4 Commits

Author	SHA1	Message	Date
Jakub Zych	8d80580083	test(19.3-06): unit tests for the review fixes ... - TestCORSCredentialedOriginRules, TestCORSAnchoredPatternNoSuffixMatch (D-04) - TestAPIDocsCSPNoHostSource (D-17) - TestLoadCookieConfigProductionInferredSecure, TestZeroCookieConfigDefaults (D-03) - TestSiteCachePurgeWaitAndClose, TestSiteCacheBulkCommitCoalesced (D-10)	2026-10-15 22:45:16 +02:00
Jakub Zych	85d8b6a85a	fix(19.3-06): zero CookieConfig writes SameSite=Lax and Secure (WR-09) ... - withDefaults gives the zero config Secure and every unset SameSite Lax; a config with any field set keeps its Secure value	2026-10-15 22:27:31 +02:00
Jakub Zych	4dae8331c5	fix(19.3-06): production refuses an inferred insecure token cookie (WR-05) ... - LoadCookieConfig refuses a Secure that resolves to false in production, also when inferred from an http or unset app.url, naming auth.cookie.secure and app.url	2026-10-15 22:26:43 +02:00
Jakub Zych	619916b5d2	test(19.3-05): phase gate with bouncer cookie and Turnstile unit suites ... - scripts/check-phase19.3.sh: fail-closed gate (go stage, self-test, --all with NOT RUN docker); a required name that fails, skips or is missing fails its stage - cookie_test.go: LoadCookieConfig defaults and errors, TokenCookie attributes and refresh-window Max-Age, forget cookie, refresh and logout handlers with a real Refresh and MemoryBlacklist - turnstile_test.go: open/closed verdict matrix, timeout, form fields, token sources, body restore, statuses and secret-free logs	2026-10-15 19:24:32 +02:00