4 Commits

Author	SHA1	Message	Date
clawbot	7f4c40caca	feat: add CSRF protection, SSRF prevention, and login rate limiting ... Security hardening implementing three issues: CSRF Protection (#35): - Session-based CSRF tokens with cryptographically random generation - Constant-time token comparison to prevent timing attacks - CSRF middleware applied to /pages, /sources, /source, and /user routes - Hidden csrf_token field added to all 12+ POST forms in templates - Excluded from /webhook (inbound) and /api (stateless) routes SSRF Prevention (#36): - ValidateTargetURL blocks private/reserved IP ranges at target creation - Blocked ranges: 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, ::1, fc00::/7, fe80::/10, plus multicast, reserved, test-net, and CGN ranges - SSRF-safe HTTP transport with custom DialContext for defense-in-depth at delivery time (prevents DNS rebinding attacks) - Only http/https schemes allowed Login Rate Limiting (#37): - Per-IP rate limiter using golang.org/x/time/rate - 5 attempts per minute per IP on POST /pages/login - GET requests (form rendering) pass through unaffected - Automatic cleanup of stale per-IP limiter entries - X-Forwarded-For and X-Real-IP header support for reverse proxies Closes #35, closes #36, closes #37	2026-03-05 03:37:09 -08:00
clawbot	25e27cc57f	refactor: merge retry target type into http (max_retries=0 = fire-and-forget)	2026-03-01 23:51:55 -08:00
clawbot	f21a007a3c	feat: add entrypoint/target management controls (closes #25) ... Add toggle (activate/deactivate) and delete buttons for individual entrypoints and targets on the webhook detail page. Each action is a POST form submission with ownership verification. New routes: POST /source/{id}/entrypoints/{entrypointID}/delete POST /source/{id}/entrypoints/{entrypointID}/toggle POST /source/{id}/targets/{targetID}/delete POST /source/{id}/targets/{targetID}/toggle	2026-03-01 16:38:14 -08:00
clawbot	7f8469a0f2	feat: implement core webhook engine, delivery system, and management UI (Phase 2) ... - Webhook reception handler: look up entrypoint by UUID, verify active, capture full HTTP request (method, headers, body, content-type), create Event record, queue Delivery records for each active Target, return 200 OK. Handles edge cases: unknown UUID → 404, inactive → 410, oversized → 413. - Delivery engine (internal/delivery): fx-managed background goroutine that polls for pending/retrying deliveries and dispatches to target type handlers. Graceful shutdown via context cancellation. - Target type implementations: - HTTP: fire-and-forget POST with original headers forwarding - Retry: exponential backoff (1s, 2s, 4s...) up to max_retries - Database: immediate success (event already stored) - Log: slog output with event details - Webhook management pages with Tailwind CSS + Alpine.js: - List (/sources): webhooks with entrypoint/target/event counts - Create (/sources/new): form with auto-created default entrypoint - Detail (/source/{id}): config, entrypoints, targets, recent events - Edit (/source/{id}/edit): name, description, retention_days - Delete (/source/{id}/delete): soft-delete with child records - Add Entrypoint (/source/{id}/entrypoints): inline form - Add Target (/source/{id}/targets): type-aware form - Event Log (/source/{id}/logs): paginated with delivery status - Updated README: marked completed items, updated naming conventions table, added delivery engine to package layout and DI docs, updated column names to reflect entity rename. - Rebuilt Tailwind CSS for new template classes. Part of: #15	2026-03-01 16:14:28 -08:00