fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

internal/domain/user/userDomain.go

@@ -18,9 +18,19 @@ var ErrInvalidDisplayName = errors.New("invalid display name")
 var ErrUsernameTaken = errors.New("username taken")
 var ErrInvalidLookup = errors.New("invalid user lookup")
 var ErrVerificationEmailNotSent = errors.New("verification email not sent")
+var ErrPasswordTooLong = errors.New("password too long")
 
 const MaxLookupIDs = 100
 
+const MaxPasswordBytes = 72
+
+func ValidatePassword(password string) error {
+	if len(password) > MaxPasswordBytes {
+		return ErrPasswordTooLong
+	}
+	return nil
+}
+
 type Role string
 
 const (
@@ -45,6 +55,22 @@ type User struct {
 	UpdatedAt               time.Time `json:"updated_at"`
 }
 
+const UnverifiedRetention = 7 * 24 * time.Hour
+
+func (u User) IsStaleUnverifiedAt(now time.Time) bool {
+	if u.IsVerified {
+		return false
+	}
+	deadline := u.VerificationExpiration
+	if deadline.IsZero() {
+		deadline = u.CreatedAt
+	}
+	if deadline.IsZero() {
+		return false
+	}
+	return now.After(deadline.Add(UnverifiedRetention))
+}
+
 func (u User) NameOrUsername() string {
 	if trimmed := strings.TrimSpace(u.DisplayName); trimmed != "" {
 		return trimmed