J3vb 9e48e8d8e8 fix: security hardening — 11 findings across auth, WS, upload, admin, data ...

Security audit across all 11 sections (AUTH-001 through DATA-001) found
0 critical, 1 high, 7 medium, 15 low issues. This commit addresses:

- Add json:"-" to User.PasswordHash, User.TOTPSecret, Session.TokenHash
  to prevent accidental serialization of sensitive fields (M7)
- Add X-Content-Type-Options: nosniff to file serve responses (M5)
- Apply owner-only guard to backup list endpoint for consistency (M6)
- Persist rate-limit lockouts to SQLite so they survive restarts (M2)
- Normalize DM non-participant responses to 404 to prevent oracle (L3)
- Add explicit per-entry expiry check in partial auth Lookup/Consume (L1)
- Truncate unknown WS message type to 64 chars before echo (L6)
- Rate-limit ping handler to 2/sec per user (L7)
- Replace raw error strings in update handlers with generic messages (L15)
- Update 4 tests to match new 404 behavior for DM non-participant

2026-04-02 14:51:16 +02:00

..

static

fix: admin panel tab navigation with error boundaries (T-202)

2026-04-01 11:38:24 +02:00

admin_handler_test.go

fix: add CSRF Origin check to setup endpoint (BUG-097)

2026-04-02 11:54:56 +02:00

admin.go

fix: add CSRF Origin check to setup endpoint (BUG-097)

2026-04-02 11:54:56 +02:00

api_edge_cases_test.go

fix: add CSRF Origin check to setup endpoint (BUG-097)

2026-04-02 11:54:56 +02:00

api_test.go

fix: add CSRF Origin check to setup endpoint (BUG-097)

2026-04-02 11:54:56 +02:00

api.go

fix: security hardening — 11 findings across auth, WS, upload, admin, data

2026-04-02 14:51:16 +02:00

handlers_backup_test.go

fix: add CSRF Origin check to setup endpoint (BUG-097)

2026-04-02 11:54:56 +02:00

handlers_backup.go

fix: close DB before backup restore to prevent corruption (BUG-096)

2026-04-02 11:45:09 +02:00

handlers_channels_test.go

fix: add CSRF Origin check to setup endpoint (BUG-097)

2026-04-02 11:54:56 +02:00

handlers_channels.go

fix: security hardening — 45 issues from full-project Copilot audit

2026-03-29 12:35:04 +02:00

handlers_settings.go

feat: TOTP 2FA settings UI, server hardening, full validation pass

2026-03-29 21:31:18 +02:00

handlers_users.go

chore: remaining server changes (code quality, go mod tidy)

2026-04-01 11:38:33 +02:00

helpers.go

chore: remaining server changes (code quality, go mod tidy)

2026-04-01 11:38:33 +02:00

logstream_test.go

feat: TOTP 2FA settings UI, server hardening, full validation pass

2026-03-29 21:31:18 +02:00

logstream.go

feat: add syncutil mutex, test scaffolding, and server hardening

2026-04-01 12:04:15 +02:00

main_test.go

feat: add syncutil mutex, test scaffolding, and server hardening

2026-04-01 12:04:15 +02:00

middleware_and_spawn_test.go

fix: add CSRF Origin check to setup endpoint (BUG-097)

2026-04-02 11:54:56 +02:00

middleware_coverage_test.go

fix: add CSRF Origin check to setup endpoint (BUG-097)

2026-04-02 11:54:56 +02:00

middleware.go

refactor: extensibility overhaul — handler registry, permission checker, sidebar decomposition, DX improvements

2026-03-29 12:19:08 +02:00

setup_handler_test.go

fix: atomic setup prevents TOCTOU race creating multiple owners (BUG-119)

2026-04-02 12:09:27 +02:00

setup_handler.go

fix: atomic setup prevents TOCTOU race creating multiple owners (BUG-119)

2026-04-02 12:09:27 +02:00

types.go

refactor: extensibility overhaul — handler registry, permission checker, sidebar decomposition, DX improvements

2026-03-29 12:19:08 +02:00

update_handlers_test.go

fix: add CSRF Origin check to setup endpoint (BUG-097)

2026-04-02 11:54:56 +02:00

update_handlers.go

fix: security hardening — 11 findings across auth, WS, upload, admin, data

2026-04-02 14:51:16 +02:00