golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
234 Commits 1 Branch 2 Tags
c187d6f735a70371f71440c0f05d293f74439360
Commit Graph

234 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jakub Zych
c187d6f735 docs(06): reopen phase after verification gaps 2026-09-20 14:00:36 +02:00
Jakub Zych
dd78e0d6b3 docs(06): record gap-closure re-verification 2026-09-20 13:57:07 +02:00
Jakub Zych
067a3ffb2b docs(06): add code review report 2026-09-20 13:49:19 +02:00
Jakub Zych
3c57a88344 chore(gsd): disable unsupported worktree isolation 2026-09-20 13:33:17 +02:00
Jakub Zych
f5fd55f419 docs(06-06): update plan tracking 2026-09-20 13:33:11 +02:00
Jakub Zych
7f627961b1 docs(06-06): complete personal-token rate-limit gap plan 2026-09-20 13:31:41 +02:00
Jakub Zych
3423da2222 docs(06-06): extend security review through gap closure 2026-09-20 13:30:41 +02:00
Jakub Zych
da8f247065 docs(06): finalize gap-closure plan 2026-09-20 00:19:53 +02:00
Jakub Zych
b20466d2e2 fix(06): revise gap plan security coverage and full gates 2026-09-20 00:14:58 +02:00
Jakub Zych
a61c83e614 fix(06): resolve research questions 2026-09-19 23:13:24 +02:00
Jakub Zych
2f90fef830 docs(06): add rate-limit middleware gap plan 2026-09-19 23:07:43 +02:00
Jakub Zych
cb34de4203 docs(phase-06): mark progress table as gaps found 2026-09-19 21:44:36 +02:00
Jakub Zych
59d9a26aad docs(phase-06): record verification gaps and reopen phase 2026-09-19 21:44:26 +02:00
Jakub Zych
73218c0781 docs(06): add code review report 2026-09-19 21:32:41 +02:00
Jakub Zych
b759669f23 docs(06-05): complete unit coverage and security-review plan 2026-09-19 21:21:42 +02:00
Jakub Zych
74d1eb37a0 docs(06-05): map every T-06-xx threat to a passing test or restated accept 
- 19-row register T-06-01 through T-06-18 plus T-06-SC
- mitigate rows name file:TestName; accept rows copy originating rationale
- grep: no bearer/hash logging; inv.must-change-password only in HouseMiddlewares
 2026-09-19 21:15:24 +02:00
Jakub Zych
98dd09847a test(06-05): close framework coverage gaps in bouncer, surf, wire, fetchguard 
- Registry neither-interface, nil-registry, and authenticate default
- MemoryStore sweep actually drops expired entries
- RegisterHouseMiddlewareFactory duplicate-name failure
- pathScopedCORS unmatched path plus empty-raw-group introspection
- Time UnmarshalJSON +00:00/Z and PublicOnlyMode host/IP cases
 2026-09-19 21:08:04 +02:00
Jakub Zych
f61776d0a6 docs(06-03): complete raw groups, wire, CORS, and body-limit plan 
- Operator-confirmed 128MiB body limits (134217728); D-18/T-06-13 closed
- HTTP-06, HTTP-08, HTTP-09 marked complete
 2026-09-19 21:01:07 +02:00
Jakub Zych
30539b954f feat(06-03): add path-scoped CORS and per-route body limits 
- CORS matches Laravel path globs (api/* includes nested segments); unlisted paths get no headers
- Non-raw routes wrap http.MaxBytesReader from http.body_limits.default_bytes; body.limit:N overrides innermost
- Raw routes stay uncapped at this layer
 2026-09-19 20:10:02 +02:00
Jakub Zych
9ecf2d1868 feat(06-03): add wire JSON helpers, Time, TriBool, and Slice 
- WriteJSON matches genre_controller byte-for-byte (SetEscapeHTML false, trim trailing newline)
- Time marshals Carbon +00:00 never Z; TriBool nulls when invalid; Slice never returns nil
 2026-09-19 20:01:27 +02:00
Jakub Zych
fa7e6d1870 feat(06-03): add raw groups, house middleware, and route:list 
- GroupRaw plus sticky raw inheritance and registration-time house-envelope refusal via pact.HasHouseMiddleware
- Recover on raw routes writes a bare 500; non-raw keeps the house JSON body
- Router.Routes() and surf.RouteListCommand; generated main registers route:list
 2026-09-19 19:55:32 +02:00
Jakub Zych
42b8295cc1 docs(06-02): complete fixed-window limiter and five-bucket plan 2026-09-19 19:46:28 +02:00
Jakub Zych
ab20ad0f9c docs(06-02): correct HTTP-04 named bucket count to five 
- ROADMAP Phase 6 success criterion 2 and REQUIREMENTS HTTP-04 said seven
- D-01: routes.php defines five fonoteka-* buckets plus inline throttle:N,M
