3 Commits

Include renames

Author	SHA1	Message	Date
mixandClaude Opus 5	ab2cd885c4	review follow-up: close the gaps left by the phase1-6 pass ... Verified the tree against docs/plans/code-review-2026-08.md and finished the tasks that were only partly done, plus two defects the pass introduced. - bcrypt: the setup account was still hashed at DefaultCost (10). The work factor now has one definition, auth.BcryptCost = 12, used everywhere. - rate limiter: protecting blocked buckets from eviction was unbounded — an attacker with many source addresses could grow the map by making each one fail its way to blocked. Blocked buckets are now evicted past maxBuckets * 4, nearest expiry first, logged once per window. Tests cover both halves. - postqueue: the 5s timeout left the output size unbounded; reads are now capped at 4 MiB and report truncation. - spec references: the ~76 `spec N` citations CHANGELOG [0.5.0] claimed were gone are removed from build/, deploy/, the first two migrations and the release workflow, with the affected comment paragraphs re-wrapped. Comments only; shell/YAML/SQL syntax re-checked. - schema-migrations.md: schema section was headed v9 with the chain at v10, and three links pointed at deleted plan files. - internal/configsafe: the shared empty/forbidden-character check behind the OpenDKIM and Postfix config writers; each writer keeps its own forbidden set. - dropped the parseDomainRateLimitForm/parseAppRateLimitForm pass-throughs left behind by the parser merge (only their own tests still called them). - plan doc now carries a status table: what shipped, what was already in place, what was declined (//go:build linux for the /proc reader) and the open CSRF-token question. Not done, each its own phase: typed template data structs, log/slog, DMARC service and handler tests, error-page/corrupted-backup tests, backup re-auth. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-19 20:03:05 +03:00
mixandCursor	02afa0fa80	fix(panel): code-review P6 optional cleanup ... Close the remaining low-risk items from the full-tree review: rename the settings handler, query assigned domains in SQL, bound the login limiter map, collapse panel.js show/hide helpers, and soften DMARC copy that promised a future in-panel receiver. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-14 14:48:43 +03:00
3 people	e6af1a7866	test: cover the auth, sign-in and RBAC surfaces P0 shipped through (P4) ... - internal/web/auth/ratelimit_test.go: the login/setup limiter's ceiling, per-address scope, window reset and the sweep that keeps finished buckets out of memory. - internal/web/auth/handlers_test.go: sign-in (session issued, refusals that do not reveal which usernames exist, a lockout a correct password cannot bypass, the setup hint before the first administrator) and the one-time setup link (creates the first global administrator and then closes, rejects a wrong or expired token, refuses credentials the panel would not accept later, rate-limited). - internal/web/handlers/authz_test.go: every global-only route answers a domain administrator — and a request with no principal — with 404, with a positive control so the table cannot pass on a handler that always 404s. This is the check that would have caught the send-log leak. - test/e2e: CoreDNS pinned to 1.14.6 instead of latest; the level-1 failure message quoted RATE_LIMIT_MESSAGES_PER_IP=5 while the stand sets 50. docs/plans/code-review.md P4 checked off except the optional backup-boot test; CHANGELOG updated. No production code changed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-13 23:35:46 +03:00