golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
368 Commits 1 Branch 2 Tags
d27f442c4991bcd7a2c11f13f84ca5724f709c0f
Commit Graph

34 Commits

Author SHA1 Message Date
Jakub Zych
06a7292dea feat(09-02): implement exact backend identity migrations 
- Add the admin jti table, reset cutoff, and Winter indexes without AutoMigrate
- Reapply the developer and publisher seed idempotently and allow repeated role codes
 2026-09-24 17:40:34 +02:00
Jakub Zych
448faa465f test(09-02): add failing tests for backend identity migrations 
- Fresh migrate is missing tokens_valid_after and the admin blacklist table
- Reapplying the seed is not idempotent and role codes reject Winter duplicates
 2026-09-24 17:38:53 +02:00
Jakub Zych
dfa00f7e3a feat(09-01): implement separate-admin genre list tracer 
- Audience-aware mint, verify, refresh, and backend guard keep frontend tokens compatible
- Cabana mounts raw admin login, list schema, and record list behind admin.jwt.secret
- Framework migration seeds Winter backend users and developer/publisher roles
 2026-09-24 17:17:19 +02:00
Jakub Zych
31634f706f feat(07-07): localize lagoon validation with Laravel-shaped Polish messages 
Replay of the user-api corpus needs lagoon::validate.* catalogs and
underscore-to-space attribute names so Go 422 bodies match Winter.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-22 23:56:58 +02:00
Jakub Zych
8fcaff77cf feat(07-01): add bcrypt, locale override, and validation rules 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-22 13:39:25 +02:00
Jakub Zych
bccd7f8f35 test(07-01): add failing tests for passwords, locale, and validation 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-22 13:36:08 +02:00
Jakub Zych
56156ae7c3 fix(05): WR-05 gate public file serving on is_public 2026-09-19 15:39:19 +02:00
Jakub Zych
c12e6576f6 fix(05): WR-04 default File.IsPublic to true without trapping false 2026-09-19 15:39:19 +02:00
Jakub Zych
fb12b2237d fix(05): WR-03 numeric between/min/max without omitempty or length tags 2026-09-19 15:39:19 +02:00
Jakub Zych
e54f9d7f10 fix(05): WR-02 delete thumb blob after a failed encode 2026-09-19 15:39:19 +02:00
Jakub Zych
c211822448 fix(05): WR-01 bound thumb dimensions and decoded image size 2026-09-19 15:39:19 +02:00
Jakub Zych
44126cc935 fix(05): CR-01 serve thumb URLs from the validated path key 2026-09-19 15:39:19 +02:00
Jakub Zych
c84869270e test(05): WR-05 pin that the thumb delete prefix is ID-delimited 2026-09-18 23:48:49 +02:00
Jakub Zych
ced87a5608 fix(05): WR-04 restrict thumb mode and ext to [a-z0-9]+ before building blob keys 2026-09-18 23:48:22 +02:00
Jakub Zych
6d2262d95f fix(05): WR-02 fill Encrypted columns from plaintext, never Scan request input 2026-09-18 23:47:28 +02:00
Jakub Zych
3943ea3a2e fix(05): CR-01 accept pointer and whole JSON numbers in integer rule 2026-09-18 23:41:57 +02:00
Jakub Zych
1fcf5abcdf test(05-06): assert HasHidden fields never marshal 
- Fixture model with json:\"-\" keeps the sentinel out of JSON
- Registered-model walk stays in fonoteka.go so the framework stays app-agnostic
 2026-09-18 20:48:21 +02:00
Jakub Zych
7ead5e0c2f test(05-06): add lagoon.Fill fuzz test 
- FuzzFill seeds extra and server-owned keys against a fixture struct
- Non-allow-listed fields stay at their pre-Fill values with zero panics
 2026-09-18 20:45:52 +02:00
Jakub Zych
4df7e016a2 feat(05-05): accept boolean validation token 
- Treat Laravel boolean as a type-check no-op in lagoon.Validate
- Settings.search_use_typesense uses this rule string
 2026-09-18 20:14:46 +02:00
Jakub Zych
d8ecb41981 feat(05-04): add attach delete lifecycle and static file handler 
- DeleteForOwner removes system_files rows in-tx; blobs after commit
- Soft-delete of an owner keeps rows and blobs
- StaticHandler serves exact partition+disk_name keys and 404s traversal
 2026-09-18 20:00:31 +02:00
Jakub Zych
ba9c99246e feat(05-04): implement attach File, Thumb, blob bucket, system_files migration 
