J3vb 3d18ce4f99 fix: Go E2EE security hardening — key holder tracking, base64 loose validation, rate limits, test schema ...

- I-1: Add key holder election in Hub (lowest userID per channel); reject
  non-key-holder voice_e2ee_offer with NOT_KEY_HOLDER error
- I-2: Accept raw (unpadded) base64 in E2EE announce/offer handlers via
  decodeBase64Loose fallback
- I-6: Copy E2EE public key value while h.mu.RLock is held in getClientE2EEPubKey
- I-7: Lower loginRateLimitPerMinute from 60 to 5
- C-1: TOCTOU fix — target channel check held under same lock as client lookup
- C-2: Include is_key_holder bool in voice_token payload so client knows
  whether to initiate key distribution
- M-5/M-6: Add ErrCodeBadPayload/ErrCodeNotKeyHolder error constants
- Fix pre-existing api build errors: block_handler.go getUserFromContext,
  router.go RequirePermission arg count
- Add user_blocks table to all test DB schemas (ws, api DM)
- Add voice_e2ee_test.go and constants_test.go covering all fixes

2026-04-04 23:16:31 +02:00

..

auth_handler_test.go

fix: encrypt TOTP secrets at rest and filter replay buffer by permissions

2026-04-02 15:05:56 +02:00

auth_handler.go

fix: resolve all 12 golangci-lint issues

2026-04-03 08:33:55 +02:00

block_handler.go

fix: Go E2EE security hardening — key holder tracking, base64 loose validation, rate limits, test schema

2026-04-04 23:16:31 +02:00

channel_authz_test.go

fix: exclude DM channels from guild channel listings (BUG-093)

2026-04-02 11:24:43 +02:00

channel_handler_test.go

fix: security hardening — 11 findings across auth, WS, upload, admin, data

2026-04-02 14:51:16 +02:00

channel_handler.go

fix: security hardening — 11 findings across auth, WS, upload, admin, data

2026-04-02 14:51:16 +02:00

client_update_test.go

test: add channel pins, metrics, diagnostics, client-update, middleware tests

2026-03-31 16:27:21 +02:00

client_update.go

chore: remaining server changes (code quality, go mod tidy)

2026-04-01 11:38:33 +02:00

clientip_test.go

feat: add Let's Encrypt ACME support, fix security issues, improve server UX

2026-03-15 07:07:59 +01:00

constants_test.go

fix: Go E2EE security hardening — key holder tracking, base64 loose validation, rate limits, test schema

2026-04-04 23:16:31 +02:00

constants.go

fix: Go E2EE security hardening — key holder tracking, base64 loose validation, rate limits, test schema

2026-04-04 23:16:31 +02:00

contract_test.go

fix: address PR review findings (issues #9-#14)

2026-03-17 04:11:04 +01:00

coverage_push_test.go

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00

diagnostics_handler_test.go

test: boost server coverage — auth 60→95%, db 69→81%, config 75→85%

2026-04-01 11:38:11 +02:00

diagnostics_handler.go

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00

dm_handler_test.go

fix: Go E2EE security hardening — key holder tracking, base64 loose validation, rate limits, test schema

2026-04-04 23:16:31 +02:00

dm_handler.go

fix: comprehensive security hardening from full codebase audit

2026-04-04 16:48:57 +00:00

export_test.go

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00

invite_handler_test.go

fix: encrypt TOTP secrets at rest and filter replay buffer by permissions

2026-04-02 15:05:56 +02:00

invite_handler.go

fix: comprehensive security hardening from full codebase audit

2026-04-04 16:48:57 +00:00

livekit_proxy_test.go

feat: voice/video polish — refactor, AudioWorklet VAD, bug fixes, UX improvements

2026-03-29 00:51:54 +01:00

livekit_proxy.go

fix: comprehensive security hardening from full codebase audit

2026-04-04 16:48:57 +00:00

livekit_ratelimit_test.go

feat: TOTP 2FA settings UI, server hardening, full validation pass

2026-03-29 21:31:18 +02:00

main_test.go

feat: add syncutil mutex, test scaffolding, and server hardening

2026-04-01 12:04:15 +02:00

metrics_handler_test.go

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00

metrics_handler.go

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00

middleware_test.go

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00

middleware.go

fix: validate proxy IP headers and force attachment for unsafe MIME types (BUG-112, BUG-118)

2026-04-02 13:23:09 +02:00

profile_handler_test.go

feat: broadcast username changes to all connected clients via WebSocket

2026-04-02 16:33:11 +02:00

profile_handler.go

security: validate avatar URLs on server and client

2026-04-03 08:10:26 +02:00

router_test.go

fix: revert breaking security changes and update tests for version removal

2026-04-04 18:02:26 +00:00

router.go

fix: Go E2EE security hardening — key holder tracking, base64 loose validation, rate limits, test schema

2026-04-04 23:16:31 +02:00

totp_handler_test.go

style: apply linter fixes to new test files

2026-04-01 08:48:41 +02:00

totp_handler.go

fix: encrypt TOTP secrets at rest and filter replay buffer by permissions

2026-04-02 15:05:56 +02:00

upload_handler_test.go

fix: add per-user upload rate limit to prevent disk exhaustion (BUG-131)

2026-04-02 13:18:57 +02:00

upload_handler.go

fix: comprehensive security hardening from full codebase audit

2026-04-04 16:48:57 +00:00

waf.go

fix: resolve all 12 golangci-lint issues

2026-04-03 08:33:55 +02:00