Merge branch 'main' into TODO

Add standard Workflow section to TODO.md
Add TODO.md
2026-07-06 21:14:58 +02:00 · 2026-07-06 21:06:46 +02:00 · 2026-07-06 20:31:41 +02:00
24 changed files with 139 additions and 737 deletions
@@ -13,4 +13,4 @@ jobs:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4, 2024-10-13
      - name: Build (runs make check inside Dockerfile)
-        run: script/cibuild
+        run: docker build .
@@ -1,4 +1,4 @@
-.PHONY: all bootstrap setup build lint fmt fmt-check test check clean docker hooks
+.PHONY: all build lint fmt fmt-check test check clean docker hooks
 BINARY := upaasd
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
@@ -7,37 +7,37 @@ LDFLAGS := -X main.Version=$(VERSION) -X main.Buildarch=$(BUILDARCH)
 all: check build
 bootstrap:
 	@script/bootstrap
 setup:
 	@script/setup
 build:
 	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/upaasd
 lint:
-	@script/lint
+	golangci-lint run --config .golangci.yml ./...
 fmt:
-	@script/fmt
+	gofmt -s -w .
 	goimports -w .
 	npx prettier --write --tab-width 4 static/js/*.js
 fmt-check:
-	@script/fmt-check
+	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
 test:
-	@script/test
+	go test -v -race -cover -timeout 30s ./...
 # Check runs all validation without making changes
 # Used by CI and Docker build - fails if anything is wrong
-check:
+check: fmt-check lint test
-	@script/check
+	@echo "==> All checks passed!"
 docker:
-	@script/docker
+	docker build .
 hooks:
-	@script/install-precommit
+	@echo "Installing pre-commit hook..."
 	@mkdir -p .git/hooks
 	@printf '#!/bin/sh\nmake check\n' > .git/hooks/pre-commit
 	@chmod +x .git/hooks/pre-commit
 	@echo "Pre-commit hook installed."
 clean:
 	rm -rf bin/
@@ -100,31 +100,6 @@ chi Router ──► Middleware Stack ──► Handler
 - **Async deployments**: Webhook triggers deploy via goroutine with `context.WithoutCancel()`
 - **Embedded assets**: Templates and static files embedded via `//go:embed`
 ## Entrypoints
 This repository adheres to the
 [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
 standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call
 them. We provide:
 - `script/bootstrap` — install all dependencies (idempotent)
 - `script/setup` — make a fresh clone ready for development
  (bootstrap, then install-precommit)
 - `script/projectname` — output the project name ("upaas")
 - `script/test` — run the test suite
 - `script/lint` — run golangci-lint
 - `script/fmt` — format all code (writes)
 - `script/fmt-check` — check formatting (read-only)
 - `script/check` — run test, lint, and fmt-check
 - `script/docker` — build the Docker image tagged via `script/projectname`
 - `script/cibuild` — CI entrypoint: `docker build .` (the Dockerfile
  runs the checks, so a green build implies a green repo)
 - `script/precommit` — pre-commit checks (`go mod tidy` guard, then
  `script/check`)
 - `script/install-precommit` — install the git pre-commit hook that
  runs `script/precommit`
 ## Development
 ### Prerequisites
@@ -136,16 +111,14 @@ them. We provide:
 ### Commands
 ```bash
 make bootstrap # Install all dependencies (idempotent)
 make setup     # Bootstrap + install git pre-commit hook
 make fmt       # Format code
 make fmt-check # Check formatting (read-only, fails if unformatted)
 make lint      # Run comprehensive linting
 make test      # Run tests with race detection (30s timeout)
-make check     # Verify everything passes (test, lint, fmt-check)
+make check     # Verify everything passes (fmt-check, lint, test)
 make build     # Build binary
 make docker    # Build Docker image
-make hooks     # Install pre-commit hook (runs script/precommit)
+make hooks     # Install pre-commit hook (runs make check)
 ```
 ### Commit Requirements
@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-07-06
+last_modified: 2026-02-22
 ---
 This document covers repository structure, tooling, and workflow standards. Code
@@ -34,46 +34,10 @@ style conventions are in separate documents:
  every file before committing. There are zero exceptions to this rule.
 - Every repo with software must have a root `Makefile` with these targets:
-  `make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
+  `make test`, `make lint`, `make fmt` (writes), `make fmt-check` (read-only),
-  `make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
+  `make check` (prereqs: `test`, `lint`, `fmt-check`), `make docker`, and
-  `make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
+  `make hooks` (installs pre-commit hook). A model Makefile is at
-  is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
 - Repos follow the
  [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
  pattern: the implementation of each Makefile target lives in an executable
  script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
  `script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
  `script/docker`), and the Makefile targets are thin shims that call them. The
  scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
  minimal containers (e.g. alpine images have no bash); locate the repo root
  with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
  the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
  for development after a fresh clone: runs `bootstrap`, then
  `install-precommit`, plus any repo-specific initialization), `test`, and
  `cibuild`. `script/bootstrap` installs all dependencies idempotently and
  assumes nothing is present: base tools come from nix, apt, brew, or apk
  (detected in that order; apt runs noninteractive). For node it uses the
  installed node if present; otherwise it installs a PINNED node version via
  nvm, first installing nvm itself if missing — from a hash-verified GitHub
  release archive (never `curl | sh`), with bash installed as an explicit
  prerequisite since nvm requires bash. yarn is then pinned via
  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
  always exact versions. `script/cibuild` runs the CI build: it changes to the
  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
  scripts are our own extensions to the standard: `script/check` runs
  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
  what the git pre-commit hook runs, and it calls `script/check`;
  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
  target shims to it); and `script/projectname` (literally that filename) simply
  outputs the project's name. Scripts that need the name call
  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
  so those scripts stay byte-identical across all repos. Repo-type-specific
  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
  `script/precommit`, not in the hook itself. Model scripts are at
  `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
  must document the provided scripts in an **Entrypoints** section (see the
  README requirements below).
 - Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
  instead of invoking the underlying tools directly. The Makefile is the single
@@ -93,83 +57,11 @@ style conventions are in separate documents:
  as a build step so the build fails if the branch is not green. For non-server
  repos, the Dockerfile should bring up a development environment and run
  `make check`. For server repos, `make check` should run as an early build
-  stage before the final image is assembled. Dockerfiles install development
+  stage before the final image is assembled.
  prerequisites by running `script/bootstrap` rather than duplicating installs
  inline; COPY `script/` and the dependency manifests (`package.json` +
  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
  layer stays cached until dependencies change.
 - **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
  repos use a multistage build where linting runs in an independent stage based
  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
  `make fmt-check` and `make lint` before the full build begins. The build stage
  then declares an explicit dependency on the lint stage via
  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
  linting before proceeding to compilation and tests. This ensures lint failures
  surface in seconds rather than minutes, without blocking on dependency
  download or compilation in the build stage.
