golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
247 Commits 1 Branch 2 Tags
c9909ce412a00807be6466bd269311872ea1b3dd
Commit Graph

247 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jakub Zych
c9909ce412 docs(06-09): update plan tracking 2026-09-20 21:08:54 +02:00
Jakub Zych
158df899f6 docs(06-09): complete transactional panic recovery plan 
Tasks completed: 1/1
- Buffer route responses so panic recovery can discard partial output

SUMMARY: .planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-09-SUMMARY.md
 2026-09-20 21:06:51 +02:00
Jakub Zych
93d63c351b fix(06-09): buffer route responses before recovery 
- Discard partial route output when house or raw handlers panic
- Commit private headers status and body only after successful return
 2026-09-20 21:05:44 +02:00
Jakub Zych
f6ba67a693 test(06-09): add failing panic response regressions 
- Exercise house and raw handlers that write secrets before panicking
- Cover successful explicit and implicit response commits
 2026-09-20 21:04:02 +02:00
Jakub Zych
8a265d8372 docs(06-08): update plan tracking 
- Advance phase progress to 8 of 11 plans
- Record transition-address security decisions and execution metrics
- Mark HTTP-07 complete in requirements tracking
 2026-09-20 21:00:45 +02:00
Jakub Zych
ac24ddd518 docs(06-08): complete transition-address SSRF closure plan 
Tasks completed: 1/1
- Decode and reclassify embedded IPv4 at the dial-time SSRF boundary

SUMMARY: .planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-08-SUMMARY.md
 2026-09-20 20:58:54 +02:00
Jakub Zych
99fa932d43 fix(06-08): classify IPv6 transition addresses 
- Decode embedded IPv4 from NAT64 well-known and local-use prefixes
- Reapply private and reserved IPv4 policy to 6to4 destinations
- Fail closed on malformed RFC 6052 local-use encodings
 2026-09-20 18:14:12 +02:00
Jakub Zych
1cd76fcd95 test(06-08): add failing transition address regressions 
- Cover private and public IPv4 embeddings across NAT64 and 6to4
- Exercise unsafe transition literals through the production dial control
- Require classifier-owned IPv4-mapped normalization
 2026-09-20 17:15:57 +02:00
Jakub Zych
3601a0ab09 docs(06-07): update plan tracking 2026-09-20 17:12:31 +02:00
Jakub Zych
bc43e9eabd docs(06-07): complete atomic limiter admission plan 
Tasks completed: 1/1
- Make fixed-window admission atomic and inline keys server-controlled

