With SUMMER_HTTP__ACCESS_LOG off the Go log has no http request records,
and the 5xx scan passed on an empty signal. scan_go_log now also refuses
unless the part of go.log written during this --e2e run (after the offset
taken once the stack is up) has an http request record. Self-test cases:
no records, an empty log, records only before the offset.
--e2e reused any running stack, so Playwright and the go.log scan could
exercise a binary built before the commits under review. A running stack
that dev-stack.sh fresh refuses is now stopped and started again (and left
running), and fresh must pass after up --detach. The self-test plants an
app and framework tree: a newer source or a missing stamp must be
refused, docs, planning files and tests ignored.
The self-test feeds a planted token line through dev-stack.sh redact-seed
and refuses when the secret survives; --e2e refuses unless
tmp/dev-stack/seed.out has mode 600.
The prefix was only trimmed. Without a leading slash ServeMux read its first
segment as a host pattern, so every upload silently answered 404, and a CDN
URL panicked in ServeMux and surfaced as a misleading route conflict. With
storage.uploads.serve on, BuildRouter now refuses a prefix that is not an
absolute URL path (scheme, host, query, fragment, whitespace, wildcard
braces, empty, . or .. segments, or a bare /) with an error naming the key.
The route answered with the blob's stored Content-Type, which attach.Store
sniffs from the bytes, so a public text upload starting with <html> was
served as text/html on the application origin; nosniff does not help when
the declared type is already HTML. Every response now carries a sandboxing
Content-Security-Policy, and a successful response whose type is not a
raster image (JPEG, PNG, GIF, WebP, AVIF) gets Content-Disposition:
attachment, on GET and HEAD. Covers stay inline.
Every 5xx became 499 once the request context was cancelled, so a panic or
a real database error on a request the browser had abandoned passed the
phase gate's 5xx scan. Now a 5xx is logged as 499 only when the client had
already gone when the status was written and the handler did not panic;
recoverJSON and recoverBare mark the access log entry. Every record of an
abandoned request carries client_gone=true. The gate self-test plants a
5xx with client_gone=true and must refuse it.
An unmatched request logged its path. A token route reached with another
method (405) or with a trailing slash (404) is answered by ServeMux before
any route handler records the pattern, so the share or invitation token in
the path reached the log. The record now carries method, pattern, status
and duration only.
- --go: vet and test ./... in summercms.go, the fonoteka.go root module and
the fonoteka plugin module, then the named console, plugin and surf tests
through the skip-intolerant detector
- --parity requires the 175/175 TestParityCorpus summary
- --contracts blocks on the phase's Nuxt contract test and reports the
whole suite (missing-catalog.test.mjs fails on HEAD before this phase)
- --guard plants guard-*.conf env files (:8422, unset internal origin,
mismatched origins, plytarium.com, a fake PHP answer, another backend's
marker) and requires a refusal for each, plus a SummerCMS control case
- --e2e brings the stack up when it is down, runs the Go-gate specs through
e2e-verdict, the D-15 specs report-only, and scans go.log for a search
engine failure or a 5xx record
- --self-test plants Playwright reports, Go logs and TAP summaries
- TestUploadsMount: key off registers nothing; on, a public blob is served
with its content type and nosniff, HEAD has no body, private, missing,
partition and encoded traversal paths 404, an unpublished bucket or
database 404s, a custom prefix is honoured
- mountUploads refuses a plugin route at or under the prefix, so
BuildRouter fails instead of only an identical pattern failing at
Assemble (README and storage docs updated)
- TestAccessLog: pattern and status for 200, handler 404 and recovered
panic, path only for unmatched requests, locale-prefixed requests keep
the pattern, integer duration_ms, no query, header or Authorization
value, ResponseController flush still works
- --self-test plants detector cases for every exit code and checks the modes
- --go runs the named console tests with go -C on the fonoteka.go workspace
A client that goes away mid-request cancels the context; a handler then
fails on context.Canceled and writes a 500 nobody receives. The request
log now records it as 499 (client closed request) so a grep for 5xx shows
real server errors only.
- one Info record "http request" per request with method, matched route
pattern, status and duration_ms; path without the query only when no
route matched
- the matched route records its pattern through a request-scoped entry,
so locale prefix rewrites do not hide it
- logs through the published *slog.Logger or slog.Default; off by default
- surf README, logging and configuration docs describe the key
- surf mounts GET {storage.uploads.public_path_prefix}/{path...} on
attach.StaticHandlerPublic when storage.uploads.serve is true
- bucket and database resolved per request; X-Content-Type-Options: nosniff
- surf README, storage and configuration docs describe the key
- mlLocale: type predicates, localeRecord, the ML_LOCALE_CHANGE broadcast
- MLField: locale switch, whole-map emit, broadcast follow, content-locale
- FileCaptionModal: prefill, save via FileRoutes.update, 422 stays, danger toast
- ApiTokensPanel and ApiTokenCreateDialog mounted directly next to the app tests
- network rule exempts only the line-anchored upload XHR in admin/src/api/files.ts
- api-listing rule exempts only the exact path admin/src/api/files.ts
- self-test plants an XHR elsewhere and an extra admin/src/api file
- The process-global debounce map was keyed by token ID, so a stamp from one test database suppressed a later write in another and turned TestBackendTokenPostgres red depending on order
- Each compositeGuard now owns a stampThrottle; the backend guard and the ResolveBackend guard of one activation share it, so a single-app binary still writes last_used_at at most once a minute per token
- TestTokenLastUsedThrottlePerGuard pins the per-guard isolation
TestMain scanned os.Args for a literal -test.short, but go test passes
-test.short=true, so beachcomber, conga, lagoon and lighthouse started a
Postgres container even under -short. Parse the flags and use
testing.Short() instead; skip cabana's newListService fixture under -short
like adminGorm already does.
- Add TryMap, Filter, Reduce, KeyBy, GroupBy, Uniq, UniqBy, Partition
and Find, plus the Set type built with SetOf (Has, Add, Slice).
- Add unit tests at 100% statement coverage and a runnable example for
every function and Set method.
- Complete the module README: contracts, use cases, Pluck rationale,
standard-library pointers and the full API reference.
- docs/architecture/introduction.md: add a Utilities row for sieve.
- docs/setup/coming-from-wintercms.md: map Laravel collection methods
to sieve and narrow the not-provided row to the fluent collection
object.