    The standard pattern for a Go repo Dockerfile is:
    ```dockerfile
    # Lint stage — fast feedback on formatting and lint issues
    # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
    FROM golangci/golangci-lint@sha256:... AS lint
    WORKDIR /src
    COPY go.mod go.sum ./
    RUN go mod download
    COPY . .
    RUN make fmt-check
    RUN make lint
    # Build stage
    # golang:1.x-alpine, YYYY-MM-DD
    FROM golang@sha256:... AS builder
    WORKDIR /src
    # Force BuildKit to run the lint stage before proceeding
    COPY --from=lint /src/go.sum /dev/null
    COPY go.mod go.sum ./
    RUN go mod download
    COPY . .
    RUN make test
    ARG VERSION=dev
    RUN CGO_ENABLED=0 go build -trimpath \
        -ldflags="-s -w -X main.Version=${VERSION}" \
        -o /app ./cmd/app/
    # Runtime stage
    FROM alpine@sha256:...
    COPY --from=builder /app /usr/local/bin/app
    ENTRYPOINT ["app"]
    ```
    Key points:
    - The lint stage uses the `golangci/golangci-lint` image directly (it
      includes both Go and the linter), so there is no need to install the
      linter separately.
    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
      a stage dependency. BuildKit runs stages in parallel by default; without
      this line, the build stage would not wait for lint to finish and a lint
      failure might not fail the overall build.
    - If the project uses `//go:embed` directives that reference build artifacts
      (e.g. a web frontend compiled in a separate stage), the lint stage must
      create placeholder files so the embed directives resolve. Example:
      `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
      The lint stage should not depend on the actual build output — it exists to
      fail fast.
    - If the project requires CGO or system libraries for linting (e.g.
      `vips-dev`), install them in the lint stage with `apk add`.
    - The build stage runs `make test` after compilation setup. Tests run in the
      build stage, not the lint stage, because they may require compiled
      artifacts or heavier dependencies.
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` (which runs `docker build .`) on push. Since the
+  runs `docker build .` on push. Since the Dockerfile already runs `make check`,
-  Dockerfile already runs `make check`, a successful build implies all checks
+  a successful build implies all checks pass.
  pass.
 - Use platform-standard formatters: `black` for Python, `prettier` for
  JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -177,11 +69,9 @@ style conventions are in separate documents:
  Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
  HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
+- Pre-commit hook: `make check` if local testing is possible, otherwise
-  testing is not possible in the repo, `script/precommit` may skip `script/test`
+  `make lint && make fmt-check`. The Makefile should provide a `make hooks`
-  and run only `script/lint` and `script/fmt-check`. The hook is installed by
+  target to install the pre-commit hook.
  `script/install-precommit`; the Makefile must provide a `make hooks` target
  that shims to it.
 - All repos with software must have tests that run via the platform-standard
  test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
@@ -192,42 +82,6 @@ style conventions are in separate documents:
 - `make test` must complete in under 20 seconds. Add a 30-second timeout in the
  Makefile.
 - **`make test` should use the conditional verbose rerun pattern.** Run tests
  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
  show full output. This keeps CI logs and `docker build` output clean on
  success (just package/suite summaries) while providing full diagnostic detail
  on failure (every test case, every assertion). The general shell pattern:
    ```makefile
    test:
    	@<test-command> || \
    		{ echo "--- Rerunning with -v for details ---"; \
    		  <test-command-with-v>; exit 1; }
    ```
    Go example:
    ```makefile
    test:
    	@go test -timeout 30s -race -cover ./... || \
    		{ echo "--- Rerunning with -v for details ---"; \
    		  go test -timeout 30s -race -v ./...; exit 1; }
    ```
    Python example:
    ```makefile
    test:
    	@python -m pytest || \
    		{ echo "--- Rerunning with -v for details ---"; \
    		  python -m pytest -v; exit 1; }
    ```
    The `exit 1` ensures the target always fails after a rerun — the first run
    already proved the tests are broken, so the build must not pass even if a
    flaky test happens to succeed on the second attempt. The rerun exists solely
    for diagnostic output.
 - Docker builds must complete in under 5 minutes.
 - `make check` must not modify any files in the repo. Tests may use temporary
@@ -244,13 +98,6 @@ style conventions are in separate documents:
  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
  a new repo.
 - **No build artifacts in version control.** Code-derived data (compiled
  bundles, minified output, generated assets) must never be committed to the
  repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
  should generate these at build time. Notable exception: Go protobuf generated
  files (`.pb.go`) ARE committed because repos need to work with `go get`, which
  downloads code but does not execute code generation.
 - Never use `git add -A` or `git add .`. Always stage files explicitly by name.
 - Never force-push to `main`.
@@ -274,76 +121,12 @@ style conventions are in separate documents:
 - Dockerized web services listen on port 8080 by default, overridable with
  `PORT`.
 - **HTTP/web services must be hardened for production internet exposure before
  tagging 1.0.** This means full compliance with security best practices
  including, without limitation, all of the following:
    - **Security headers** on every response:
        - `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
          and `includeSubDomains`.
        - `Content-Security-Policy` (CSP) with a restrictive default policy
          (`default-src 'self'` as a baseline, tightened per-resource as
          needed). Never use `unsafe-inline` or `unsafe-eval` unless
          unavoidable, and document the reason.
        - `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
          Prefer the `frame-ancestors` CSP directive as the primary control.
        - `X-Content-Type-Options: nosniff`.
        - `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
        - `Permissions-Policy` restricting access to browser features the
          application does not use (camera, microphone, geolocation, etc.).
    - **Request and response limits:**
        - Maximum request body size enforced on all endpoints (e.g. Go
          `http.MaxBytesReader`). Choose a sane default per-route; never accept
          unbounded input.
        - Maximum response body size where applicable (e.g. paginated APIs).
        - `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
          against slowloris attacks.
        - `WriteTimeout` on the `http.Server`.
        - `IdleTimeout` on the `http.Server`.
        - Per-handler execution time limits via `context.WithTimeout` or
          chi/stdlib `middleware.Timeout`.
    - **Authentication and session security:**
        - Rate limiting on password-based authentication endpoints. API keys are
          high-entropy and not susceptible to brute force, so they are exempt.
        - CSRF tokens on all state-mutating HTML forms. API endpoints
          authenticated via `Authorization` header (Bearer token, API key) are
          exempt because the browser does not attach these automatically.
        - Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
          MD5, or SHA.
        - Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
          `Strict`) attributes.
