2 Commits

Include renames

Author	SHA1	Message	Date
jevb	57d87bb439	fix: require auth + channel ACL on file serving (BUG-092) ... Private attachments were accessible without authentication if the UUID was known. Added AuthMiddleware to the GET /api/v1/files/{id} route, uploader_id tracking on uploads, and channel-level permission checks (guild READ_MESSAGES, DM participant, admin bypass) in handleServeFile. Migration 010 adds uploader_id column to attachments table. 8 new access-control tests covering all authorization paths.	2026-04-02 11:16:16 +02:00
jevb	2a62f31c39	test: boost server coverage — auth 60→95%, db 69→81%, config 75→85% ... Add comprehensive tests across all Go packages: - auth: username validation, concurrent rate limiting, TOTP stores, timing - config: env overrides, default credential detection, voice defaults - db: search, message queries, special char handling - api: handler edge cases, error paths, DM/invite/TOTP coverage - ws: voice handler paths, integration scenarios - updater: version comparison, timeout handling 6 of 8 packages now at 80%+ coverage.	2026-04-01 11:38:11 +02:00