7 Commits

Include renames

Author	SHA1	Message	Date
sneak	55795ddfc4	Hash passwords with 1 MiB in tests so make test fits in 4 GiB (closes #261) ... On a build machine with 4 GiB, docker build . failed: the auth test binary was killed for lack of memory. upaasd hashes passwords with argon2id at 64 MiB per hash; the auth and handlers tests run many such hashes at once, and the race detector multiplies what each one takes, so make test peaked at 2.7 GiB. The memory per hash is now the auth service's ArgonMemory field. New sets it to the same 64 MiB, which upaasd keeps; the test helpers lower it to 1 MiB. A new test checks that New sets 64 MiB and hashes and verifies a password with it. GOMAXPROCS=4 make test now peaks at about 1.4 GiB. Model: opus-5-5	2026-10-03 00:37:04 +00:00
3 people	12446f9f79	fix: change module path to sneak.berlin/go/upaas (closes #143) (#149) ... Changes the Go module path from `git.eeqj.de/sneak/upaas` to `sneak.berlin/go/upaas`. All import paths in Go files updated accordingly. `go mod tidy` and `make check` pass cleanly. fixes #143 Co-authored-by: user <user@Mac.lan guest wan> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: #149 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-01 23:22:18 +01:00
clawbot	cdd7e3fd3a	fix: set DestroySession MaxAge to -1 instead of -1*time.Second (closes #39) ... The gorilla/sessions MaxAge field expects seconds, not nanoseconds. Previously MaxAge was set to -1000000000 (-1 * time.Second in nanoseconds), which worked by accident since any negative value deletes the cookie. Changed to the conventional value of -1.	2026-02-15 22:07:57 -08:00
user	97a5aae2f7	simplify: replace mutex + ON CONFLICT with a single DB transaction ... Remove the sync.Mutex and CreateUserAtomic (INSERT ON CONFLICT) in favor of a single DB transaction in CreateFirstUser that atomically checks for existing users and inserts. SQLite serializes write transactions, so this is sufficient to prevent the race condition without application-level locking.	2026-02-15 21:41:52 -08:00
clawbot	763e722607	fix: prevent setup endpoint race condition (closes #26) ... Add mutex and INSERT ON CONFLICT to CreateUser to prevent TOCTOU race where concurrent requests could create multiple admin users. Changes: - Add sync.Mutex to auth.Service to serialize CreateUser calls - Add models.CreateUserAtomic using INSERT ... ON CONFLICT(username) DO NOTHING - Check RowsAffected to detect conflicts at the DB level (defense-in-depth) - Add concurrent race condition test (10 goroutines, only 1 succeeds) The existing UNIQUE constraint on users.username was already in place. This fix adds the application-level protection (items 1 & 2 from #26).	2026-02-15 21:35:16 -08:00
clawbot	185daab909	fix: set Secure flag on session cookie in production mode (closes #5)	2026-02-08 12:05:09 -08:00
sneak	3f9d83c436	Initial commit with server startup infrastructure ... Core infrastructure: - Uber fx dependency injection - Chi router with middleware stack - SQLite database with embedded migrations - Embedded templates and static assets - Structured logging with slog Features implemented: - Authentication (login, logout, session management, argon2id hashing) - App management (create, edit, delete, list) - Deployment pipeline (clone, build, deploy, health check) - Webhook processing for Gitea - Notifications (ntfy, Slack) - Environment variables, labels, volumes per app - SSH key generation for deploy keys Server startup: - Server.Run() starts HTTP server on configured port - Server.Shutdown() for graceful shutdown - SetupRoutes() wires all handlers with chi router	2025-12-29 15:46:03 +07:00