SUMMARY: .planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-07-SUMMARY.md
 2026-09-20 17:10:43 +02:00
Jakub Zych
6852a8f8c3 fix(06-07): make limiter admission atomic 
- Replace split store checks with one mutex-guarded Attempt operation
- Use domainless trusted-client keys for anonymous inline throttles
- Preserve fixed-window headers, expiry, stacking, and principal isolation
 2026-09-20 17:02:53 +02:00
Jakub Zych
5bcd7ba011 test(06-07): add failing atomic limiter regressions 
- Coordinate concurrent store and middleware attempts behind start barriers
- Prove Host rotation and inline policy changes share anonymous budgets
 2026-09-20 17:00:28 +02:00
Jakub Zych
47e9c44b2a docs(06): create gap closure plans 2026-09-20 16:14:21 +02:00
Jakub Zych
c187d6f735 docs(06): reopen phase after verification gaps 2026-09-20 14:00:36 +02:00
Jakub Zych
dd78e0d6b3 docs(06): record gap-closure re-verification 2026-09-20 13:57:07 +02:00
Jakub Zych
067a3ffb2b docs(06): add code review report 2026-09-20 13:49:19 +02:00
Jakub Zych
3c57a88344 chore(gsd): disable unsupported worktree isolation 2026-09-20 13:33:17 +02:00
Jakub Zych
f5fd55f419 docs(06-06): update plan tracking 2026-09-20 13:33:11 +02:00
Jakub Zych
7f627961b1 docs(06-06): complete personal-token rate-limit gap plan 2026-09-20 13:31:41 +02:00
Jakub Zych
3423da2222 docs(06-06): extend security review through gap closure 2026-09-20 13:30:41 +02:00
Jakub Zych
da8f247065 docs(06): finalize gap-closure plan 2026-09-20 00:19:53 +02:00
Jakub Zych
b20466d2e2 fix(06): revise gap plan security coverage and full gates 2026-09-20 00:14:58 +02:00
Jakub Zych
a61c83e614 fix(06): resolve research questions 2026-09-19 23:13:24 +02:00
Jakub Zych
2f90fef830 docs(06): add rate-limit middleware gap plan 2026-09-19 23:07:43 +02:00
Jakub Zych
cb34de4203 docs(phase-06): mark progress table as gaps found 2026-09-19 21:44:36 +02:00
Jakub Zych
59d9a26aad docs(phase-06): record verification gaps and reopen phase 2026-09-19 21:44:26 +02:00
Jakub Zych
73218c0781 docs(06): add code review report 2026-09-19 21:32:41 +02:00
Jakub Zych
b759669f23 docs(06-05): complete unit coverage and security-review plan 2026-09-19 21:21:42 +02:00
Jakub Zych
74d1eb37a0 docs(06-05): map every T-06-xx threat to a passing test or restated accept 
- 19-row register T-06-01 through T-06-18 plus T-06-SC
- mitigate rows name file:TestName; accept rows copy originating rationale
- grep: no bearer/hash logging; inv.must-change-password only in HouseMiddlewares
 2026-09-19 21:15:24 +02:00
Jakub Zych
98dd09847a test(06-05): close framework coverage gaps in bouncer, surf, wire, fetchguard 
- Registry neither-interface, nil-registry, and authenticate default
- MemoryStore sweep actually drops expired entries
- RegisterHouseMiddlewareFactory duplicate-name failure
- pathScopedCORS unmatched path plus empty-raw-group introspection
- Time UnmarshalJSON +00:00/Z and PublicOnlyMode host/IP cases
 2026-09-19 21:08:04 +02:00
Jakub Zych
f61776d0a6 docs(06-03): complete raw groups, wire, CORS, and body-limit plan 
- Operator-confirmed 128MiB body limits (134217728); D-18/T-06-13 closed
- HTTP-06, HTTP-08, HTTP-09 marked complete
 2026-09-19 21:01:07 +02:00
Jakub Zych
30539b954f feat(06-03): add path-scoped CORS and per-route body limits 
- CORS matches Laravel path globs (api/* includes nested segments); unlisted paths get no headers
- Non-raw routes wrap http.MaxBytesReader from http.body_limits.default_bytes; body.limit:N overrides innermost
- Raw routes stay uncapped at this layer
 2026-09-19 20:10:02 +02:00
Jakub Zych
9ecf2d1868 feat(06-03): add wire JSON helpers, Time, TriBool, and Slice 
- WriteJSON matches genre_controller byte-for-byte (SetEscapeHTML false, trim trailing newline)
- Time marshals Carbon +00:00 never Z; TriBool nulls when invalid; Slice never returns nil
 2026-09-19 20:01:27 +02:00
Jakub Zych
fa7e6d1870 feat(06-03): add raw groups, house middleware, and route:list 
- GroupRaw plus sticky raw inheritance and registration-time house-envelope refusal via pact.HasHouseMiddleware
- Recover on raw routes writes a bare 500; non-raw keeps the house JSON body
- Router.Routes() and surf.RouteListCommand; generated main registers route:list
 2026-09-19 19:55:32 +02:00
Jakub Zych
42b8295cc1 docs(06-02): complete fixed-window limiter and five-bucket plan 2026-09-19 19:46:28 +02:00
Jakub Zych
ab20ad0f9c docs(06-02): correct HTTP-04 named bucket count to five 
- ROADMAP Phase 6 success criterion 2 and REQUIREMENTS HTTP-04 said seven
- D-01: routes.php defines five fonoteka-* buckets plus inline throttle:N,M
 2026-09-19 19:42:23 +02:00
Jakub Zych
68c6ab85c5 feat(06-02): add fixed-window limiter, Store, and ClientIP 
- MemoryStore mirrors Laravel tooManyAttempts-before-hit first-hit-wins
- FixedWindowLimiter + throttle factory; success and 429 rate-limit headers
- Trusted-proxy ClientIP; remove noOpLimit; keep Limiter interface seam
 2026-09-19 19:35:53 +02:00
Jakub Zych
e2aba0ebf0 docs(phase-06): update tracking after wave 1 2026-09-19 19:28:18 +02:00
Jakub Zych
bc17c3decb chore: merge executor worktree (worktree-agent-01a0ba96) 2026-09-19 19:26:53 +02:00
Jakub Zych
1f56a9ee1c docs(06-01): complete guard registry and dual-group genres plan 2026-09-19 19:24:03 +02:00
Jakub Zych
cca4ec3a8b docs(06-04): complete SSRF-guarded fetch helper plan 
- Record fetchguard.Fetch dial-time SSRF helper, typed reasons, and TDD commits
 2026-09-19 19:03:20 +02:00
Jakub Zych
7923fe86c7 feat(06-04): implement dial-time SSRF-guarded Fetch 
- AllowHosts exact/dotted-suffix and PublicOnly modes, https-only
- Private/reserved IP check at net.Dialer.Control, no redirects
- Streaming io.LimitReader byte cap and typed failure reasons
 2026-09-19 19:02:12 +02:00
Jakub Zych
bae9de8788 test(06-04): add failing tests for SSRF-guarded Fetch 
- Cover host allow-list, dotted-suffix bypass, dial-time private IP
- Cover no-follow redirects, streaming byte cap, and D-14 config defaults
 2026-09-19 19:00:01 +02:00
Jakub Zych
d376b1be2d feat(06-01): grow router verbs, factories, and guard registry 
- Add Post/Put/Patch/Delete on pact.Router and surf Router/Group
- Resolve name:param middleware via RegisterMiddlewareFactory
- Add bouncer.Registry with Guard, CredentialGuard, UnauthorizedWriter
- Re-express jwt as NewJWTGuard without changing Middleware bodies
 2026-09-19 18:59:12 +02:00
Jakub Zych
d3630e7de0 feat(06-04): implement private/reserved IP classification table 
- Port PHP PRIVATE_V4_CIDRS and PRIVATE_V6_PREFIXES onto netip.Prefix
- Fail closed on invalid addresses; Unmap remains the caller's job
 2026-09-19 18:57:44 +02:00
Jakub Zych
f7e7ca7fa3 test(06-04): add failing test for private/reserved IP table 
- Table-driven cases port PHP PRIVATE_V4_CIDRS/PRIVATE_V6_PREFIXES
- Document Unmap() as the caller responsibility for v4-mapped literals
 2026-09-19 18:57:18 +02:00
Jakub Zych
ecab09c37a docs(06): finalize phase plan after verification 2026-09-19 17:16:58 +02:00
Jakub Zych
ad3d6f7f84 docs(06): revision pass 1 - resolve Limiter naming collision and add plugin-facing house-middleware capability 2026-09-19 17:13:02 +02:00
Jakub Zych
c4f406bb64 docs(06): create phase plan 2026-09-19 16:58:48 +02:00
Jakub Zych
6a9f5e1b47 docs(05): add code review fix report 2026-09-19 15:41:27 +02:00