golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
468 Commits 1 Branch 2 Tags
38f087deb3ea280920ca1c4e90f78ca50fa198a7
Commit Graph

468 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jakub Zych
98dd09847a test(06-05): close framework coverage gaps in bouncer, surf, wire, fetchguard 
- Registry neither-interface, nil-registry, and authenticate default
- MemoryStore sweep actually drops expired entries
- RegisterHouseMiddlewareFactory duplicate-name failure
- pathScopedCORS unmatched path plus empty-raw-group introspection
- Time UnmarshalJSON +00:00/Z and PublicOnlyMode host/IP cases
 2026-09-19 21:08:04 +02:00
Jakub Zych
f61776d0a6 docs(06-03): complete raw groups, wire, CORS, and body-limit plan 
- Operator-confirmed 128MiB body limits (134217728); D-18/T-06-13 closed
- HTTP-06, HTTP-08, HTTP-09 marked complete
 2026-09-19 21:01:07 +02:00
Jakub Zych
30539b954f feat(06-03): add path-scoped CORS and per-route body limits 
- CORS matches Laravel path globs (api/* includes nested segments); unlisted paths get no headers
- Non-raw routes wrap http.MaxBytesReader from http.body_limits.default_bytes; body.limit:N overrides innermost
- Raw routes stay uncapped at this layer
 2026-09-19 20:10:02 +02:00
Jakub Zych
9ecf2d1868 feat(06-03): add wire JSON helpers, Time, TriBool, and Slice 
- WriteJSON matches genre_controller byte-for-byte (SetEscapeHTML false, trim trailing newline)
- Time marshals Carbon +00:00 never Z; TriBool nulls when invalid; Slice never returns nil
 2026-09-19 20:01:27 +02:00
Jakub Zych
fa7e6d1870 feat(06-03): add raw groups, house middleware, and route:list 
- GroupRaw plus sticky raw inheritance and registration-time house-envelope refusal via pact.HasHouseMiddleware
- Recover on raw routes writes a bare 500; non-raw keeps the house JSON body
- Router.Routes() and surf.RouteListCommand; generated main registers route:list
 2026-09-19 19:55:32 +02:00
Jakub Zych
42b8295cc1 docs(06-02): complete fixed-window limiter and five-bucket plan 2026-09-19 19:46:28 +02:00
Jakub Zych
ab20ad0f9c docs(06-02): correct HTTP-04 named bucket count to five 
- ROADMAP Phase 6 success criterion 2 and REQUIREMENTS HTTP-04 said seven
- D-01: routes.php defines five fonoteka-* buckets plus inline throttle:N,M
 2026-09-19 19:42:23 +02:00
Jakub Zych
68c6ab85c5 feat(06-02): add fixed-window limiter, Store, and ClientIP 
- MemoryStore mirrors Laravel tooManyAttempts-before-hit first-hit-wins
- FixedWindowLimiter + throttle factory; success and 429 rate-limit headers
- Trusted-proxy ClientIP; remove noOpLimit; keep Limiter interface seam
 2026-09-19 19:35:53 +02:00
Jakub Zych
e2aba0ebf0 docs(phase-06): update tracking after wave 1 2026-09-19 19:28:18 +02:00
Jakub Zych
bc17c3decb chore: merge executor worktree (worktree-agent-01a0ba96) 2026-09-19 19:26:53 +02:00
Jakub Zych
1f56a9ee1c docs(06-01): complete guard registry and dual-group genres plan 2026-09-19 19:24:03 +02:00
Jakub Zych
cca4ec3a8b docs(06-04): complete SSRF-guarded fetch helper plan 
- Record fetchguard.Fetch dial-time SSRF helper, typed reasons, and TDD commits
 2026-09-19 19:03:20 +02:00
Jakub Zych
7923fe86c7 feat(06-04): implement dial-time SSRF-guarded Fetch 
- AllowHosts exact/dotted-suffix and PublicOnly modes, https-only
- Private/reserved IP check at net.Dialer.Control, no redirects
- Streaming io.LimitReader byte cap and typed failure reasons
 2026-09-19 19:02:12 +02:00
Jakub Zych
bae9de8788 test(06-04): add failing tests for SSRF-guarded Fetch 
- Cover host allow-list, dotted-suffix bypass, dial-time private IP
- Cover no-follow redirects, streaming byte cap, and D-14 config defaults
 2026-09-19 19:00:01 +02:00
Jakub Zych
d376b1be2d feat(06-01): grow router verbs, factories, and guard registry 
- Add Post/Put/Patch/Delete on pact.Router and surf Router/Group
- Resolve name:param middleware via RegisterMiddlewareFactory
- Add bouncer.Registry with Guard, CredentialGuard, UnauthorizedWriter
- Re-express jwt as NewJWTGuard without changing Middleware bodies
 2026-09-19 18:59:12 +02:00
Jakub Zych
d3630e7de0 feat(06-04): implement private/reserved IP classification table 
- Port PHP PRIVATE_V4_CIDRS and PRIVATE_V6_PREFIXES onto netip.Prefix
- Fail closed on invalid addresses; Unmap remains the caller's job
 2026-09-19 18:57:44 +02:00
Jakub Zych
f7e7ca7fa3 test(06-04): add failing test for private/reserved IP table 
- Table-driven cases port PHP PRIVATE_V4_CIDRS/PRIVATE_V6_PREFIXES
- Document Unmap() as the caller responsibility for v4-mapped literals
 2026-09-19 18:57:18 +02:00
Jakub Zych
ecab09c37a docs(06): finalize phase plan after verification 2026-09-19 17:16:58 +02:00
Jakub Zych