    - **Reverse proxy awareness:**
        - True client IP detection when behind a reverse proxy
          (`X-Forwarded-For`, `X-Real-IP`). The application must accept
          forwarded headers only from a configured set of trusted proxy
          addresses — never trust `X-Forwarded-For` unconditionally.
    - **CORS:**
        - Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
          an explicit allowlist of known origins. Wildcard (`*`) is acceptable
          only for public, unauthenticated read-only APIs.
    - **Error handling:**
        - Internal errors must never leak stack traces, SQL queries, file paths,
          or other implementation details to the client. Return generic error
          messages in production; detailed errors only when `DEBUG` is enabled.
    - **TLS:**
        - Services never terminate TLS directly. They are always deployed behind
          a TLS-terminating reverse proxy. The service itself listens on plain
          HTTP. However, HSTS headers and `Secure` cookie flags must still be
          set by the application so that the browser enforces HTTPS end-to-end.
    This list is non-exhaustive. Apply defense-in-depth: if a standard security
    hardening measure exists for HTTP services and is not listed here, it is
    still expected. When in doubt, harden.
 - `README.md` is the primary documentation. Required sections:
    - **Description**: First line must include the project name, purpose,
      category (web server, SPA, CLI tool, etc.), license, and author. Example:
      "µPaaS is an MIT-licensed Go web application by @sneak that receives
      git-frontend webhooks and deploys applications via Docker in realtime."
    - **Getting Started**: Copy-pasteable install/usage code block.
    - **Entrypoints**: Opens by stating that the repo adheres to the
      [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
      standard (with that link), then documents each provided `script/`
      entrypoint and its purpose.
    - **Rationale**: Why does this exist?
    - **Design**: How is the program structured?
    - **TODO**: Update meticulously, even between commits. When planning, put
@@ -362,13 +145,13 @@ style conventions are in separate documents:
 - Database migrations live in `internal/db/migrations/` and must be embedded in
  the binary.
-    - `000_migration.sql` — contains ONLY the creation of the migrations
+  - `000_migration.sql` — contains ONLY the creation of the migrations tracking
-      tracking table itself. Nothing else.
+    table itself. Nothing else.
-    - `001_schema.sql` — the full application schema.
+  - `001_schema.sql` — the full application schema.
-    - **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
+  - **Pre-1.0.0:** never add additional migration files (002, 003, etc.). There
-      There is no installed base to migrate. Edit `001_schema.sql` directly.
+    is no installed base to migrate. Edit `001_schema.sql` directly.
-    - **Post-1.0.0:** add new numbered migration files for each schema change.
+  - **Post-1.0.0:** add new numbered migration files for each schema change.
-      Never edit existing migrations after release.
+    Never edit existing migrations after release.
 - All repos should have an `.editorconfig` enforcing the project's indentation
  settings.
@@ -398,9 +181,6 @@ style conventions are in separate documents:
    - `README.md`, `.git`, `.gitignore`, `.editorconfig`
    - `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
    - `Makefile`
    - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
      `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
      `install-precommit`)
    - `Dockerfile`, `.dockerignore`
    - `.gitea/workflows/check.yml`
    - Go: `go.mod`, `go.sum`, `.golangci.yml`
@@ -10,28 +10,18 @@
 # Status
-1.0+. Tagged 1.0.0 on 2026-02-26. Policy violation: main currently
+1.0+. Tagged 1.0.0 on 2026-02-26; 8 commits on main since. Policy
-fails make check under golangci-lint >= 2.12 (25 lint issues remaining:
+violation: main currently fails make check (91 lint issues), so the tree
-1 gosec G703, 24 goconst), so the tree is out of compliance until
+is out of compliance until fixed.
 fixed. CI (Dockerfile lint stage, pinned golangci-lint v2.10.1) is
 green; the pin bump is tracked in issue #179. The road to release
 1.1.0 is tracked in Gitea issues #175-#185 (milestone 1.1.0).
 # Next Step
-Fix the gosec G703 path traversal finding in the deploy log download
+Fix the 47 noctx lint findings (HTTP requests without context) in one
-handler (issue #177): canonicalize and containment-check the log path
+commit and confirm the count drops under make check. This is the largest
-before http.ServeFile, with a traversal-rejection test.
+of the three lint classes blocking a green main.
 # Completed Steps
 - 2026-08-07: Fixed all 22 gosec G710 open-redirect findings: app
  redirects go through a redirectToApp helper that ULID-validates the
  app ID (#176).
 - 2026-08-07: Fixed all 47 noctx lint findings: tests now use
  httptest.NewRequestWithContext with t.Context() (#175).
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
  Makefile shims, README Entrypoints section
 - 2026-03-11: Monolithic env var editing with bulk save (#158).
 - 2026-03-10: Webhook event history UI page (#164); added missing
  Makefile docker and hooks targets plus test timeout (#159);
@@ -53,13 +43,11 @@ before http.ServeFile, with a traversal-rejection test.
 # Future Steps
 - Get main green (compliance, ordered):
-    - Fix 1 gosec G703 finding (Next Step, #177).
+    - Fix 47 noctx findings (Next Step).
-    - Fix 24 goconst findings (#178).
+    - Fix 23 gosec findings.
-    - Bump Dockerfile golangci-lint pin to v2.12.x (#179).
+    - Fix 21 goconst findings.
    - Run make check clean on main and keep it green; main must always
      pass.
 - Confirm .gitea/workflows/check.yml gates merges on make check so main
-  cannot regress (#180).
+  cannot regress.
 - Deploy to fsn1app1 and verify end-to-end (#181), then tag 1.1.0
  (#182).
 - Resume feature work only after main is green.
