popertots af685df40c test: rate-limit proxy-header trust (TRUST_PROXY_HEADERS) coverage ...

Tests lock the TRUST_PROXY_HEADERS behavior: a trusted CF-Connecting-IP
becomes the rate-limit key (per-IP and per-user+IP), an origin-exposed header
on an untrusted proxy is ignored, and the unauthenticated per-user limiter
honors header mode. Mirrors the middleware contract (finding 4a / Loop B).

2026-08-22 00:34:50 +01:00

..

auth_test.go

Block guest-role tokens from online payment routes (RequireNonGuest middleware)

2026-08-22 00:34:49 +01:00

auth.go

Block guest-role tokens from online payment routes (RequireNonGuest middleware)

2026-08-22 00:34:49 +01:00

contenttype_test.go

chore: run go fix for Go 1.26 modernization

2026-07-09 17:25:23 +01:00

contenttype.go

feat(mw): add content-type and response middleware

2026-06-24 23:42:57 +01:00

ratelimit_dev_test.go

fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

2026-08-22 00:34:50 +01:00

ratelimit_dev.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

ratelimit_prod_test.go

fix: remove rate limiter dev stub, consolidate tests under all build tags

2026-07-11 14:41:58 +01:00

ratelimit_shared_test.go

fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

2026-08-22 00:34:50 +01:00

ratelimit_shared.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

ratelimit_test.go

test: rate-limit proxy-header trust (TRUST_PROXY_HEADERS) coverage

2026-08-22 00:34:50 +01:00

ratelimit.go

fix: round-2 loop-B adversarial (503c326 baseline) — B1 webhook race, APPROVED refund semantics, notification cap single-source, 2FA cooldown/StateFor hardening, register bcrypt semaphore

2026-08-22 00:34:50 +01:00

response_test.go

test: add coverage tests across backend + fix mock for PENDING checkout support

2026-07-10 18:13:44 +01:00

response.go

fix: replace silent json.Encode with error-logging pattern across all handlers

2026-07-11 17:50:07 +01:00