Harden API security: input validation, safe auth extraction, new tests, and deploy config
Comprehensive security hardening from audit findings: - Add validation tags to all DTO request structs (max lengths, ranges, enums) - Replace unsafe type assertions with MustGetAuthUser helper across all handlers - Remove query-param token auth from admin middleware (prevents URL token leakage) - Add request validation calls in handlers that were missing c.Validate() - Remove goroutines in handlers (timezone update now synchronous) - Add sanitize middleware and path traversal protection (path_utils) - Stop resetting admin passwords on migration restart - Warn on well-known default SECRET_KEY - Add ~30 new test files covering security regressions, auth safety, repos, and services - Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Trey t
@@ -2097,3 +2097,170 @@ func TestConsistency_OverduePredicateVsScopeVsRepo(t *testing.T) {
|
||||
}
|
||||
assert.Equal(t, expectedCount, len(repoTasks), "Overdue task count mismatch")
|
||||
}
|
||||
|
||||
// TestGetKanbanData_CategorizesCorrectly verifies the single-query kanban approach
|
||||
// produces correct column assignments for various task states.
|
||||
func TestGetKanbanData_CategorizesCorrectly(t *testing.T) {
|
||||
db := testutil.SetupTestDB(t)
|
||||
repo := NewTaskRepository(db)
|
||||
|
||||
user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
|
||||
residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
|
||||
|
||||
now := time.Date(2025, 6, 15, 0, 0, 0, 0, time.UTC)
|
||||
yesterday := now.AddDate(0, 0, -1)
|
||||
tomorrow := now.AddDate(0, 0, 1)
|
||||
nextMonth := now.AddDate(0, 1, 0)
|
||||
|
||||
// Create overdue task (due yesterday)
|
||||
overdueTask := &models.Task{
|
||||
ResidenceID: residence.ID,
|
||||
CreatedByID: user.ID,
|
||||
Title: "Overdue Task",
|
||||
DueDate: &yesterday,
|
||||
IsCancelled: false,
|
||||
IsArchived: false,
|
||||
Version: 1,
|
||||
}
|
||||
require.NoError(t, db.Create(overdueTask).Error)
|
||||
|
||||
// Create due-soon task (due tomorrow, within 30-day threshold)
|
||||
dueSoonTask := &models.Task{
|
||||
ResidenceID: residence.ID,
|
||||
CreatedByID: user.ID,
|
||||
Title: "Due Soon Task",
|
||||
DueDate: &tomorrow,
|
||||
IsCancelled: false,
|
||||
IsArchived: false,
|
||||
Version: 1,
|
||||
}
|
||||
require.NoError(t, db.Create(dueSoonTask).Error)
|
||||
|
||||
// Create upcoming task (due next month, outside 30-day threshold)
|
||||
upcomingTask := &models.Task{
|
||||
ResidenceID: residence.ID,
|
||||
CreatedByID: user.ID,
|
||||
Title: "Upcoming Task",
|
||||
DueDate: &nextMonth,
|
||||
IsCancelled: false,
|
||||
IsArchived: false,
|
||||
Version: 1,
|
||||
}
|
||||
require.NoError(t, db.Create(upcomingTask).Error)
|
||||
|
||||
// Create in-progress task
|
||||
inProgressTask := &models.Task{
|
||||
ResidenceID: residence.ID,
|
||||
CreatedByID: user.ID,
|
||||
Title: "In Progress Task",
|
||||
DueDate: &tomorrow,
|
||||
InProgress: true,
|
||||
IsCancelled: false,
|
||||
IsArchived: false,
|
||||
Version: 1,
|
||||
}
|
||||
require.NoError(t, db.Create(inProgressTask).Error)
|
||||
|
||||
// Create completed task (no next due date, has completion)
|
||||
completedTask := &models.Task{
|
||||
ResidenceID: residence.ID,
|
||||
CreatedByID: user.ID,
|
||||
Title: "Completed Task",
|
||||
DueDate: &yesterday,
|
||||
IsCancelled: false,
|
||||
IsArchived: false,
|
||||
Version: 1,
|
||||
}
|
||||
require.NoError(t, db.Create(completedTask).Error)
|
||||
