fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

internal/infrastructure/config/settings.go

@@ -9,11 +9,12 @@ import (
 )
 
 type SmtpSettings struct {
-	Login    string
-	Sender   string
-	Password string
-	Host     string
-	Port     int
+	Login         string
+	Sender        string
+	Password      string
+	Host          string
+	Port          int
+	AllowInsecure bool
 }
 
 type AuthRateLimitSettings struct {
@@ -55,11 +56,21 @@ func (s Settings) IsProduction() bool {
 }
 
 func NewSettingsFromEnv() (Settings, error) {
+	jwtSecret, err := jwtSecretFromEnv()
+	if err != nil {
+		return Settings{}, err
+	}
+
 	smtpPort, err := intEnv("SMTP_PORT")
 	if err != nil {
 		return Settings{}, err
 	}
 
+	smtpAllowInsecure, err := boolEnv(EnvSmtpAllowInsecure, DefaultSmtpAllowInsecure)
+	if err != nil {
+		return Settings{}, err
+	}
+
 	authRateLimitMaxAttempts, err := intEnv("AUTH_RATE_LIMIT_MAX_ATTEMPTS")
 	if err != nil {
 		return Settings{}, err
@@ -100,18 +111,19 @@ func NewSettingsFromEnv() (Settings, error) {
 		CorsAllowedOrigins: parseSemicolonSeparatedList(os.Getenv("CORS_ALLOWED_ORIGINS")),
 		PublicURL:          os.Getenv("PUBLIC_URL"),
 		UploadDir:          os.Getenv("UPLOAD_DIR"),
-		JWTSecret:          os.Getenv("JWT_SECRET"),
+		JWTSecret:          jwtSecret,
 		DBFile:             os.Getenv("DB_FILE"),
 		Database:           database,
 		Storage:            storage,
 		DataDirPath:        os.Getenv("DATA_DIR"),
 		Port:               os.Getenv("PORT"),
 		Smtp: SmtpSettings{
-			Login:    os.Getenv("SMTP_LOGIN"),
-			Sender:   os.Getenv("SMTP_SENDER"),
-			Password: os.Getenv("SMTP_PASSWORD"),
-			Host:     os.Getenv("SMTP_HOST"),
-			Port:     smtpPort,
+			Login:         os.Getenv("SMTP_LOGIN"),
+			Sender:        os.Getenv("SMTP_SENDER"),
+			Password:      os.Getenv("SMTP_PASSWORD"),
+			Host:          os.Getenv("SMTP_HOST"),
+			Port:          smtpPort,
+			AllowInsecure: smtpAllowInsecure,
 		},
 		AuthRateLimit: AuthRateLimitSettings{
 			MaxAttempts: authRateLimitMaxAttempts,