ad3d6f7f84 docs(06): revision pass 1 - resolve Limiter naming collision and add plugin-facing house-middleware capability 2026-09-19 17:13:02 +02:00
Jakub Zych
c4f406bb64 docs(06): create phase plan 2026-09-19 16:58:48 +02:00
Jakub Zych
6a9f5e1b47 docs(05): add code review fix report 2026-09-19 15:41:27 +02:00
Jakub Zych
56156ae7c3 fix(05): WR-05 gate public file serving on is_public 2026-09-19 15:39:19 +02:00
Jakub Zych
c12e6576f6 fix(05): WR-04 default File.IsPublic to true without trapping false 2026-09-19 15:39:19 +02:00
Jakub Zych
fb12b2237d fix(05): WR-03 numeric between/min/max without omitempty or length tags 2026-09-19 15:39:19 +02:00
Jakub Zych
e54f9d7f10 fix(05): WR-02 delete thumb blob after a failed encode 2026-09-19 15:39:19 +02:00
Jakub Zych
c211822448 fix(05): WR-01 bound thumb dimensions and decoded image size 2026-09-19 15:39:19 +02:00
Jakub Zych
44126cc935 fix(05): CR-01 serve thumb URLs from the validated path key 2026-09-19 15:39:19 +02:00
Jakub Zych
c0b2b6db08 docs(phase-6): add validation strategy 2026-09-19 15:36:23 +02:00
Jakub Zych
e9c2f25ebe docs(06): research HTTP routing, auth groups and rate limiting 2026-09-19 15:35:20 +02:00
Jakub Zych
07df9b1e74 docs(state): record phase 6 context session 2026-09-19 14:04:36 +02:00
Jakub Zych
820d17c6c3 docs(06): capture phase context 2026-09-19 14:04:36 +02:00
Jakub Zych
ab4ac856da docs(05): add code review report 2026-09-19 00:20:17 +02:00
Jakub Zych
bbee45c5f4 docs(05): add code review fix report 2026-09-18 23:53:21 +02:00
Jakub Zych
c84869270e test(05): WR-05 pin that the thumb delete prefix is ID-delimited 2026-09-18 23:48:49 +02:00
Jakub Zych
ced87a5608 fix(05): WR-04 restrict thumb mode and ext to [a-z0-9]+ before building blob keys 2026-09-18 23:48:22 +02:00
Jakub Zych
6d2262d95f fix(05): WR-02 fill Encrypted columns from plaintext, never Scan request input 2026-09-18 23:47:28 +02:00
Jakub Zych
3943ea3a2e fix(05): CR-01 accept pointer and whole JSON numbers in integer rule 2026-09-18 23:41:57 +02:00
Jakub Zych
ba8a822149 docs(phase-5): evolve PROJECT.md after phase completion 2026-09-18 21:11:43 +02:00
Jakub Zych
0056c35cb0 docs(phase-5): complete phase execution 2026-09-18 21:11:43 +02:00
Jakub Zych
cd546dae1d docs(05): add code review report 2026-09-18 21:11:11 +02:00
Jakub Zych
38cd4c6f50 docs(05-06): record plan close-out in STATE and ROADMAP 
- Phase 5 plan 6 of 6 complete and ready for verification
- Record 23 min / 3 tasks / 12 files and the fill-boundary test decisions
 2026-09-18 20:56:10 +02:00
Jakub Zych
ba3efccadd docs(05-06): complete fill-fuzz hidden-marshal security-review plan 
- Record fuzz, hidden-marshal, public_token, attach, and security-review outcomes
- Note module-boundary placement of the models.All() walk
 2026-09-18 20:54:10 +02:00
Jakub Zych
e0a11c3ea0 docs(05-06): security review of fill and encryption boundaries 
- Map T-05-01 through T-05-24 to a passing test or restated accept rationale
- Enumerate every .Reveal() call site; none are on log or serialize paths
- Confirm zero AutoMigrate production calls and no Association Mode pivot writes
 2026-09-18 20:51:35 +02:00
Jakub Zych
1fcf5abcdf test(05-06): assert HasHidden fields never marshal 
- Fixture model with json:\"-\" keeps the sentinel out of JSON
- Registered-model walk stays in fonoteka.go so the framework stays app-agnostic
 2026-09-18 20:48:21 +02:00
Jakub Zych
7ead5e0c2f test(05-06): add lagoon.Fill fuzz test 
- FuzzFill seeds extra and server-owned keys against a fixture struct
- Non-allow-listed fields stay at their pre-Fill values with zero panics
 2026-09-18 20:45:52 +02:00
Jakub Zych
67434f5185 docs(05-05): record plan close-out in STATE and ROADMAP 
- Advance to plan 6 of 6; mark DATA-11 and CLI-03 complete
 2026-09-18 20:28:00 +02:00
Jakub Zych
62f3ae563f docs(05-05): complete remaining-models schema-diff fixture plan 
- Record Task 1-3 commits, D-02 allow-list, and DATA-11 fixture isolation
 2026-09-18 20:26:41 +02:00
Jakub Zych
4df7e016a2 feat(05-05): accept boolean validation token 
- Treat Laravel boolean as a type-check no-op in lagoon.Validate
- Settings.search_use_typesense uses this rule string
 2026-09-18 20:14:46 +02:00
Jakub Zych
678b216900 docs(05-04): record plan close-out in STATE and ROADMAP 
- Advance to plan 5 of 6; DATA-08 marked complete
 2026-09-18 20:05:58 +02:00
Jakub Zych
690aed2ea6 docs(05-04): complete attachments system_files blob and thumb plan 
Tasks completed: 3/3
- Task 1: File, Thumb, bucket, system_files migration
- Task 2: delete lifecycle and static handler
- Task 3: Album/Collection MorphName

SUMMARY: .planning/phases/05-data-layer-full-fidelity/05-04-SUMMARY.md
 2026-09-18 20:04:39 +02:00