popertots 8d9f72b9f0 feat: CardDAV profile sync writes through dav.Service (photo included, DAV_BASE_URL retired) ...

- profile.go updateCardDAV now writes directly to the shared dav_cards table via
  dav.Service (mirroring registration) instead of PUTting a vCard to
  DAV_BASE_URL over HTTP — the Go backend no longer needs the SabreDAV URL,
  only the sabredav PHP container uses the server-side credential.
- dav/types.go: ContactInput gains PhotoURL; GenerateVCard emits the
  PHOTO;VALUE=URI line when set, so the profile photo syncs into the address
  book. DAV_BASE_URL is retained in .env.example for reference only.

2026-08-22 00:34:50 +01:00

..

auth

fix: round-2 loop-B adversarial (503c326 baseline) — B1 webhook race, APPROVED refund semantics, notification cap single-source, 2FA cooldown/StateFor hardening, register bcrypt semaphore

2026-08-22 00:34:50 +01:00

clock

Gift-card rolling expiry, SvelteDate→Date purge, strict DST tests, UTC scan-location + settings legal floor

2026-08-22 00:34:49 +01:00

db

Gift-card rolling expiry, SvelteDate→Date purge, strict DST tests, UTC scan-location + settings legal floor

2026-08-22 00:34:49 +01:00

handlers

feat: CardDAV profile sync writes through dav.Service (photo included, DAV_BASE_URL retired)

2026-08-22 00:34:50 +01:00

internal

feat: CardDAV profile sync writes through dav.Service (photo included, DAV_BASE_URL retired)

2026-08-22 00:34:50 +01:00

mw

fix: round-2 loop-B adversarial (503c326 baseline) — B1 webhook race, APPROVED refund semantics, notification cap single-source, 2FA cooldown/StateFor hardening, register bcrypt semaphore

2026-08-22 00:34:50 +01:00

testutils

fix: SCA review round + gitea pipeline green — GDPR audit scrub, backend test gaps, frontend SCA/Square-API, docs parity

2026-08-22 00:34:50 +01:00

.golangci.yml

fix: SCA review round + gitea pipeline green — GDPR audit scrub, backend test gaps, frontend SCA/Square-API, docs parity

2026-08-22 00:34:50 +01:00

Dockerfile

fix: review round 7 — fresh-eyes audit fixes (6 agents) + full test suites for every backend change

2026-08-22 00:34:49 +01:00

go.mod

fix: SCA review round + gitea pipeline green — GDPR audit scrub, backend test gaps, frontend SCA/Square-API, docs parity

2026-08-22 00:34:50 +01:00

go.sum

fix: SCA review round + gitea pipeline green — GDPR audit scrub, backend test gaps, frontend SCA/Square-API, docs parity

2026-08-22 00:34:50 +01:00

main_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

main.go

feat: SCA-only saved-card charges — 2FA charge fallback removed (C6), versioned consent fields, token provenance

2026-08-22 00:34:50 +01:00

run-tests.sh

Fix review findings: aggregated-refund/saved-card/legacy-refund idempotency keys, structured Square error classification, CSP for Square SDK

2026-08-22 00:34:49 +01:00

testmain_test.go

…