@@ -47,12 +47,7 @@ func setupAPITest(t *testing.T) (*testContext, []*http.Cookie) {
 	r := apiRouter(tc)
 	loginBody := `{"username":"admin","password":"password123"}`
-	req := httptest.NewRequestWithContext(
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(loginBody))
 		t.Context(),
 		http.MethodPost,
 		"/api/v1/login",
 		strings.NewReader(loginBody),
 	)
 	req.Header.Set("Content-Type", "application/json")
 	rr := httptest.NewRecorder()
@@ -75,7 +70,7 @@ func apiGet(
 ) *httptest.ResponseRecorder {
 	t.Helper()
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, path, nil)
+	req := httptest.NewRequest(http.MethodGet, path, nil)
 	for _, c := range cookies {
 		req.AddCookie(c)
@@ -100,12 +95,7 @@ func TestAPILoginSuccess(t *testing.T) {
 	r := apiRouter(tc)
 	body := `{"username":"admin","password":"password123"}`
-	req := httptest.NewRequestWithContext(
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
 		t.Context(),
 		http.MethodPost,
 		"/api/v1/login",
 		strings.NewReader(body),
 	)
 	req.Header.Set("Content-Type", "application/json")
 	rr := httptest.NewRecorder()
@@ -132,12 +122,7 @@ func TestAPILoginInvalidCredentials(t *testing.T) {
 	r := apiRouter(tc)
 	body := `{"username":"admin","password":"wrong"}`
-	req := httptest.NewRequestWithContext(
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
 		t.Context(),
 		http.MethodPost,
 		"/api/v1/login",
 		strings.NewReader(body),
 	)
 	req.Header.Set("Content-Type", "application/json")
 	rr := httptest.NewRecorder()
@@ -154,12 +139,7 @@ func TestAPILoginMissingFields(t *testing.T) {
 	r := apiRouter(tc)
 	body := `{"username":"","password":""}`
-	req := httptest.NewRequestWithContext(
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
 		t.Context(),
 		http.MethodPost,
 		"/api/v1/login",
 		strings.NewReader(body),
 	)
 	req.Header.Set("Content-Type", "application/json")
 	rr := httptest.NewRecorder()
@@ -175,9 +155,7 @@ func TestAPIRejectsUnauthenticated(t *testing.T) {
 	r := apiRouter(tc)
-	req := httptest.NewRequestWithContext(
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/apps", nil)
 		t.Context(), http.MethodGet, "/api/v1/apps", nil,
 	)
 	rr := httptest.NewRecorder()
 	r.ServeHTTP(rr, req)
@@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -15,7 +14,6 @@ import (
 	"time"
 	"github.com/go-chi/chi/v5"
 	"github.com/oklog/ulid/v2"
 	"sneak.berlin/go/upaas/internal/models"
 	"sneak.berlin/go/upaas/internal/service/app"
@@ -29,27 +27,6 @@ const (
 	deploymentsHistoryLimit = 50
 )
 // redirectToApp issues a See Other redirect to the detail page of the
 // given app, plus an optional suffix (a sub-path like "/deployments"
 // or a query string like "?success=updated"). App IDs are ULIDs: the
 // ID is parsed and re-serialized so the redirect target never
 // contains unvalidated request input; an invalid ID yields 404.
 func redirectToApp(
 	writer http.ResponseWriter,
 	request *http.Request,
 	appID, suffix string,
 ) {
 	id, parseErr := ulid.ParseStrict(appID)
 	if parseErr != nil {
 		http.NotFound(writer, request)
 		return
 	}
 	target := "/apps/" + url.PathEscape(id.String()) + suffix
 	http.Redirect(writer, request, target, http.StatusSeeOther)
 }
 // HandleAppNew returns the new app form handler.
 func (h *Handlers) HandleAppNew() http.HandlerFunc {
 	tmpl := templates.GetParsed()
@@ -142,7 +119,7 @@ func (h *Handlers) HandleAppCreate() http.HandlerFunc { //nolint:funlen // valid
 			return
 		}
-		redirectToApp(writer, request, createdApp.ID, "")
+		http.Redirect(writer, request, "/apps/"+createdApp.ID, http.StatusSeeOther)
 	}
 }
@@ -308,7 +285,8 @@ func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // valid
 			return
 		}
-		redirectToApp(writer, request, application.ID, "?success=updated")
+		redirectURL := "/apps/" + application.ID + "?success=updated"
 		http.Redirect(writer, request, redirectURL, http.StatusSeeOther)
 	}
 }
@@ -393,7 +371,12 @@ func (h *Handlers) HandleAppDeploy() http.HandlerFunc {
 			}
 		}(deployCtx, application)
-		redirectToApp(writer, request, application.ID, "/deployments")
+		http.Redirect(
 			writer,
 			request,
 			"/apps/"+application.ID+"/deployments",
 			http.StatusSeeOther,
 		)
 	}
 }
@@ -414,7 +397,12 @@ func (h *Handlers) HandleCancelDeploy() http.HandlerFunc {
 			h.log.Info("deployment cancelled by user", "app", application.Name)
 		}
-		redirectToApp(writer, request, application.ID, "")
+		http.Redirect(
 			writer,
 			request,
 			"/apps/"+application.ID,
 			http.StatusSeeOther,
 		)
 	}
 }
@@ -433,12 +421,12 @@ func (h *Handlers) HandleAppRollback() http.HandlerFunc {
 		rollbackErr := h.deploy.Rollback(request.Context(), application)
 		if rollbackErr != nil {
 			h.log.Error("rollback failed", "error", rollbackErr, "app", application.Name)
-			redirectToApp(writer, request, application.ID, "")
+			http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 			return
 		}
-		redirectToApp(writer, request, application.ID, "?success=rolledback")
+		http.Redirect(writer, request, "/apps/"+application.ID+"?success=rolledback", http.StatusSeeOther)
 	}
 }
@@ -811,7 +799,7 @@ func (h *Handlers) handleContainerAction(
 	containerInfo, containerErr := h.docker.FindContainerByAppID(ctx, appID)
 	if containerErr != nil || containerInfo == nil {
-		redirectToApp(writer, request, appID, "")
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 		return
 	}
@@ -844,7 +832,7 @@ func (h *Handlers) handleContainerAction(
 			"action", action, "app", application.Name, "container", containerID)
 	}
-	redirectToApp(writer, request, appID, "")
+	http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 }
 // HandleAppRestart handles restarting an app's container.
@@ -898,7 +886,7 @@ func (h *Handlers) addKeyValueToApp(
 	value := request.FormValue("value")
 	if key == "" || value == "" {
-		redirectToApp(writer, request, application.ID, "")
+		http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 		return
 	}
@@ -908,7 +896,7 @@ func (h *Handlers) addKeyValueToApp(
 		h.log.Error("failed to add key-value pair", "error", saveErr)
 	}
-	redirectToApp(writer, request, application.ID, "")
+	http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 }
 // envPairJSON represents a key-value pair in the JSON request body.
