fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

test/verified_account_required_http_test.go

@@ -269,13 +269,29 @@ func TestVerifiedAccountRequiredHttp(t *testing.T) {
 		assertOnlyArticleOneListed(t, rec)
 	})
 
+	t.Run("Listing hides offline articles from a verified caller whose token is stale", func(t *testing.T) {
+		articleRepo := seedListingArticleRepo()
+		userRepo := seedVerifiedAccountRequiredUserRepo(true)
+		stale := userRepo.users[1]
+		stale.TokenVersion = 1
+		userRepo.users[1] = stale
+		router := newVerifiedAccountRequiredRouter(articleRepo, userRepo, token)
+
+		req := newVerifiedAccountRequiredRequest(http.MethodGet, "/v1/article/", "")
+		req.AddCookie(mintVerifiedAccountRequiredCookie(t, token, map[string]any{"user_id": uint32(1), "token_version": 0}))
+		rec := httptest.NewRecorder()
+		router.ServeHTTP(rec, req)
+
+		assertOnlyArticleOneListed(t, rec)
+	})
+
 	t.Run("Listing still returns every article for an authenticated and verified caller", func(t *testing.T) {
 		articleRepo := seedListingArticleRepo()
 		userRepo := seedVerifiedAccountRequiredUserRepo(true)
 		router := newVerifiedAccountRequiredRouter(articleRepo, userRepo, token)
 
 		req := newVerifiedAccountRequiredRequest(http.MethodGet, "/v1/article/", "")
-		req.AddCookie(mintVerifiedAccountRequiredCookie(t, token, map[string]any{"user_id": uint32(1)}))
+		req.AddCookie(mintVerifiedAccountRequiredCookie(t, token, map[string]any{"user_id": uint32(1), "token_version": 0}))
 		rec := httptest.NewRecorder()
 		router.ServeHTTP(rec, req)