popertotsandSisyphus d90e25d1ff fix: auth/2FA — password change requires 2FA gate, admin self-deletion blocked, twofa JSON responses, per-IP email-verify budget, OptionalAuth log sanitised ...

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

2026-08-22 00:34:51 +01:00

..

auth_test.go

Block guest-role tokens from online payment routes (RequireNonGuest middleware)

2026-08-22 00:34:49 +01:00

auth.go

fix: auth/2FA — password change requires 2FA gate, admin self-deletion blocked, twofa JSON responses, per-IP email-verify budget, OptionalAuth log sanitised

2026-08-22 00:34:51 +01:00

contenttype_test.go

chore: run go fix for Go 1.26 modernization

2026-07-09 17:25:23 +01:00

contenttype.go

feat(mw): add content-type and response middleware

2026-06-24 23:42:57 +01:00

ratelimit_dev_test.go

fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

2026-08-22 00:34:50 +01:00

ratelimit_dev.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

ratelimit_prod_test.go

fix: remove rate limiter dev stub, consolidate tests under all build tags

2026-07-11 14:41:58 +01:00

ratelimit_shared_test.go

fix: adversarial review round — replay-rescue double-charge, discount credit, 2FA/per-IP limits, snapshot encryption, refund reconciliation, VAT, frontend parity, tests+docs

2026-08-22 00:34:50 +01:00

ratelimit_shared.go

fix: dev-mock/prod parity + fail-closed config gates — 402 verification, cnon:sca binding validation, refund reconcile parity, SNAPSHOT_ENC_KEY fail-closed, webhook config gates, access-token startup validation, ClientIP validation

2026-08-22 00:34:51 +01:00

ratelimit_test.go

fix: dev-mock/prod parity + fail-closed config gates — 402 verification, cnon:sca binding validation, refund reconcile parity, SNAPSHOT_ENC_KEY fail-closed, webhook config gates, access-token startup validation, ClientIP validation

2026-08-22 00:34:51 +01:00

ratelimit.go

fix: rate limiter memory pruning in Check(), services error leakage replaced with generic messages

2026-08-22 00:34:51 +01:00

response_test.go

test: add coverage tests across backend + fix mock for PENDING checkout support

2026-07-10 18:13:44 +01:00

response.go

fix: replace silent json.Encode with error-logging pattern across all handlers

2026-07-11 17:50:07 +01:00