 Florian Sylvain
|
ea98c5ec05
|
fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)
|
2026-10-22 00:49:19 +02:00 |
|
|
Florian Sylvain
|
c68e9a7858
|
refac: removed 7 direct and 12 indirect go modules for custom code instead
|
2026-10-21 23:13:46 +02:00 |
|
 fsylvain
|
e37a46a027
|
feat: activity log producers
|
2026-10-06 22:25:23 +02:00 |
|
|
fsylvain
|
50b1649965
|
feat: activity log backend foundation
|
2026-10-06 20:35:03 +02:00 |
|
|
fsylvain
|
9b47685002
|
refac: split the auth handler into registration and login, account verification, and password reset handlers, each with its own dependencies
|
2026-09-25 06:14:53 +02:00 |
|
|
fsylvain
|
3282b0580c
|
fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id
|
2026-09-25 05:58:37 +02:00 |
|
|
fsylvain
|
aa865af2e9
|
refac: reamaining auth surface rewrite, T0
|
2026-09-24 05:11:49 +02:00 |
|
|
fsylvain
|
6d510d2805
|
refac: register only open while no verified acc exists, enforced by a use case rather than handler & sends verification email whose link uses the conf pub URL whose code expires after 2h
|
2026-09-24 03:36:37 +02:00 |
|
|
fsylvain
|
0b4e614ec9
|
refac: runtime settings are read once at startup and passed in through the composition root; no handler, router or repository reads environment variables
|
2026-09-24 01:30:00 +02:00 |
|
|
fsylvain
|
ff8cd5f0ec
|
refac: password and code hashing & checking go through a domain hasher interface used by the use cases instead of bcrypt in the user repository and the auth handler
|
2026-09-23 19:29:20 +02:00 |
|