 2026-09-19 19:42:23 +02:00
Jakub Zych
68c6ab85c5 feat(06-02): add fixed-window limiter, Store, and ClientIP 
- MemoryStore mirrors Laravel tooManyAttempts-before-hit first-hit-wins
- FixedWindowLimiter + throttle factory; success and 429 rate-limit headers
- Trusted-proxy ClientIP; remove noOpLimit; keep Limiter interface seam
 2026-09-19 19:35:53 +02:00
Jakub Zych
e2aba0ebf0 docs(phase-06): update tracking after wave 1 2026-09-19 19:28:18 +02:00
Jakub Zych
bc17c3decb chore: merge executor worktree (worktree-agent-01a0ba96) 2026-09-19 19:26:53 +02:00
Jakub Zych
1f56a9ee1c docs(06-01): complete guard registry and dual-group genres plan 2026-09-19 19:24:03 +02:00
Jakub Zych
cca4ec3a8b docs(06-04): complete SSRF-guarded fetch helper plan 
- Record fetchguard.Fetch dial-time SSRF helper, typed reasons, and TDD commits
 2026-09-19 19:03:20 +02:00
Jakub Zych
7923fe86c7 feat(06-04): implement dial-time SSRF-guarded Fetch 
- AllowHosts exact/dotted-suffix and PublicOnly modes, https-only
- Private/reserved IP check at net.Dialer.Control, no redirects
- Streaming io.LimitReader byte cap and typed failure reasons
 2026-09-19 19:02:12 +02:00
Jakub Zych
bae9de8788 test(06-04): add failing tests for SSRF-guarded Fetch 
- Cover host allow-list, dotted-suffix bypass, dial-time private IP
- Cover no-follow redirects, streaming byte cap, and D-14 config defaults
 2026-09-19 19:00:01 +02:00
Jakub Zych
d376b1be2d feat(06-01): grow router verbs, factories, and guard registry 
- Add Post/Put/Patch/Delete on pact.Router and surf Router/Group
- Resolve name:param middleware via RegisterMiddlewareFactory
- Add bouncer.Registry with Guard, CredentialGuard, UnauthorizedWriter
- Re-express jwt as NewJWTGuard without changing Middleware bodies
 2026-09-19 18:59:12 +02:00
Jakub Zych
d3630e7de0 feat(06-04): implement private/reserved IP classification table 
- Port PHP PRIVATE_V4_CIDRS and PRIVATE_V6_PREFIXES onto netip.Prefix
- Fail closed on invalid addresses; Unmap remains the caller's job
 2026-09-19 18:57:44 +02:00
Jakub Zych
f7e7ca7fa3 test(06-04): add failing test for private/reserved IP table 
- Table-driven cases port PHP PRIVATE_V4_CIDRS/PRIVATE_V6_PREFIXES
- Document Unmap() as the caller responsibility for v4-mapped literals
 2026-09-19 18:57:18 +02:00
Jakub Zych
ecab09c37a docs(06): finalize phase plan after verification 2026-09-19 17:16:58 +02:00
Jakub Zych
ad3d6f7f84 docs(06): revision pass 1 - resolve Limiter naming collision and add plugin-facing house-middleware capability 2026-09-19 17:13:02 +02:00
Jakub Zych
c4f406bb64 docs(06): create phase plan 2026-09-19 16:58:48 +02:00
Jakub Zych
6a9f5e1b47 docs(05): add code review fix report 2026-09-19 15:41:27 +02:00
Jakub Zych
56156ae7c3 fix(05): WR-05 gate public file serving on is_public 2026-09-19 15:39:19 +02:00
Jakub Zych
c12e6576f6 fix(05): WR-04 default File.IsPublic to true without trapping false 2026-09-19 15:39:19 +02:00
Jakub Zych
fb12b2237d fix(05): WR-03 numeric between/min/max without omitempty or length tags 2026-09-19 15:39:19 +02:00
Jakub Zych
e54f9d7f10 fix(05): WR-02 delete thumb blob after a failed encode 2026-09-19 15:39:19 +02:00
Jakub Zych
c211822448 fix(05): WR-01 bound thumb dimensions and decoded image size 2026-09-19 15:39:19 +02:00
Jakub Zych
44126cc935 fix(05): CR-01 serve thumb URLs from the validated path key 2026-09-19 15:39:19 +02:00
Jakub Zych
c0b2b6db08 docs(phase-6): add validation strategy 2026-09-19 15:36:23 +02:00
Jakub Zych
e9c2f25ebe docs(06): research HTTP routing, auth groups and rate limiting 2026-09-19 15:35:20 +02:00
Jakub Zych
07df9b1e74 docs(state): record phase 6 context session 2026-09-19 14:04:36 +02:00
Jakub Zych
820d17c6c3 docs(06): capture phase context 2026-09-19 14:04:36 +02:00
Jakub Zych
ab4ac856da docs(05): add code review report 2026-09-19 00:20:17 +02:00
Jakub Zych
bbee45c5f4 docs(05): add code review fix report 2026-09-18 23:53:21 +02:00
Jakub Zych
c84869270e test(05): WR-05 pin that the thumb delete prefix is ID-delimited 2026-09-18 23:48:49 +02:00