5 Commits

Include renames

Author	SHA1	Message	Date
sneak	9bc6c597b6	Say the query logger drops bound values (closes #535) ... The comment on MaxAccessLogLineBytes said the GORM adapter logs each statement with the client's parameter written into it. Its ParamsFilter drops every bound value, so the statement is logged with its placeholders. The comment now says so and keeps the parts that still hold: the widest line spends two budgets and the adapter's test checks it against this constant. The assertBounded doc no longer claims each line was cut, and the postReceiver doc no longer explains itself by a log size test that is gone. Model: opus-5-5	2026-10-15 16:37:13 +00:00
clawbot	0d38aea12c	Keep the entrypoint UUID out of webhooker's own logs (closes #531) ... On the receiver route the access log and the per-entrypoint 429 line name the route pattern whatever the status. A request chi never routed, such as a dev-mode CORS preflight to the receiver, logs (unmatched). The access log keeps only the scheme and host of a Referer. The received line names the entrypoint and webhook IDs, and the unknown-entrypoint line logs no path. The pattern is middleware.ReceiverRoute, which routes.go registers the receiver with. The README says the proxy's access log holds the UUID and must be protected like the URL, and that a log target writes the request's headers as received. Its access-log, rate-limit, Sentry and log-size passages now match the code. Model: opus-5-5	2026-10-15 14:58:35 +02:00
clawbot	43ed8d4834	Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367) ... The webhook page and everything under it move from /source/ID to /hook/ID; the list and new-webhook form from /sources to /hooks and /hooks/new; the event log from .../logs to /hook/ID/events; entrypoint URLs, the ones senders post to, from /webhook/UUID to /h/UUID. The old paths are simply gone, per the owner's ruling. Every link, redirect, form action, test, comment and README mention follows; every link to the event log, and its title and heading, read "Full Event Log". Keeping the UUID out of logs, metrics labels and error reports, and the receiver rate limits, key on the route itself, so they cover /h/ unchanged. Routed tests follow every link and form the pages render to a moved page. Model: opus-5-5	2026-10-02 06:32:14 +02:00
clawbot	507980a347	Bound username length at creation (closes #184) ... Usernames are limited to 1024 bytes, so no account can exist that is unable to log in. The username rides in the session cookie, which browsers and securecookie refuse past about 4 KB, leaving room for roughly 2000 bytes of username; the limit is about half that. User.BeforeSave returns ErrUsernameTooLong when a whole User is created or saved. A byte-counting check constraint on users.username catches every other write, including a column update. The limit appears in the constant and in the struct tag; a test fails if they disagree. Model: opus-5-5	2026-10-01 21:38:48 +02:00
clawbot	563e834cf2	Bound every slog line against client-chosen text (closes #176)	2026-08-18 06:03:10 +02:00