completion := &models.TaskCompletion{
|
||||
TaskID: completedTask.ID,
|
||||
CompletedByID: user.ID,
|
||||
CompletedAt: now,
|
||||
}
|
||||
require.NoError(t, db.Create(completion).Error)
|
||||
|
||||
// Create cancelled task (should NOT appear in kanban columns)
|
||||
cancelledTask := &models.Task{
|
||||
ResidenceID: residence.ID,
|
||||
CreatedByID: user.ID,
|
||||
Title: "Cancelled Task",
|
||||
DueDate: &yesterday,
|
||||
IsCancelled: true,
|
||||
IsArchived: false,
|
||||
Version: 1,
|
||||
}
|
||||
require.NoError(t, db.Create(cancelledTask).Error)
|
||||
|
||||
// Create archived task (should NOT appear in active kanban columns)
|
||||
archivedTask := &models.Task{
|
||||
ResidenceID: residence.ID,
|
||||
CreatedByID: user.ID,
|
||||
Title: "Archived Task",
|
||||
DueDate: &yesterday,
|
||||
IsCancelled: false,
|
||||
IsArchived: true,
|
||||
Version: 1,
|
||||
}
|
||||
require.NoError(t, db.Create(archivedTask).Error)
|
||||
|
||||
// Create no-due-date task (should go to upcoming)
|
||||
noDueDateTask := &models.Task{
|
||||
ResidenceID: residence.ID,
|
||||
CreatedByID: user.ID,
|
||||
Title: "No Due Date Task",
|
||||
IsCancelled: false,
|
||||
IsArchived: false,
|
||||
Version: 1,
|
||||
}
|
||||
require.NoError(t, db.Create(noDueDateTask).Error)
|
||||
|
||||
// Execute kanban data retrieval
|
||||
board, err := repo.GetKanbanData(residence.ID, 30, now)
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, board)
|
||||
require.Len(t, board.Columns, 5, "Should have 5 visible columns")
|
||||
|
||||
// Build a map of column name -> task titles for easy assertion
|
||||
columnTasks := make(map[string][]string)
|
||||
for _, col := range board.Columns {
|
||||
var titles []string
|
||||
for _, task := range col.Tasks {
|
||||
titles = append(titles, task.Title)
|
||||
}
|
||||
columnTasks[col.Name] = titles
|
||||
}
|
||||
|
||||
// Verify overdue column
|
||||
assert.Contains(t, columnTasks["overdue_tasks"], "Overdue Task",
|
||||
"Overdue task should be in overdue column")
|
||||
|
||||
// Verify in-progress column
|
||||
assert.Contains(t, columnTasks["in_progress_tasks"], "In Progress Task",
|
||||
"In-progress task should be in in-progress column")
|
||||
|
||||
// Verify due-soon column
|
||||
assert.Contains(t, columnTasks["due_soon_tasks"], "Due Soon Task",
|
||||
"Due-soon task should be in due-soon column")
|
||||
|
||||
// Verify upcoming column contains both upcoming and no-due-date tasks
|
||||
assert.Contains(t, columnTasks["upcoming_tasks"], "No Due Date Task",
|
||||
"No-due-date task should be in upcoming column")
|
||||
|
||||
// Verify completed column
|
||||
assert.Contains(t, columnTasks["completed_tasks"], "Completed Task",
|
||||
"Completed task should be in completed column")
|
||||
|
||||
// Verify cancelled and archived tasks are categorized to the cancelled column
|
||||
// (which is present in categorization but hidden from visible kanban columns)
|
||||
// The cancelled/archived tasks should NOT appear in any of the 5 visible columns
|
||||
allVisibleTitles := make(map[string]bool)
|
||||
for _, col := range board.Columns {
|
||||
for _, task := range col.Tasks {
|
||||
allVisibleTitles[task.Title] = true
|
||||
}
|
||||
}
|
||||
assert.False(t, allVisibleTitles["Cancelled Task"],
|
||||
"Cancelled task should not appear in visible kanban columns")
|
||||
assert.False(t, allVisibleTitles["Archived Task"],
|
||||
"Archived task should not appear in visible kanban columns")
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user