3 Commits

Include renames

Author	SHA1	Message	Date
J3vbandClaude Fable 5	95f85e213f	test(service): cover atomic attachment-ownership link semantics (W1-3) ... Mechanical signature updates for LinkAttachmentsToMessage callsites, plus: db-level OwnershipGuard test (owned links, foreign never links, legacy NULL-uploader claimable, nonexistent skipped) and a service-level SendMessage test proving skip semantics end-to-end including the already-linked retry path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 08:29:26 +02:00
jevb	57d87bb439	fix: require auth + channel ACL on file serving (BUG-092) ... Private attachments were accessible without authentication if the UUID was known. Added AuthMiddleware to the GET /api/v1/files/{id} route, uploader_id tracking on uploads, and channel-level permission checks (guild READ_MESSAGES, DM participant, admin bypass) in handleServeFile. Migration 010 adds uploader_id column to attachments table. 8 new access-control tests covering all authorization paths.	2026-04-02 11:16:16 +02:00
jevb	2a62f31c39	test: boost server coverage — auth 60→95%, db 69→81%, config 75→85% ... Add comprehensive tests across all Go packages: - auth: username validation, concurrent rate limiting, TOTP stores, timing - config: env overrides, default credential detection, voice defaults - db: search, message queries, special char handling - api: handler edge cases, error paths, DM/invite/TOTP coverage - ws: voice handler paths, integration scenarios - updater: version comparison, timeout handling 6 of 8 packages now at 80%+ coverage.	2026-04-01 11:38:11 +02:00