- Winter-exact thumb filename and 3x3 partition with lazy imaging resize
- gocloud.dev/blob fileblob/memblob; empty bucket_url fails boot
- lagoon.Migrate runs system_files before every plugin set
 2026-09-18 19:55:15 +02:00
Jakub Zych
2d84ae4565 test(05-04): add failing tests for attach File, Thumb, and bucket 
- ThumbFilename/PartitionDirectory/File.Thumb behavior tests
- OpenBucket fail-loud and memblob tests
- Migrate empty plugin list must create system_files
 2026-09-18 19:53:00 +02:00
Jakub Zych
8d9109a771 feat(05-03): implement lagoon.Encrypted, key:generate, Laravel decrypt helper 
- AES-256-GCM with stdlib HKDF column keys and previous_keys fallback
- Fail-loud LoadAppKey, redacting marshal paths, key:generate via crypto/rand
- Standalone DecryptLaravelPayload unwired from Scan/Value
 2026-09-18 19:35:24 +02:00
Jakub Zych
06bad37c24 test(05-03): add failing tests for Encrypted, key:generate, Laravel decrypt 
- Round-trip, fresh nonce, redaction, previous_keys fallback
- LoadAppKey rejects empty/short/undecodable keys
- key:generate prints 32-byte base64; DecryptLaravelPayload fixture
 2026-09-18 19:32:30 +02:00
Jakub Zych
2c5d92d659 feat(05-02): add lagoon.Validate rule-string engine 
- Translate Laravel rule strings onto validator.Var and unique:table
- Custom money range via big.Rat; unique checks skip soft-deleted rows
- Fill zeros nil values and Scans jsonable columns
 2026-09-18 19:22:04 +02:00
Jakub Zych
20b0199579 feat(05-02): add lagoon.Jsonable TEXT cast 
- Scanner/Valuer JSON-text column preserving SQL NULL vs empty array
- Generic struct with gorm-ignored inner fields so GORM does not walk Data
 2026-09-18 19:12:33 +02:00
Jakub Zych
52638fb4e3 feat(05-01): add Paginate envelope and RegisterJoinTable 
- Page/PageMeta emit {data, meta} with no links key
- RegisterJoinTable fails loud on nil db; document pivot-write contract
 2026-09-18 18:47:42 +02:00
Jakub Zych
969a5f522a feat(05-01): implement Fill, hook interfaces, and cascade helper 
- Allow-list copy with once-per-key non-production dropped-key log
- Winter-named Has* hook interfaces; WithSoftDeleteCascade names the tx
 2026-09-18 18:46:37 +02:00
Jakub Zych
fec23e21c2 test(05-01): add failing tests for Fill and lifecycle cascade 
- Fill allow-list, once-per-key dropped log, production silence
- BeforeCreate fires on real Postgres; cascade rollback on error
 2026-09-18 18:45:46 +02:00
Jakub Zych
92255a46ed test(03-04): cover framework database, routing and JWT boundaries 
- Shared pgx/GORM pool, ICU locale fail, and isolated plugin migrations
- Seven-stage middleware order, missing-guard boot failure, typed 404s
- Adversarial JWT matrix including alg:none, empty secret, and no leak

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-17 20:29:46 +02:00
Jakub Zych
8e3bf266d8 feat(03-03): add typed path params and per-plugin rollback 
Compile regex and enum constraints at route registration so malformed and unknown IDs share a 404, and named rollback errors isolate one plugin's history.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-17 20:19:59 +02:00
Jakub Zych
56be82f3f3 feat(03-02): add allow-listed database-default order helper 
- Reject identifiers and directions outside the caller allow-list
- Emit ordinary ORDER BY without COLLATE so ICU pl-PL applies

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-17 20:13:03 +02:00
Jakub Zych
4ee4c4a2fc feat(03-01): add ServeMux groups, JWT verifier, and serve command 
Named middleware resolves at boot, HS256 tokens are pinned with required
exp/sub, and both binaries expose a signal-aware serve command.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-17 20:04:13 +02:00
Jakub Zych
d0d845052b feat(03-01): add shared postgres pool and plugin migrations 
Open one pgx stdlib *sql.DB, hand it to GORM, and run per-plugin
gormigrate sets with isolated history tables after an ICU pl-PL check.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-17 19:55:33 +02:00