 2 from #26).	2026-02-15 21:35:16 -08:00
clawbot	185daab909	fix: set Secure flag on session cookie in production mode (closes #5)	2026-02-08 12:05:09 -08:00
sneak	3f9d83c436	Initial commit with server startup infrastructure ... Core infrastructure: - Uber fx dependency injection - Chi router with middleware stack - SQLite database with embedded migrations - Embedded templates and static assets - Structured logging with slog Features implemented: - Authentication (login, logout, session management, argon2id hashing) - App management (create, edit, delete, list) - Deployment pipeline (clone, build, deploy, health check) - Webhook processing for Gitea - Notifications (ntfy, Slack) - Environment variables, labels, volumes per app - SSH key generation for deploy keys Server startup: - Server.Run() starts HTTP server on configured port - Server.Shutdown() for graceful shutdown - SetupRoutes() wires all handlers with chi router	2025-12-29 15:46:03 +07:00