@@ -1043,7 +1031,7 @@ func (h *Handlers) HandleLabelDelete() http.HandlerFunc {
 			h.log.Error("failed to delete label", "error", deleteErr)
 		}
-		redirectToApp(writer, request, appID, "")
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 	}
 }
@@ -1071,7 +1059,12 @@ func (h *Handlers) HandleVolumeAdd() http.HandlerFunc {
 		readOnly := request.FormValue("readonly") == "1"
 		if hostPath == "" || containerPath == "" {
-			redirectToApp(writer, request, application.ID, "")
+			http.Redirect(
 				writer,
 				request,
 				"/apps/"+application.ID,
 				http.StatusSeeOther,
 			)
 			return
 		}
@@ -1079,7 +1072,7 @@ func (h *Handlers) HandleVolumeAdd() http.HandlerFunc {
 		pathErr := validateVolumePaths(hostPath, containerPath)
 		if pathErr != nil {
 			h.log.Error("invalid volume path", "error", pathErr)
-			redirectToApp(writer, request, application.ID, "")
+			http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 			return
 		}
@@ -1095,7 +1088,7 @@ func (h *Handlers) HandleVolumeAdd() http.HandlerFunc {
 			h.log.Error("failed to add volume", "error", saveErr)
 		}
-		redirectToApp(writer, request, application.ID, "")
+		http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 	}
 }
@@ -1124,7 +1117,7 @@ func (h *Handlers) HandleVolumeDelete() http.HandlerFunc {
 			h.log.Error("failed to delete volume", "error", deleteErr)
 		}
-		redirectToApp(writer, request, appID, "")
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 	}
 }
@@ -1152,7 +1145,7 @@ func (h *Handlers) HandlePortAdd() http.HandlerFunc {
 			request.FormValue("container_port"),
 		)
 		if !valid {
-			redirectToApp(writer, request, application.ID, "")
+			http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 			return
 		}
@@ -1173,7 +1166,7 @@ func (h *Handlers) HandlePortAdd() http.HandlerFunc {
 			h.log.Error("failed to save port", "error", saveErr)
 		}
-		redirectToApp(writer, request, application.ID, "")
+		http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 	}
 }
@@ -1219,7 +1212,7 @@ func (h *Handlers) HandlePortDelete() http.HandlerFunc {
 			h.log.Error("failed to delete port", "error", deleteErr)
 		}
-		redirectToApp(writer, request, appID, "")
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 	}
 }
@@ -1281,7 +1274,7 @@ func (h *Handlers) HandleLabelEdit() http.HandlerFunc {
 		value := request.FormValue("value")
 		if key == "" || value == "" {
-			redirectToApp(writer, request, appID, "")
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 			return
 		}
@@ -1294,7 +1287,7 @@ func (h *Handlers) HandleLabelEdit() http.HandlerFunc {
 			h.log.Error("failed to update label", "error", saveErr)
 		}
-		redirectToApp(writer, request, appID, "")
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 	}
 }
@@ -1330,7 +1323,7 @@ func (h *Handlers) HandleVolumeEdit() http.HandlerFunc {
 		readOnly := request.FormValue("readonly") == "1"
 		if hostPath == "" || containerPath == "" {
-			redirectToApp(writer, request, appID, "")
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 			return
 		}
@@ -1338,7 +1331,7 @@ func (h *Handlers) HandleVolumeEdit() http.HandlerFunc {
 		pathErr := validateVolumePaths(hostPath, containerPath)
 		if pathErr != nil {
 			h.log.Error("invalid volume path", "error", pathErr)
-			redirectToApp(writer, request, appID, "")
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 			return
 		}
@@ -1352,7 +1345,7 @@ func (h *Handlers) HandleVolumeEdit() http.HandlerFunc {
 			h.log.Error("failed to update volume", "error", saveErr)
 		}
-		redirectToApp(writer, request, appID, "")
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 	}
 }
@@ -193,8 +193,7 @@ func TestHandleHealthCheck(t *testing.T) {
 		testCtx := setupTestHandlers(t)
-		request := httptest.NewRequestWithContext(
+		request := httptest.NewRequest(
 			t.Context(),
 			http.MethodGet,
 			"/.well-known/healthcheck.json",
 			nil,
@@ -219,7 +218,7 @@ func TestHandleSetupGET(t *testing.T) {
 		testCtx := setupTestHandlers(t)
-		request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/setup", nil)
+		request := httptest.NewRequest(http.MethodGet, "/setup", nil)
 		recorder := httptest.NewRecorder()
 		handler := testCtx.handlers.HandleSetupGET()
@@ -231,18 +230,14 @@ func TestHandleSetupGET(t *testing.T) {
 }
 func createSetupFormRequest(
 	t *testing.T,
 	username, password, confirm string,
 ) *http.Request {
 	t.Helper()
 	form := url.Values{}
 	form.Set("username", username)
 	form.Set("password", password)
 	form.Set("password_confirm", confirm)
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/setup",
 		strings.NewReader(form.Encode()),
@@ -257,7 +252,7 @@ func TestHandleSetupPOSTCreatesUserAndRedirects(t *testing.T) {
 	testCtx := setupTestHandlers(t)
-	request := createSetupFormRequest(t, "admin", "password123", "password123")
+	request := createSetupFormRequest("admin", "password123", "password123")
 	recorder := httptest.NewRecorder()
 	handler := testCtx.handlers.HandleSetupPOST()
@@ -272,7 +267,7 @@ func TestHandleSetupPOSTRejectsEmptyUsername(t *testing.T) {
 	testCtx := setupTestHandlers(t)
-	request := createSetupFormRequest(t, "", "password123", "password123")
+	request := createSetupFormRequest("", "password123", "password123")
 	recorder := httptest.NewRecorder()
 	handler := testCtx.handlers.HandleSetupPOST()
@@ -287,7 +282,7 @@ func TestHandleSetupPOSTRejectsShortPassword(t *testing.T) {
 	testCtx := setupTestHandlers(t)
-	request := createSetupFormRequest(t, "admin", "short", "short")
+	request := createSetupFormRequest("admin", "short", "short")
 	recorder := httptest.NewRecorder()
 	handler := testCtx.handlers.HandleSetupPOST()
@@ -302,7 +297,7 @@ func TestHandleSetupPOSTRejectsMismatchedPasswords(t *testing.T) {
 	testCtx := setupTestHandlers(t)
-	request := createSetupFormRequest(t, "admin", "password123", "different123")
+	request := createSetupFormRequest("admin", "password123", "different123")
 	recorder := httptest.NewRecorder()
 	handler := testCtx.handlers.HandleSetupPOST()
@@ -320,7 +315,7 @@ func TestHandleLoginGET(t *testing.T) {
 		testCtx := setupTestHandlers(t)
-		request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/login", nil)
+		request := httptest.NewRequest(http.MethodGet, "/login", nil)
 		recorder := httptest.NewRecorder()
 		handler := testCtx.handlers.HandleLoginGET()
@@ -331,15 +326,12 @@ func TestHandleLoginGET(t *testing.T) {
 	})
 }
