popertotsandSisyphus 4d179385e8 test: security regression — IDOR payment-check scoping, CORS preflight 403, rate limiter pruning, services error leakage ...

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

2026-08-22 00:34:51 +01:00

..

admin_bookings_test.go

test: add coverage tests across backend + fix mock for PENDING checkout support

2026-07-10 18:13:44 +01:00

admin_cancel_reservation_test.go

chore: run go fix for Go 1.26 modernization

2026-07-09 17:25:23 +01:00

admin_cancel_reservation.go

feat(api): add admin reservation cancel endpoint

2026-07-06 17:58:03 +01:00

admin_reserve_test.go

chore: run go fix for Go 1.26 modernization

2026-07-09 17:25:23 +01:00

admin_reserve.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

bookings_coverage_test.go

fix: restore dead functions properly, match test expectations, fix vet/lint

2026-07-11 13:23:27 +01:00

bookings_test.go

test: security regression — IDOR payment-check scoping, CORS preflight 403, rate limiter pruning, services error leakage

2026-08-22 00:34:51 +01:00

bookings.go

fix: security — CORS preflight origin gating, IDOR payment-existence check scoped to user, per-IP anonymous reservation cap

2026-08-22 00:34:51 +01:00

cancel_reservation_test.go

chore: run go fix for Go 1.26 modernization

2026-07-09 17:25:23 +01:00

cancel_reservation.go

feat: add cancel reservation handler and background cleanup

2026-07-05 11:47:54 +01:00

closing_time_test.go

feat: add getClosingTimeForDate to check staged default hours for bookings

2026-08-22 00:34:48 +01:00

closing_time.go

feat: add getClosingTimeForDate to check staged default hours for bookings

2026-08-22 00:34:48 +01:00

coverage_improvements_test.go

test: add coverage tests across backend + fix mock for PENDING checkout support

2026-07-10 18:13:44 +01:00

dedup_test.go

chore: run go fix for Go 1.26 modernization

2026-07-09 17:25:23 +01:00

deposit_test.go

Close refund system and gate raw-PAN card entry

2026-08-22 00:34:49 +01:00

discount_test.go

fix: review-loop A — discount credit on admin payments, campaign over-credit cap, sweep replay window, dedup refund revalidation, duplication/modularisation, GBP pence naming

2026-08-22 00:34:50 +01:00

dst_timezone_test.go

Gift-card rolling expiry, SvelteDate→Date purge, strict DST tests, UTC scan-location + settings legal floor

2026-08-22 00:34:49 +01:00

edit_requests_test.go

fix: payments review rounds — money-safety, GDPR, security, gift-card cancel, modal stacking

2026-08-22 00:34:50 +01:00

manage.go

fix: booking hardening — notification flood caps (C5) + pending-release eviction refunds (C4)

2026-08-22 00:34:50 +01:00

overlap_test.go

fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

2026-08-22 00:34:50 +01:00

repo_test.go

test: add coverage tests across backend + fix mock for PENDING checkout support

2026-07-10 18:13:44 +01:00

repo.go

feat(bookings): add closing_time validation and repo layer

2026-06-24 23:43:23 +01:00

reserve_test.go

chore: run go fix for Go 1.26 modernization

2026-07-09 17:25:23 +01:00

reserve.go

fix: security — CORS preflight origin gating, IDOR payment-existence check scoped to user, per-IP anonymous reservation cap

2026-08-22 00:34:51 +01:00

testmain_test.go

chore: run go fix for Go 1.26 modernization

2026-07-09 17:25:23 +01:00

trigger_test.go

chore: run go fix for Go 1.26 modernization

2026-07-09 17:25:23 +01:00