codegirl007
29b0536215
Address production-readiness review: clearer errors, safer votes, and ops hardening.
...
Distinguish auth/lookup failures, make votes idempotent on visible questions, bound shutdown, page admin users, LRU throttle, trusted-proxy CIDRs, avatar cleanup, versioned migrations, and session cleanup logging.
2026-08-22 12:16:59 -07:00
codegirl007
5bdaa8977f
Fix auth throttle DoS and serialize admin bootstrap.
...
Evict/cap limiter keys, replace hard username lockouts with IP+user progressive delays cleared on success, and create bootstrap admins under the same advisory/mutex lock as role changes.
2026-08-22 11:54:10 -07:00
codegirl007
59513ab75e
Harden auth: setup secret, throttling, session destroy, secure cookies.
...
Replace username-based admin bootstrap with a one-time setup secret, rate-limit login/register, equalize login bcrypt timing, cap passwords at 72 bytes, destroy sessions on logout, and require Secure cookies when PORT is set.
2026-08-22 11:47:42 -07:00
codegirl007
96b0ce795a
Address follow-up review: cheaper avatars, list limits, less chatter.
...
Switch avatar resize to ApproxBiLinear, cap hunt/profile/admin list queries, drop redundant admin/profile lookups, dedupe CI on app PRs, and refresh stale todo.md notes.
2026-08-22 09:55:32 -07:00
codegirl007
1a8c4eda14
Tighten avatar decode and encoded size limits.
...
Reject images over 1024px before pixel decode, resize down to 512 for storage, and cap re-encoded output at the upload byte limit.
2026-08-22 07:58:58 -07:00
codegirl007
f4cec32afb
Make web tests database-free and finish review hardening.
...
Introduce a Store interface with Postgres and in-memory backends, cover mutations/CSRF/session rotation without Postgres, bound avatar decode dimensions, add truncate/prepareAvatar unit tests, and run go test -race in CI.
2026-08-22 07:36:13 -07:00
codegirl007
afd2476f3c
Harden sessions, uploads, admin demotion, and HTTP timeouts.
...
Address PR review findings: renew session tokens on auth, sniff/re-encode avatars, serialize last-admin checks, bound server timeouts, rune-safe truncation, and TEST_DATABASE_URL-only integration tests.
2026-08-22 07:24:39 -07:00
codegirl007
247fb05281
Replace scs postgresstore with a sqlc-backed SessionStore.
...
Keep scs for cookies and session API while sessions DDL and queries live in the same sqlc stack as the rest of Postgres.
2026-08-22 07:11:47 -07:00
codegirl007
b519cf6fe5
Adopt sqlc for typed Postgres queries behind store entities.
2026-08-22 06:59:56 -07:00
codegirl007
c77298411e
Refactor Store into SessionStore; move domain SQL onto User/Question/Answer.
2026-08-22 02:40:51 -07:00
codegirl007
f31f352838
Remove remaining SQLite-only schema and docs residue.
2026-08-21 23:55:09 -07:00
codegirl007
a249965fc1
Rename Object to FileUpload; use native Postgres $n placeholders.
2026-08-21 23:53:00 -07:00
codegirl007
a36bc723cc
Move Spaces FromEnv into blob; Upload takes Object; drop logSpaces.
2026-08-21 23:48:18 -07:00
codegirl007
3eb75cfd80
Split main into openStore, newHandler, and run helpers.
2026-08-21 23:43:01 -07:00
codegirl007
3391cce7bd
Address PR review: graceful shutdown, Role/NewUser, drop SQLite.
2026-08-21 23:40:59 -07:00
codegirl007
d167b9216a
Initial commit: runnable Ask a Plumber First server.
2026-08-21 23:30:15 -07:00
codegirl007
7bc79af954
chore: empty master
...
Keep application work on feature branches for pull requests.
2026-08-21 23:29:10 -07:00
codegirl007