-func createLoginFormRequest(t *testing.T, username, password string) *http.Request {
+func createLoginFormRequest(username, password string) *http.Request {
 	t.Helper()
 	form := url.Values{}
 	form.Set("username", username)
 	form.Set("password", password)
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/login",
 		strings.NewReader(form.Encode()),
@@ -362,7 +354,7 @@ func TestHandleLoginPOSTAuthenticatesValidCredentials(t *testing.T) {
 	)
 	require.NoError(t, createErr)
-	request := createLoginFormRequest(t, "testuser", "testpass123")
+	request := createLoginFormRequest("testuser", "testpass123")
 	recorder := httptest.NewRecorder()
 	handler := testCtx.handlers.HandleLoginPOST()
@@ -385,7 +377,7 @@ func TestHandleLoginPOSTRejectsInvalidCredentials(t *testing.T) {
 	)
 	require.NoError(t, createErr)
-	request := createLoginFormRequest(t, "testuser", "wrongpassword")
+	request := createLoginFormRequest("testuser", "wrongpassword")
 	recorder := httptest.NewRecorder()
 	handler := testCtx.handlers.HandleLoginPOST()
@@ -403,7 +395,7 @@ func TestHandleDashboard(t *testing.T) {
 		testCtx := setupTestHandlers(t)
-		request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
+		request := httptest.NewRequest(http.MethodGet, "/", nil)
 		recorder := httptest.NewRecorder()
 		handler := testCtx.handlers.HandleDashboard()
@@ -421,7 +413,7 @@ func TestHandleDashboard(t *testing.T) {
 		// Create an app so the template iterates over AppStats and hits .CSRFField
 		createTestApp(t, testCtx, "csrf-test-app")
-		request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
+		request := httptest.NewRequest(http.MethodGet, "/", nil)
 		recorder := httptest.NewRecorder()
 		handler := testCtx.handlers.HandleDashboard()
@@ -441,9 +433,7 @@ func TestHandleAppNew(t *testing.T) {
 		testCtx := setupTestHandlers(t)
-		request := httptest.NewRequestWithContext(
+		request := httptest.NewRequest(http.MethodGet, "/apps/new", nil)
 			t.Context(), http.MethodGet, "/apps/new", nil,
 		)
 		recorder := httptest.NewRecorder()
 		handler := testCtx.handlers.HandleAppNew()
@@ -511,8 +501,7 @@ func TestHandleWebhookRejectsOversizedBody(t *testing.T) {
 	// Create a body larger than 1MB - it should be silently truncated
 	// and the webhook should still process (or fail gracefully on parse)
 	largePayload := strings.Repeat("x", 2*1024*1024) // 2MB
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/webhook/"+createdApp.WebhookSecret,
 		strings.NewReader(largePayload),
@@ -555,8 +544,7 @@ func testOwnershipVerification(t *testing.T, cfg ownedResourceTestConfig) {
 	resourceID := cfg.createFn(t, testCtx, app1)
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		cfg.deletePath(app2.ID, resourceID),
 		nil,
@@ -595,8 +583,7 @@ func TestHandleEnvVarSaveBulk(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader(body),
@@ -638,8 +625,7 @@ func TestHandleEnvVarSaveAppNotFound(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/apps/nonexistent-id/env",
 		strings.NewReader(body),
@@ -665,8 +651,7 @@ func TestHandleEnvVarSaveEmptyKeyRejected(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader(body),
@@ -693,8 +678,7 @@ func TestHandleEnvVarSaveDuplicateKeyRejected(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader(body),
@@ -732,8 +716,7 @@ func TestHandleEnvVarSaveCrossAppIsolation(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/apps/"+appA.ID+"/env",
 		strings.NewReader(body),
@@ -796,8 +779,7 @@ func TestHandleEnvVarSaveBodySizeLimit(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader(sb.String()),
@@ -866,8 +848,7 @@ func TestDeleteVolumeOwnershipVerification(t *testing.T) {
 	require.NoError(t, volume.Save(context.Background()))
 	// Try to delete app1's volume using app2's URL path
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/apps/"+app2.ID+"/volumes/"+strconv.FormatInt(volume.ID, 10)+"/delete",
 		nil,
@@ -908,8 +889,7 @@ func TestDeletePortOwnershipVerification(t *testing.T) {
 	require.NoError(t, port.Save(context.Background()))
 	// Try to delete app1's port using app2's URL path
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/apps/"+app2.ID+"/ports/"+strconv.FormatInt(port.ID, 10)+"/delete",
 		nil,
@@ -950,8 +930,7 @@ func TestHandleEnvVarSaveEmptyClears(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader("[]"),
@@ -1000,8 +979,7 @@ func TestHandleVolumeAddValidatesPaths(t *testing.T) {
 			form.Set("host_path", tt.hostPath)
 			form.Set("container_path", tt.containerPath)
-			request := httptest.NewRequestWithContext(
+			request := httptest.NewRequest(
 				t.Context(),
 				http.MethodPost,
 				"/apps/"+createdApp.ID+"/volumes",
 				strings.NewReader(form.Encode()),
@@ -1060,7 +1038,7 @@ func TestSetupRequiredExemptsHealthAndStaticAndAPI(t *testing.T) {
 		t.Run(path, func(t *testing.T) {
 			t.Parallel()
-			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, path, nil)
+			req := httptest.NewRequest(http.MethodGet, path, nil)
 			rr := httptest.NewRecorder()
 			wrapped.ServeHTTP(rr, req)
@@ -1073,7 +1051,7 @@ func TestSetupRequiredExemptsHealthAndStaticAndAPI(t *testing.T) {
 	t.Run("non-exempt redirects", func(t *testing.T) {
 		t.Parallel()
-		req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
 		rr := httptest.NewRecorder()
 		wrapped.ServeHTTP(rr, req)
@@ -1089,8 +1067,7 @@ func TestHandleCancelDeployRedirects(t *testing.T) {
 	createdApp := createTestApp(t, testCtx, "cancel-deploy-app")
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/deployments/cancel",
 		nil,
@@ -1110,8 +1087,7 @@ func TestHandleCancelDeployReturns404ForUnknownApp(t *testing.T) {
 	testCtx := setupTestHandlers(t)
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		"/apps/nonexistent/deployments/cancel",
 		nil,
@@ -1132,8 +1108,7 @@ func TestHandleWebhookReturns404ForUnknownSecret(t *testing.T) {
 	webhookURL := "/webhook/unknown-secret"
 	payload := `{"ref": "refs/heads/main"}`
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		webhookURL,
 		strings.NewReader(payload),
@@ -1168,8 +1143,7 @@ func TestHandleWebhookProcessesValidWebhook(t *testing.T) {
 	payload := `{"ref": "refs/heads/main", "after": "abc123"}`
 	webhookURL := "/webhook/" + createdApp.WebhookSecret
-	request := httptest.NewRequestWithContext(
+	request := httptest.NewRequest(
 		t.Context(),
 		http.MethodPost,
 		webhookURL,
 		strings.NewReader(payload),
@@ -16,7 +16,7 @@ func TestRenderTemplateBuffersOutput(t *testing.T) {
