  popertotsandSisyphus
|
6064a06b7d
|
refactor: extract shared rate limiter types into ratelimit_shared.go
Move RateLimiter, ProgressiveRateLimiter, and cleanup functions to ratelimit_shared.go. Add dev and prod rate limiter tests. Remove inline cleanup goroutines.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
|
2026-07-07 00:09:43 +01:00 |
|
|
popertotsandSisyphus
|
e4b9003439
|
refactor(handlers): migrate remaining backend handlers to clock.Now() and transaction patterns
Apply clock.Now() migration, transaction wrapping, and minor refactors across admin, scheduling, today, user, auth handler, notifications, webhooks, services, portfolio, ratelimit, testutils, and main.go.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
|
2026-06-24 23:43:50 +01:00 |
|
|
popertotsandSisyphus
|
b253ab9732
|
feat(backend): update rate limiting middleware
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
|
2026-06-18 16:26:06 +01:00 |
|
|
popertotsandSisyphus
|
306f942d00
|
feat(mw): add dev-mode rate limiting bypass
Add build tag split: real rate limiter under !dev, no-op under dev build tag.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
|
2026-05-31 18:48:53 +01:00 |
|
|
popertotsandSisyphus
|
700b7c1152
|
fix: extract client IP via net.SplitHostPort consistently
Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
|
2026-05-31 10:55:23 +01:00 |
|
|
popertots
|
b4d91d5dc0
|
Security pass
|
2026-02-20 12:59:10 +00:00 |
|
|
popertots
|
f9eec94f2f
|
Security: add rate limiting, input validation, and filter category
validation
Backend:
- Add rate limiting middleware (mw/ratelimit.go) - in-memory per-IP
limiter
- Apply rate limits per endpoint group:
- Public read-only: 120/min
- Registration: 10/min
- Portfolio filters: 60/min
- Authenticated users: 120/min
- Admin: none (trusted)
- Add 256 char input length validation on portfolio endpoints
- Validate filter categories exist in DB before querying
- Secure GetImage endpoint: only allow UUID or numeric timestamp (15-20
digits)
- Remove pattern-based image lookup to prevent enumeration
- Add services validation: name (100), duration (1-480), patch test
(0-168)
Frontend:
- Add maxlength=256 to portfolio tag/search inputs
- Add maxlength to registration: name (50), email (255), phone (20),
password (72)
- Add maxlength=100 to service name input
|
2026-02-20 12:03:05 +00:00 |
|