popertots and Sisyphus
306f942d00
feat(mw): add dev-mode rate limiting bypass
...
Add build tag split: real rate limiter under !dev, no-op under dev build tag.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-05-31 18:48:53 +01:00
popertots and Sisyphus
700b7c1152
fix: extract client IP via net.SplitHostPort consistently
...
Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-05-31 10:55:23 +01:00
popertots and Sisyphus
2ba7b85d0b
feat: add OptionalAuth middleware and slot reservation endpoint
...
OptionalAuth extracts user info from Bearer token if present,
otherwise passes through without requiring authentication.
ReserveSlotHandler creates temporary time_blockers reservations:
- Logged-in users: max 1 active, 1hr TTL, tracked by user_id
- Anonymous users: global cap of 50, 10min TTL, tracked by IP hash
- Validates slot availability (working hours, booking overlap, blocker overlap)
- Returns reservation ID, start_time, duration, and expires_at
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent )
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai >
2026-04-29 22:56:53 +01:00
popertots
b4d91d5dc0
Security pass
2026-02-20 12:59:10 +00:00
popertots
f9eec94f2f
Security: add rate limiting, input validation, and filter category
...
validation
Backend:
- Add rate limiting middleware (mw/ratelimit.go) - in-memory per-IP
limiter
- Apply rate limits per endpoint group:
- Public read-only: 120/min
- Registration: 10/min
- Portfolio filters: 60/min
- Authenticated users: 120/min
- Admin: none (trusted)
- Add 256 char input length validation on portfolio endpoints
- Validate filter categories exist in DB before querying
- Secure GetImage endpoint: only allow UUID or numeric timestamp (15-20
digits)
- Remove pattern-based image lookup to prevent enumeration
- Add services validation: name (100), duration (1-480), patch test
(0-168)
Frontend:
- Add maxlength=256 to portfolio tag/search inputs
- Add maxlength to registration: name (50), email (255), phone (20),
password (72)
- Add maxlength=100 to service name input
2026-02-20 12:03:05 +00:00
popertots
708b741a32
Initial commit. Working login, example UI with prototype and demo, connections to DB and DAV, local and prod setups.
2025-10-12 22:13:19 +01:00
popertotsandSisyphus