 	testCtx := setupTestHandlers(t)
 	// The setup page is simple and has no DB dependencies
-	request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/setup", nil)
+	request := httptest.NewRequest(http.MethodGet, "/setup", nil)
 	recorder := httptest.NewRecorder()
 	handler := testCtx.handlers.HandleSetupGET()
@@ -39,7 +39,7 @@ func TestDashboardRenderTemplateBuffersOutput(t *testing.T) {
 	testCtx := setupTestHandlers(t)
-	request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
+	request := httptest.NewRequest(http.MethodGet, "/", nil)
 	recorder := httptest.NewRecorder()
 	handler := testCtx.handlers.HandleDashboard()
@@ -59,7 +59,7 @@ func TestLoginRenderTemplateBuffersOutput(t *testing.T) {
 	testCtx := setupTestHandlers(t)
-	request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/login", nil)
+	request := httptest.NewRequest(http.MethodGet, "/login", nil)
 	recorder := httptest.NewRecorder()
 	handler := testCtx.handlers.HandleLoginGET()
@@ -32,7 +32,7 @@ func TestCORS_NoOriginsConfigured_NoCORSHeaders(t *testing.T) {
 		w.WriteHeader(http.StatusOK)
 	}))
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	req.Header.Set("Origin", "https://evil.com")
 	rec := httptest.NewRecorder()
@@ -50,7 +50,7 @@ func TestCORS_OriginsConfigured_AllowsMatchingOrigin(t *testing.T) {
 		w.WriteHeader(http.StatusOK)
 	}))
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	req.Header.Set("Origin", "https://app.example.com")
 	rec := httptest.NewRecorder()
@@ -70,7 +70,7 @@ func TestCORS_OriginsConfigured_RejectsNonMatchingOrigin(t *testing.T) {
 		w.WriteHeader(http.StatusOK)
 	}))
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	req.Header.Set("Origin", "https://evil.com")
 	rec := httptest.NewRecorder()
@@ -36,7 +36,7 @@ func TestLoginRateLimitAllowsUpToBurst(t *testing.T) {
 	// First 5 requests should succeed (burst)
 	for i := range 5 {
-		req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+		req := httptest.NewRequest(http.MethodPost, "/login", nil)
 		req.RemoteAddr = "192.168.1.1:12345"
 		rec := httptest.NewRecorder()
 		handler.ServeHTTP(rec, req)
@@ -44,7 +44,7 @@ func TestLoginRateLimitAllowsUpToBurst(t *testing.T) {
 	}
 	// 6th request should be rate limited
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+	req := httptest.NewRequest(http.MethodPost, "/login", nil)
 	req.RemoteAddr = "192.168.1.1:12345"
 	rec := httptest.NewRecorder()
 	handler.ServeHTTP(rec, req)
@@ -63,21 +63,21 @@ func TestLoginRateLimitIsolatesIPs(t *testing.T) {
 	// Exhaust IP1's budget
 	for range 5 {
-		req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+		req := httptest.NewRequest(http.MethodPost, "/login", nil)
 		req.RemoteAddr = "10.0.0.1:1234"
 		rec := httptest.NewRecorder()
 		handler.ServeHTTP(rec, req)
 	}
 	// IP1 should be blocked
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+	req := httptest.NewRequest(http.MethodPost, "/login", nil)
 	req.RemoteAddr = "10.0.0.1:1234"
 	rec := httptest.NewRecorder()
 	handler.ServeHTTP(rec, req)
 	assert.Equal(t, http.StatusTooManyRequests, rec.Code)
 	// IP2 should still work
-	req2 := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+	req2 := httptest.NewRequest(http.MethodPost, "/login", nil)
 	req2.RemoteAddr = "10.0.0.2:1234"
 	rec2 := httptest.NewRecorder()
 	handler.ServeHTTP(rec2, req2)
@@ -96,13 +96,13 @@ func TestLoginRateLimitReturns429Body(t *testing.T) {
 	// Exhaust burst
 	for range 5 {
-		req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+		req := httptest.NewRequest(http.MethodPost, "/login", nil)
 		req.RemoteAddr = "172.16.0.1:5555"
 		rec := httptest.NewRecorder()
 		handler.ServeHTTP(rec, req)
 	}
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+	req := httptest.NewRequest(http.MethodPost, "/login", nil)
 	req.RemoteAddr = "172.16.0.1:5555"
 	rec := httptest.NewRecorder()
 	handler.ServeHTTP(rec, req)
@@ -121,7 +121,7 @@ func getSessionCookie(t *testing.T, svc *auth.Service) *http.Cookie {
 	require.NoError(t, err)
 	recorder := httptest.NewRecorder()
-	request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
+	request := httptest.NewRequest(http.MethodGet, "/", nil)
 	err = svc.CreateSession(recorder, request, user)
 	require.NoError(t, err)
@@ -380,7 +380,7 @@ func TestDestroySessionMaxAge(testingT *testing.T) {
 		defer cleanup()
 		recorder := httptest.NewRecorder()
-		request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
+		request := httptest.NewRequest(http.MethodGet, "/", nil)
 		err := svc.DestroySession(recorder, request)
 		require.NoError(t, err)
@@ -1,121 +0,0 @@
 #!/bin/sh
 # script/bootstrap: install all dependencies needed to build and develop
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes NOTHING is present (not git,
 # make, or go). golangci-lint is packaged in nix, brew, and apk; on apt
 # it is installed from a hash-verified GitHub release archive (never
 # curl | sh).
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # Pinned versions, 2026-07-07. Never "latest"; exact versions only.
 GOLANGCI_LINT_VERSION="2.10.1"
 # sha256 of golangci-lint-2.10.1-linux-<arch>.tar.gz release archives
 GOLANGCI_LINT_SHA256_AMD64="dfa775874cf0561b404a02a8f4481fc69b28091da95aa697259820d429b09c99"
 GOLANGCI_LINT_SHA256_ARM64="6652b42ae02915eb2f9cb2a2e0cac99514c8eded8388d88ae3e06e1a52c00de8"
 PKGMGR=""
 SUDO=""
 detect_pkgmgr() {
    [ -n "$PKGMGR" ] && return 0
    if command -v nix-env >/dev/null 2>&1; then
        PKGMGR="nix"
    elif command -v apt-get >/dev/null 2>&1; then
        PKGMGR="apt"
    elif command -v brew >/dev/null 2>&1; then
        PKGMGR="brew"
    elif command -v apk >/dev/null 2>&1; then
        PKGMGR="apk"
    else
        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
        exit 1
    fi
    if [ "$PKGMGR" = "apt" ]; then
        export DEBIAN_FRONTEND=noninteractive
        if [ "$(id -u)" != "0" ]; then
            SUDO="sudo"
        fi
    fi
 }
 # pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
 pkg_install() {
    detect_pkgmgr
    case "$PKGMGR" in
        nix) nix-env -iA "nixpkgs.$1" ;;
        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
        brew) brew install "$3" ;;
        apk) apk add --no-cache "$4" ;;
    esac
 }
 missing() {
    ! command -v "$1" >/dev/null 2>&1
 }
 # verify_sha256 <file> <expected-hash>
 verify_sha256() {
    if command -v sha256sum >/dev/null 2>&1; then
        actual="$(sha256sum "$1" | cut -d' ' -f1)"
