sneak/upaas
1
0
Fork 1
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity
122 Commits 16 Branches 1 Tag
711c92028542a5db477be62a7177afb0a4380e88
Commit Graph
10 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
clawbot 711c920285 fix: resolve lint issues for make check compliance
Check / check (pull_request) Failing after 5m5s
Details
2026-02-19 23:44:47 -08:00
clawbot 728b29ef16 Revert "Merge pull request 'feat: add Gitea Actions CI for make check (closes #96)' (#98) from feat/ci-make-check into main" 
This reverts commit f61d4d0f91, reversing
changes made to 06e8e66443.
 2026-02-19 20:36:22 -08:00
clawbot 95a690e805 fix: use strings.HasPrefix instead of manual slice comparison 
- Replace entry.Name()[:len(prefix)] == prefix with strings.HasPrefix
- Applied consistently in both deploy.go and export_test.go
 2026-02-19 20:17:27 -08:00
clawbot 802518b917 fix: clean up orphan resources on deploy cancellation (closes #89) 2026-02-19 20:15:22 -08:00
clawbot 02847eea92 fix: restrict CORS to configured origins (closes #40) 
- Add CORSOrigins config field (UPAAS_CORS_ORIGINS env var)
- Default to same-origin only (no CORS headers when unconfigured)
- When configured, allow specified origins with AllowCredentials: true
- Add tests for CORS middleware behavior
 2026-02-19 13:45:18 -08:00
clawbot 506c795f16 test: add CORS middleware tests (failing - TDD) 2026-02-19 13:43:33 -08:00
clawbot 69a5a8c298 fix: resolve all golangci-lint issues (fixes #32) 2026-02-15 22:13:12 -08:00
clawbot 66661d1b1d Add rate limiting to login endpoint to prevent brute force 
Apply per-IP rate limiting (5 attempts/minute) to POST /login using
golang.org/x/time/rate. Returns 429 Too Many Requests when exceeded.

Closes #12
 2026-02-15 21:01:11 -08:00
clawbot b1dc8fcc4e Add CSRF protection to state-changing POST endpoints 
Add gorilla/csrf middleware to protect all HTML-serving routes against
cross-site request forgery attacks. The webhook endpoint is excluded
since it uses secret-based authentication.

Changes:
- Add gorilla/csrf v1.7.3 dependency
- Add CSRF() middleware method using session secret as key
- Apply CSRF middleware to all HTML route groups in routes.go
- Pass CSRF token to all templates via addGlobals helper
- Add {{ .CSRFField }} / {{ $.CSRFField }} hidden inputs to all forms

Closes #11
 2026-02-15 14:17:55 -08:00
clawbot 72786a9feb fix: use hashed webhook secrets for constant-time comparison 
Store a SHA-256 hash of the webhook secret in a new webhook_secret_hash
column. FindAppByWebhookSecret now hashes the incoming secret and queries
by hash, eliminating the SQL string comparison timing side-channel.

- Add migration 005_add_webhook_secret_hash.sql
- Add database.HashWebhookSecret() helper
- Backfill existing secrets on startup
- Update App model to include WebhookSecretHash in all queries
- Update app creation to compute hash at insert time
- Add TestHashWebhookSecret unit test
- Update all test fixtures to set WebhookSecretHash

Closes #13
 2026-02-15 14:06:53 -08:00