    else
        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
    fi
    if [ "$actual" != "$2" ]; then
        echo "bootstrap: sha256 mismatch for $1" >&2
        echo "  expected: $2" >&2
        echo "  actual:   $actual" >&2
        exit 1
    fi
 }
 # apt has no golangci-lint package: install a pinned release archive
 # from GitHub, verified by hardcoded sha256 (never curl | sh).
 install_golangci_lint_release() {
    case "$(uname -m)" in
        x86_64) goarch="amd64"; sha="$GOLANGCI_LINT_SHA256_AMD64" ;;
        aarch64|arm64) goarch="arm64"; sha="$GOLANGCI_LINT_SHA256_ARM64" ;;
        *)
            echo "bootstrap: unsupported architecture $(uname -m)" >&2
            exit 1
            ;;
    esac
    if missing curl; then pkg_install curl curl curl curl; fi
    name="golangci-lint-${GOLANGCI_LINT_VERSION}-linux-${goarch}"
    tmp="$(mktemp -d)"
    curl -fsSL -o "$tmp/$name.tar.gz" \
        "https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_LINT_VERSION}/${name}.tar.gz"
    verify_sha256 "$tmp/$name.tar.gz" "$sha"
    tar -xzf "$tmp/$name.tar.gz" -C "$tmp"
    $SUDO install -m 0755 "$tmp/$name/golangci-lint" /usr/local/bin/golangci-lint
    rm -rf "$tmp"
 }
 ensure_golangci_lint() {
    if ! missing golangci-lint; then return 0; fi
    detect_pkgmgr
    case "$PKGMGR" in
        apt) install_golangci_lint_release ;;
        *) pkg_install golangci-lint golangci-lint golangci-lint golangci-lint ;;
    esac
 }
 main() {
    cd "$ROOT"
    # Base tooling
    if missing git; then pkg_install git git git git; fi
    if missing make; then pkg_install gnumake make make make; fi
    # Go toolchain and linter
    if missing go; then pkg_install go golang go go; fi
    ensure_golangci_lint
    go mod download
    echo "bootstrap complete"
 }
 main "$@"
@@ -1,15 +0,0 @@
 #!/bin/sh
 # script/check: run all checks (test, lint, fmt-check). Our own
 # extension to scripts-to-rule-them-all. Must not modify any files.
 # Generic: usually needs no adaptation.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 main() {
    "$SCRIPT_DIR/test"
    "$SCRIPT_DIR/lint"
    "$SCRIPT_DIR/fmt-check"
 }
 main "$@"
@@ -1,15 +0,0 @@
 #!/bin/sh
 # script/cibuild: run the CI build. The Dockerfile runs the checks
 # (make fmt-check, lint, test), so a successful build implies a green
 # repo. Generic: needs no adaptation. The Gitea workflow runs this on
 # push.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
    cd "$ROOT"
    docker build .
 }
 main "$@"
@@ -1,15 +0,0 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
 # Identical in all repos; the tag comes from script/projectname.
 # Generic: needs no adaptation.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 main() {
    cd "$ROOT"
    docker build -t "$("$SCRIPT_DIR/projectname")" .
 }
 main "$@"
@@ -1,14 +0,0 @@
 #!/bin/sh
 # script/fmt: format all files (writes).
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
    cd "$ROOT"
    gofmt -s -w .
    goimports -w .
    npx prettier --write --tab-width 4 static/js/*.js
 }
 main "$@"
@@ -1,17 +0,0 @@
 #!/bin/sh
 # script/fmt-check: check formatting (read-only). Same scope as
 # script/fmt, but fails instead of writing.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
    cd "$ROOT"
    if [ -n "$(gofmt -l .)" ]; then
        echo "Files not formatted:"
        gofmt -l .
        exit 1
    fi
 }
 main "$@"
@@ -1,16 +0,0 @@
 #!/bin/sh
 # script/install-precommit: install the git pre-commit hook that runs
 # script/precommit. Our own extension to scripts-to-rule-them-all.
 # Generic: needs no adaptation.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
    cd "$ROOT"
    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
    chmod +x .git/hooks/pre-commit
    echo "pre-commit hook installed: runs script/precommit"
 }
 main "$@"
@@ -1,12 +0,0 @@
 #!/bin/sh
 # script/lint: run the linter.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
    cd "$ROOT"
    golangci-lint run --config .golangci.yml ./...
 }
 main "$@"
@@ -1,21 +0,0 @@
 #!/bin/sh
 # script/precommit: run by the git pre-commit hook; fails the commit if
 # checks fail. Our own extension to scripts-to-rule-them-all. Go repo
 # extras: go mod tidy must not change go.mod/go.sum.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 main() {
    cd "$ROOT"
    go mod tidy
    git diff --exit-code -- go.mod go.sum || {
        echo "precommit: go mod tidy changed go.mod/go.sum;" \
            "stage the changes and retry" >&2
        exit 1
    }
    "$SCRIPT_DIR/check"
 }
 main "$@"
@@ -1,12 +0,0 @@
 #!/bin/sh
 # script/projectname: output the name of this project. Our own
 # extension to scripts-to-rule-them-all. Other scripts that need the
 # name (e.g. script/docker) call this, so they can stay identical
 # across all repos.
 set -eu
 main() {
    echo "upaas"
 }
 main "$@"
@@ -1,14 +0,0 @@
 #!/bin/sh
 # script/setup: set up the repo for development after a fresh clone:
 # installs dependencies (script/bootstrap) and the git pre-commit hook.
 # Add any repo-specific initialization (db init, .env template) here.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 main() {
    "$SCRIPT_DIR/bootstrap"
    "$SCRIPT_DIR/install-precommit"
 }
 main "$@"
@@ -1,12 +0,0 @@
 #!/bin/sh
 # script/test: run the test suite.
 set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
    cd "$ROOT"
    go test -v -race -cover -timeout 30s ./...
 }
 main "$@"
Author	SHA1	Message	Date
sneak	fa18a4400a	Merge branch 'main' into TODO Check / check (pull_request) Successful in 3m6s Details	2026-07-06 21:14:58 +02:00
sneak	b2d5ca824a	Add standard Workflow section to TODO.md Check / check (pull_request) Successful in 3m3s Details	2026-07-06 21:06:46 +02:00
sneak	7c43cd77cb	Add TODO.md	2026-07-06 20:31:41 +02:00